Privacy Policy

1. Data We Collect

We collect the minimum data necessary to operate Fresher Bot. The categories of data we hold are:

• Account data: Your Discord user ID, username, discriminator (if applicable), email address (if shared via OAuth), and avatar hash.
• Economy data: Your FreshCoin balance, plan tier, plan expiry date, Premium Keys you own, and reward claim timestamps.
• Server (guild) data: Server IDs and configuration settings for servers where you have added Fresher Bot. We store only the configuration you explicitly set — we do not read or archive message content.
• Ticket data: Ticket metadata (ticket ID, status, assigned staff, timestamps). Ticket transcript content is stored only if transcript logging is enabled by the server administrator.
• Transaction records: Payment reference IDs (from Razorpay or PayPal), amounts, dates, and the product purchased. We do not store card numbers or bank details.

2. Discord OAuth

We use Discord's OAuth 2.0 system to authenticate users. When you sign in, Discord shares the following with us (depending on the scopes you authorise): your user ID, username, email address, and avatar. We do not receive your Discord password.

We store an encrypted access token and refresh token to maintain your session and to re-fetch updated profile data when your session expires. These tokens are stored securely in our database and are never exposed to the client browser.

Discord is a data processor for authentication purposes. Their privacy practices are governed by Discord's Privacy Policy.

3. Payments

Payment processing is handled by two third-party processors:

• Razorpay — processes INR payments for subscriptions, two-week plans, and FreshCoin packages. Razorpay stores payment instrument details. We receive only a payment ID, order ID, and signature for verification purposes.
• PayPal — available as an alternate processor for Pro and Deluxe monthly subscriptions. PayPal stores your billing information. We receive a subscription ID and payer ID for verification.

We retain transaction records (amount, product, reference ID, date) for accounting and dispute resolution purposes for up to 7 years as required by applicable financial regulations. Detailed card or bank data is never transmitted to or stored by us.

4. Cookies

We use the following types of cookies and local storage:

• Session cookie: A secure, HTTP-only cookie set by NextAuth.js to maintain your login session. This cookie is strictly necessary and cannot be opted out of while using the dashboard.
• CSRF token: A short-lived token to prevent cross-site request forgery attacks.
• Theme preference: Stored in localStorage to remember your display settings between sessions. Contains no personal data.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not share cookie data with advertisers.

5. Retention

We retain your personal data for as long as your account is active. Specifically:

• Account data: Retained until you request account deletion.
• Economy and key data: Retained with your account. Deleted when your account is deleted.
• Ticket transcripts: Retained for 90 days after ticket closure, or until the server administrator purges them, whichever comes first.
• Transaction records: Retained for 7 years for legal and accounting purposes, even after account deletion.
• Access and refresh tokens: Rotated on each session refresh. Invalidated when you sign out or delete your account.

6. Sharing

We do not sell, rent, or trade your personal data to third parties. We share data only in the following limited circumstances:

• Payment processors: Razorpay and PayPal receive transaction data as described in Section 3.
• Discord: Fresher Bot interacts with the Discord API to send messages, manage server settings, and retrieve guild data on your behalf.
• Legal requirements: We may disclose data if required by law, court order, or governmental authority.
• Business transfer: In the event of a merger or acquisition, your data may be transferred as part of that transaction. We will notify users in advance.

7. Security

We implement technical and organisational measures to protect your data, including: encrypted database connections (TLS), HTTP-only session cookies, CSRF protection, server-side input validation, and rate limiting on all API endpoints.

No system is completely secure. If you discover a security vulnerability, please report it responsibly via our support server rather than publicly disclosing it. We commit to acknowledging valid reports within 72 hours.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and associated data (excluding transaction records retained for legal reasons).
• Portability: Request an export of your data in a machine-readable format.
• Objection: Object to processing of your data in certain circumstances.

To exercise any of these rights, contact us through the support server with your Discord username and the nature of your request. We will respond within 30 days.

9. Children

Fresher Bot is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. Discord itself requires users to be at least 13 years old in most jurisdictions, and our authentication relies on Discord OAuth, which enforces this requirement.

If you believe a child under 13 has provided us with personal data, please contact us immediately. We will delete the relevant data as quickly as practicable.

10. Contact

For questions, data requests, or privacy concerns, please contact us through our support server: discord.com/invite/rMrXQnYsfA. Please include "Privacy Request" in your opening message so we can route your query to the right person.

We do not have a physical mailing address for correspondence at this time. All privacy-related communications should go through our support server.