Privacy Policy
Effective 1 October 2026
This explains what LobbyForge stores about you, why, and what you can do about it. It is written for the person running a Discord server, not for a lawyer, so it names the actual tables and columns rather than talking about "certain information".
There are two kinds of people in this policy: dashboard users, who sign in with Discord to design layouts, and server members, who never sign in and only ever press a button in Discord. We store much less about the second group.
What we collect, and why
If you sign in to the dashboard
| What | Why |
|---|---|
| Your Discord user id, username, display name, avatar hash and locale | To identify you, show who you are in the dashboard, and record who made a change. Comes from Discord's basic profile permission. |
| Your Discord refresh token, encrypted, and its expiry | So we can refresh your server list without making you sign in again. See "How this is protected" below. |
| The list of servers you can administer: server id, name, icon hash, your permission bits, whether you own it, and when we last checked | To show you the right servers. Cached rather than re-fetched on every request, and refreshed regularly so that losing Manage Server in Discord removes your dashboard access within minutes. Comes from Discord's server-list permission. |
| A session record: a hash of your session token, a truncated hash of your IP address, your browser's user-agent string, and creation, expiry and revocation times | To keep you signed in, and to notice a session that suddenly moves to a different network. The IP address itself is never written down. |
| Short-lived OAuth state: a random state value, which flow it was for, where to send your browser afterwards, and a PKCE verifier | Anti-CSRF for the Discord sign-in and bot-invite flows. Single use, and valid for ten minutes. |
| Subscription records: which plan, the status, and the customer and subscription ids given to us by the payment processor | To know what you have paid for. We never receive or store card numbers. |
Sign-in deliberately does not request Discord's email permission, so Discord does not give us your email address and the column stays empty. If that ever changes, this policy changes with it.
About your Discord servers
| What | Why |
|---|---|
| Server id, name, icon hash, approximate member count, when the bot joined or was removed, who installed it, and when the bot last checked in | To run the bot, show install state, and produce aggregate usage figures. Member counts are only ever published as a total across all servers — never per server. |
| Channel routing and options: category, announce, panel, hub and asset channel ids, the panel message id, your on/off settings, locale, and the panel design document | So the bot knows where to post and what the panel looks like. Records who last changed them. |
| Layouts: the draft you are editing and every published revision, plus the difference between revisions, and which user created, updated or published each one | This is the product. Revision history is what makes publish and rollback safe, and lets an open lobby keep rendering with the design it was created under. |
| Images you upload, or a Discord upload link you paste, for a layout or panel: the image itself, its type, size and checksum, which slot it was for, its public address, and who uploaded it | Artwork has to be reachable by URL for Discord to render it, and Discord's own upload links stop working after about a day. We keep a copy and serve it from lobbyforge.net so it keeps working. Anyone with the address can view the image, just as anyone in your server sees it in the panel. |
| An audit trail: the action taken, what it was taken on, which user or system took it, a small detail object, and the time | Powers the activity panel in your dashboard, answers "who deleted our layout" for support, and lets us investigate abuse. |
About people who use lobbies in Discord
| What | Why |
|---|---|
| For each lobby: the Discord user id of the host, and the list of Discord user ids currently in it | To know who may edit or close a lobby, to render the roster in the embed, and to close a lobby once it empties. |
| The lobby itself: voice channel id, announce channel and message ids, the join link, the chosen field values, party size, extra slots, the free-text note, and the open/close times and reason | To render and manage the lobby, and to tell the reaper when to close it. |
Note that the free-text note on a lobby is written by a member and shown publicly in your server. Whatever they type there is stored.
What we deliberately do not collect
- Message content. The bot does not read your channels.
- Your server's member list. The bot does not use Discord's privileged members intent. It only ever learns about someone when they interact with a lobby.
- Voice audio. The bot creates and deletes voice channels. It never joins one and never listens.
- Raw IP addresses. Only a truncated hash is stored.
- Passwords. There are none — sign-in is Discord OAuth, so there is nothing for us to leak.
- Advertising or analytics trackers. There are no third-party tracking scripts on the dashboard.
Why we are allowed to hold it
Where data protection law such as the UK/EU GDPR applies, we rely on:
- Performance of a contract — for account data, sessions, your servers, your layouts and your subscription. Without these the Service cannot work at all.
- Legitimate interests — for the audit trail, session security data and aggregate usage counts. Our interest is keeping the Service secure, supportable and working; we keep the data minimal to balance that against your privacy.
- Consent — you choose to connect Discord, you choose which servers to install the bot into, and you can disconnect by removing the bot and asking us to delete your account.
- Legal obligation — where we have to keep records, for example for tax on paid plans.
For lobby data inside your server, you are the one deciding it should exist and we are running the system on your behalf. If you are subject to the GDPR, you should treat yourself as the controller for your server's data and us as a processor acting on your instructions.
How this is protected
- Discord refresh tokens are encrypted at rest. They are encrypted in the application, using authenticated encryption, before they are written to the database. The encryption key is held separately from the database and is deliberately not stored in it, so a database backup on its own is not a pile of usable Discord credentials.
