Privacy Policy

1. What we collect

Account and identity

• Your Discord user ID, username, global display name, and avatar URL.
• Your email address, only if you granted the email OAuth scope.
• The timestamp of your first successful sign-in and of each later one.
• Session records: a session identifier, a device fingerprint, device label, platform, browser and version, and an approximate city/country derived at session creation.

Panindigan never receives or stores your Discord password. It stores an OAuth access/refresh token server-side so it can list the servers you can manage; that token is never sent to a browser.

Consent records

• The exact Terms of Service and Privacy Policy versions you accepted or declined.
• The timestamp, the surface you acted on, the request identifier, and a safe device/context reference.
• An append-only audit trail of acceptance, decline, re-consent, and revocation events.

We keep a raw IP address for no longer than needed to answer an abuse or security investigation, and we do not use it to build a profile.

Server and configuration data

• The Discord server ID, name, icon, owner, and member count.
• Panindigan configuration you set: prefix, language, timezone, system channels and roles, module enablement, moderation rules, welcome and Goodbye message templates, and automation definitions.
• Your role or permission level within each server.

Moderation, security, and support records

• Moderation cases: the action, the target member, the moderator, the reason, and the timestamps.
• Security events such as spam, link, invite, and raid detections.
• Ticket transcripts you or the ticket participants wrote, stored privately and reachable only through an authorised or deliberately shared link.
• Reports you submit, and the status of those reports.

These records exist so moderation decisions can be reviewed and reversed when they are wrong. They are not used for advertising.

Economy, games, and music

• Economy ledger entries and inventory, scoped to each server.
• Game sessions and results.
• Music history and playlists, and per-user privacy choices that switch history collection off.

Operational data

• Command execution records: which command ran, who ran it, when, how long it took, and whether it succeeded.
• Aggregated analytics and service health measurements used to run the platform.
• Billing records for purchased plans.

2. Message content

Panindigan does not read your messages across Discord. It accesses message content only where a feature you or your server administrators explicitly enabled requires it, for example:

• ticket transcripts, which read the ticket channel's messages when the ticket closes;
• channel or thread summarisation, which you must invoke and which requires the entitlement for the feature;
• purge and delete commands, which remove the messages you selected;
• link, invite, and spam filters, which examine messages as they arrive and store only the detection, not the message body.

AI features process content only when you invoke them, respect your opt-out, and are metered. Turning on AI opt-out stops eligible AI processing of your activity.

3. Why we process it

• To authenticate you and keep you signed in.
• To enforce the consent gate before any command runs.
• To operate, secure, and support the platform you are using.
• To enforce plans, entitlements, and rate limits.
• To meet legal, accounting, and billing obligations.
• To detect abuse, spam, and attacks.

We do not sell your personal data. We do not use it for third-party advertising. We do not build advertising profiles.

4. Who we share it with

• Discord — to authenticate you and to read the server data a feature needs.
• Cloudflare — DNS, CDN, WAF, Turnstile, and private object storage (R2) for transcripts and exports. Object storage is private by default and reached through short-lived signed links.
• Infrastructure providers — the database, cache, and queue hosts that run the platform, under contract and only to the extent needed.
• Payment providers — for plan purchases; we never receive or store card numbers.
• Third-party service providers you configure — only for the integrations your server administrators set up, and only the data those integrations require.
• Law enforcement or regulators — where we are legally required to disclose.

5. How long we keep it

Records you are legally required to keep — for example billing and consent audit records — survive an account deletion request and are stated as such in the confirmation prompt. Everything else eligible for deletion is removed.

6. Your controls

• Accept, decline, or withdraw consent at the consent center, at any time. Declining or withdrawing locks command access immediately.
• Disconnect Discord from account security settings. This revokes our token and ends every session.
• Sign out a session or sign out of all other sessions.
• Export your data from the dashboard's account privacy page.
• Delete your Panindigan account from the Danger Zone. This does not delete your Discord account.
• Opt out of AI processing with the AI opt-out command.
• Adjust music history and recommendation privacy from social and music settings.

7. Security

Data is encrypted in transit with TLS. Passwords and secrets are held as deployment secrets, never in source code, configuration files, or browser assets. The Discord bot token is never exposed to a browser or written into logs. Administrative actions, moderation actions, and consent decisions are recorded in append-only audit logs. Access to operator tooling requires a separate, allowlisted identity.

No system is perfect. If you discover a vulnerability, please report it through the security page.

8. Children

Panindigan is not directed at children under 13, or under the minimum age of digital consent where that is higher. We do not knowingly collect data from children who are below that age.

9. Changes to this policy

When this policy changes, the version number and effective date at the top of this page change, the change is recorded in the changelog, and you are asked to accept the new version. Command access stays locked until you accept.

10. Contact

Privacy questions and data-subject requests can be raised through the contact page or the support center.