Privacy Policy
Last updated: November 2026
1. Overview
Kiwora ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data when you use the Kiwora Discord bot or dashboard at kiwora-dashboard.vercel.app.
2. Data We Collect
We collect the data Kiwora needs to run its features and to support you: About your server • Server (guild) IDs and names, and the settings you choose in the dashboard • When Kiwora was added and removed, and whether setup was completed About members of a server • Discord user IDs • Member join and leave history (user ID, server ID, time), kept only for servers on a plan that includes member analytics (Creator+ plan and above) • Last-activity records (when a member last sent a message or was in voice; no message or voice content) • Command logs (command name, user ID, server ID, time) • Role-assignment logs (which role was added or removed, and whether it worked) • XP, level, loyalty-point, shop, quest and giveaway records, and leaderboard data • Birthdays, as month and day only, if a member sets one • Vote records (top.gg votes: user ID, time, vote totals) • Text that people type into Kiwora features: suggestions, polls, giveaway or exit-survey answers About people who sign in to the dashboard • Your Discord user ID, username and avatar when you sign in (kept in your session cookie), and a cached copy of the list of servers you are in so pages load faster • Reports and messages you send through Report a Problem, including any screenshots you attach. Replies you send to Kiwora by direct message about a report are saved with it, screenshots are copied into our file storage, and each reply is also forwarded to our operator's Discord direct messages • Usernames and user IDs in our billing records Billing • Subscriptions are handled by Stripe. We store Stripe's customer and subscription IDs, your plan, status and renewal or cancellation dates, and a log of billing events. We never see or store card details. What we do NOT store • The text of messages sent in your server (beyond features that ask people to type text, listed above). Kiwora counts a message's characters and attachments for the XP settings you turn on, and does not keep the text • Members' usernames, nicknames or avatars in member records. Kiwora reads a member's name and avatar only to show them in messages it posts (welcome, goodbye, level-up and re-engagement messages, rank cards and custom commands), and does not keep them • Voice or audio content • Email addresses (Stripe collects the email you give at checkout) • Card or bank details • Passwords
3. How We Use Your Data
The data we collect is used exclusively to: • Operate and improve Kiwora's features (leveling, welcome messages, themes, announcements) • Display your server's configuration and statistics in the dashboard • Process subscription payments through Stripe • Debug issues and monitor bot health • Provide leaderboard and XP ranking features to your server members
4. Data Storage and Security
Your data is stored securely in Supabase, a trusted cloud database provider. We use industry-standard security practices including encrypted connections and access controls. Payment data is handled entirely by Stripe and is never stored on our servers.
5. Data Sharing
We do not sell or rent your data. We use these service providers to run Kiwora: • Stripe — for processing subscription payments • Supabase — for secure data storage • Vercel — for hosting the dashboard • Railway — for running the bot • Sentry — for receiving error reports from the dashboard, which can include the page address (it contains your server's ID), browser and device details, and the steps leading up to the error, and error reports from the bot, which can include server and user IDs and the text of the error Our hosting providers may process technical data such as IP address and browser information when you use the dashboard or bot. All providers are bound by their own privacy policies and applicable data protection laws.
6. Data Retention
We keep your data while Kiwora is in your server. If Kiwora is removed from your server, we keep your server's settings. Server activity data for XP and levels, loyalty points, the shop, quests, suggestions and giveaways is deleted 90 days after removal. Quest progress is deleted 30 days after the Quests, Server-Wide or Chains setting is switched off. Older progress on repeating quests is also trimmed automatically; we keep at least the latest 90 days. Other records, such as activity and command logs, level-role records and birthdays, are kept until deleted on request. Member join and leave history is recorded only while a server is on a plan that includes member analytics (Creator+ plan and above); if a server moves to a lower plan, recording stops and the history already recorded is kept until deleted on request. We plan to add automatic deletion of older logs. Error and diagnostic records, and reports sent to us, are kept until we delete them.
7. Discord OAuth2
When you log in to the Kiwora dashboard, we use Discord's OAuth2 system to authenticate you. We receive your Discord user ID, username, avatar, and the list of servers you are in; the dashboard shows the ones you can manage. We do not receive your email address, password, or payment information from Discord. Your sign-in tokens are kept in your browser's session cookie. When Discord requires them to be refreshed, the new tokens pass through our database while the refresh completes and are removed from it within a day at the latest. We use this information to sign you in and show you the correct servers.
8. Children's Privacy
Kiwora is not intended for use by anyone under the age of 13, in accordance with Discord's Terms of Service. We do not knowingly collect data from users under 13. If you believe a user under 13 has used Kiwora, please contact us and we will take appropriate action.
9. Your Rights
You have the right to: • Request a copy of the data we hold about you • Request deletion of your data • Opt out of XP tracking with the /xp-optout command in Discord. This stops new XP tracking for you in that server; it does not delete XP data already stored. • Remove your birthday with the /birthday clear command. Anyone else (for example a server owner) can ask us to remove a birthday through a privacy request. • Remove Kiwora from your server at any time To make a data or privacy request, send it through Report a Problem on the Kiwora dashboard and choose "Data / privacy request". We may ask you to confirm that you are the server owner or the person the data is about before we act. We aim to act within 30 days, except for billing records we must keep by law. Help > Report a problem in the dashboard is the only way to send one.
10. Cookies
The Kiwora dashboard uses cookies to sign you in: a session cookie that keeps you logged in (for up to 30 days) and short-lived cookies used while you log in with Discord. Your browser's local storage keeps display choices and shortcuts such as your theme, your last server, a cached copy of your server list, collapsed cards and tour progress. We use one first-party cookie to remember which link brought you to Kiwora (for example, a social media post). It stores only that short campaign name, never who you are, and expires after 7 days. A second copy lasts 15 minutes after you press Add to Discord so we can match the link to the server you add. We do not use advertising or cross-site tracking cookies. Discord's login page and Stripe Checkout are run by those companies and set their own cookies under their own policies.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will update the "last updated" date at the top of this page when changes are made. Continued use of Kiwora after changes are posted constitutes your acceptance of the revised policy.
12. Contact Us
For data or privacy requests, use Report a Problem on the Kiwora dashboard and choose "Data / privacy request". Questions about this policy go the same way: Help > Report a problem.