- Session tokens are stored only as hashes. Your session cookie holds a 256-bit random token. What we store is its SHA-256 hash, compared in constant time. We cannot reconstruct your session token from our database, and a database leak does not hand an attacker a set of live sessions.
- IP addresses are hashed and truncated — SHA-256, cut to 16 bytes. Enough to notice that a session moved networks, not enough to be a record of where you live.
- Tenant isolation. Every query for server data is scoped to a server you have been verified to administer. Staff accounts bypass plan limits but do not bypass this — staff still only reach servers they administer in Discord.
- Traffic to the dashboard is served over HTTPS.
No system is perfectly secure, and we do not claim otherwise. If we become aware of a breach affecting your data we will tell you, and we will notify regulators where we are required to.
Cookies
The dashboard sets exactly one cookie, and it is strictly necessary — it is what keeps you signed in. There are no advertising, analytics or third-party cookies, so there is no consent banner to click through.
| Cookie | What it does |
|---|---|
| the session cookie | Holds your session token. Set when you sign in and cleared when you sign out. Lasts 30 days. Marked so that page scripts cannot read it, so it is only ever sent over HTTPS, and so it survives the redirect back from Discord but is not sent on cross-site requests. |
How long we keep it
We would rather tell you what actually happens today than quote a policy the code does not follow.
- Sessions expire 30 days after sign-in and stop working then. The row itself — a token hash, a truncated IP hash and a user-agent string, none of which can be used to sign in — is deleted seven days after that by a sweep which runs every five minutes.
- OAuth state rows stop being valid after ten minutes and are single-use. The same sweep deletes them as soon as they expire.
- Your account and layouts are kept while your account exists. Nothing you author is hard-deleted by the product: deleting a layout marks it deleted so support can undo an accident, and removing the bot from a server keeps that server's designs so re-inviting restores everything.
- Uploaded images are kept while a layout or panel uses them. Once a server has 40, uploading another deletes its oldest images that no layout, published version or panel still uses.
- Cached server-access records are refreshed continually and removed when you lose access.
- Lobby records, including the host's Discord user id and the list of member ids, are deleted 90 daysafter the lobby closes. Open lobbies are never touched by this.
- Audit events — which user took which action on which server, and when — are deleted after one year.
If you want any of the above removed sooner, ask — see "Your choices" below.
Who else sees it
We do not sell your data and we do not share it for advertising. It is handled by:
- Discord Inc. — the identity provider and the platform the bot runs on. Everything the bot posts goes to Discord, and signing in sends you through Discord's OAuth. Discord's own Privacy Policy covers what they do with it.
- Our hosting provider — the Service and its Postgres database are hosted on Fly.io, with the primary region in Sydney, Australia. They hold the data at rest on our behalf.
- A payment processor — if and when paid plans go live, card details go straight to the processor and never reach us. We only keep the customer and subscription ids they hand back.
- Anyone we are legally required to disclose to — a valid court order, for example. We will tell you unless we are forbidden from doing so.
If LobbyForge is ever sold or merged, data may transfer as part of that. You would be told before it happened.
International transfers
Our servers are in Australia. Discord is based in the United States, so anything that passes through Discord — which is most of what the bot does — is processed there. If you are in the UK or the EU, using LobbyForge means your data leaves that region. Where the law requires a transfer mechanism such as Standard Contractual Clauses, we rely on the terms our providers offer.
Your choices
You can ask us to:
- Show you what we hold about you, in a readable form;
- Export it — we will send you your account record, your layouts and revisions, and your audit entries as JSON;
- Correct it — though most of it comes from Discord, so changing your Discord profile and signing in again is usually faster;
- Delete it — we will delete your account record and revoke your sessions and stored Discord token. Note the limits: content that belongs to a shared Discord server, such as layouts other administrators are still using and audit entries showing who did what, may be kept or anonymised rather than removed, because erasing it would delete another person's data too;
- Object to, or restrict, processing we base on legitimate interests.
Make any of these requests in the support Discord, or delete your account yourself from the dashboard. Deleting your account removes your record, your sign-in sessions and your stored Discord token immediately and permanently — there is no recovery. Layouts you designed stay with the server they belong to, no longer attributed to you, so that leaving does not destroy a server's setup for everyone else in it. For anything we handle by hand we aim to respond within 30 days, and we may need you to prove you control the account in question.
You can also simply stop: sign out to end your session, and remove the bot from a server to stop it collecting anything new there. If you are in the UK or EU you have the right to complain to your data protection authority.
Children
LobbyForge is not directed at children. Discord requires its users to be at least 13 — higher in some countries — and we rely on that: you cannot use LobbyForge without a Discord account. We do not knowingly collect data from anyone below that age. If you believe a child's data is in our system, tell us and we will remove it.
Changes to this policy
We will update this page when what we store changes. The effective date at the top always reflects the current version, and material changes will be announced in the dashboard or the support Discord.
Contact
Data questions, export requests and deletion requests all go to support@lobbyforge.net or the LobbyForge support Discord. Email gives you a written record; use it for anything you may need to point back to later.
Questions about this document? Ask in the support Discord or email support@lobbyforge.net.