Privacy Policy

1. Scope of Application

This policy applies to the Service's website, API, and all related features. By using the Service, you are deemed to have agreed to this policy.

2. Information We Collect

The Service collects and uses the following information.

2.1 Information Obtained at Authentication (Discord OAuth2)

We use Discord's authentication (OAuth2) for login. In doing so, we obtain the following information from Discord.

2.2 Information Stored by the Service

• User information: Discord ID, username, discriminator, avatar URL, display language, created/updated timestamps. Access tokens received from Discord at login are stored encrypted.
• Server (guild) information: Discord server ID, name, icon URL, etc. (for access permission determination)
• File-related: Metadata of uploaded files (file name, size, type, uploader, destination server and channel, share link/token, etc.). File contents are stored in external storage (Cloudflare R2).
• Upload sessions: Session ID, expiration, status, etc. for uploads started from the web or from Discord's /upload (temporary processing)
• Access records: IP address, user agent, and time of login sessions, share link views, and file downloads (to prevent abuse and investigate failures)
• Paid plan information: Customer ID at our payment provider (Stripe), subscription status, and the subscribed server. We do not store card numbers or other payment details.

2.3 Information Held on Browser/Device

• Session cookie: We use cookies whose names contain better-auth to keep you logged in (expires up to 24 hours after last use, HttpOnly, Secure).
• Local storage / session storage: We may store your display language (i18nextLng) and temporary values used to avoid duplicate login handling and measurement (keys starting with disco). Authentication tokens are not stored in browser storage.

3. Purposes of Use

• Providing the Service (authentication, file list display, streaming, upload, posting to Discord, share link management, paid plans)
• Permission management to limit uploads and management actions to the Discord servers the user belongs to
• Processing necessary to operate and improve the Service (error investigation, load measures, usage analysis, etc.)
• Compliance with laws and regulations

4. Third-Party Provision and External Services

• Discord: We send requests to the Discord API for authentication, to obtain joined server information, and to post files. Discord's privacy policy applies.
• Cloud storage (Cloudflare R2): Used to store the contents of uploaded files.
• Hosting and database: The Service runs on cloud services such as Google Cloud Run, Cloudflare Pages, and Amazon Web Services (database), and those providers' terms and data processing apply.
• Payments (Stripe): We use Stripe, Inc.'s checkout for paid plans. Payment information is handled by Stripe, and Stripe's privacy policy applies.
• Analytics (Google Analytics): We use Google Analytics 4 to understand how the Service is used. Google Analytics uses cookies, and while you are logged in we send a one-way hash of your user ID within the Service to distinguish users. Data is handled under Google's policies.

Other than as stated above, we do not sell or transfer data that identifies individuals to third parties without user consent.

5. Data Retention

• User, guild, and file metadata: Retained for the period necessary to provide the Service, or until the user deletes it.
• Sessions and upload sessions: Deleted or invalidated after expiration.
• Server logs: May be retained for a certain period for operation and incident investigation.

6. Security

• We use HTTPS and the Secure attribute of session cookies for authentication.
• Login sessions expire, and you need to log in again after expiration. Tokens received from Discord are stored encrypted.
• Access to the database and storage is limited to what is necessary for the Service.

7. Your Rights

You can invalidate your login session by logging out. If you wish to request disclosure, correction, deletion, or suspension of use of your stored personal data, please contact us via "9. Contact".

8. Cookies and Local Storage

We use a session cookie to keep you logged in, store your display language, and use cookies for analytics (Google Analytics). We do not currently use cookies for advertising or behavioral targeting.

9. Contact

For questions or requests regarding this policy or the handling of personal information, please contact the operator of the Service. (Contact details are provided in "Help" or as designated by the operator.)

10. Revisions

This policy may be revised as needed. For material changes, we will notify you via the Service or by updating the last-updated date. Use of the Service after a revision constitutes acceptance of the revised policy.