Case Privacy Policy

1. Scope of this Privacy Policy

This Privacy Policy explains how Case processes information when you use the Case Discord bot, website, dashboard, ticket system, application system, transcripts, audit tools, and related functionality.

It applies to information processed by Case and does not replace Discord's own privacy policy.

Case is an independent application and is not Discord, Inc.

The exact data processed depends on the features enabled by a server and the actions users take.

2. Privacy principles

Case aims to process only information reasonably necessary to provide, secure, maintain, and support its stated functionality.

Case does not intend to build advertising profiles from Discord API data.

Case does not sell Discord API data.

Case does not intentionally use Discord API data for unrelated advertising or data-broker purposes.

Case seeks to limit access to information based on server permissions and dashboard authorization.

3. Discord OAuth account information

When you sign in with Discord, Case may receive information made available through the OAuth scopes you authorize.

This may include your Discord user ID, username, global display name, avatar information, and servers associated with the authorized account where permitted by Discord.

Case uses this information to authenticate you, display your account, determine which server dashboards you may access, and enforce dashboard permissions.

Case does not need your Discord password and you should never provide your Discord password to Case.

OAuth access credentials and sessions are treated as security-sensitive information and should not be shared.

4. Server and bot information

Case may process Discord server identifiers, names, icons, roles, role identifiers, channels, channel identifiers, categories, permissions, emojis, and other configuration data necessary for enabled features.

Case may cache some Discord API information for performance, reliability, and rate-limit management.

Cached information may become temporarily stale and can be refreshed or replaced as Case communicates with Discord.

5. Ticket information

Case may process ticket channel identifiers, opener identifiers, staff identifiers, status, ticket type, category, timestamps, claims, close events, and related ticket metadata.

When authorized ticket viewing is used, Case may retrieve and display ticket message content and message metadata from Discord.

Message metadata may include author identifiers, names, avatars, timestamps, attachment information, and Discord message identifiers.

Case uses ticket information to provide support workflows, live dashboard ticket views, replies, closing, transcripts, records, and security or audit functionality.

6. Dashboard replies

When an authorized staff member sends a ticket reply through the dashboard, Case processes the submitted text in order to validate and transmit it to Discord through the Case bot.

Case may apply safety or language filters before transmission.

Blocked messages may generate an audit event describing that an attempted reply was blocked without needing to preserve the prohibited text itself.

Successful dashboard replies may generate an audit event indicating that Case sent a message to the relevant ticket.

7. Language filtering

Case may inspect dashboard-submitted message text for configured profanity, discriminatory language, harassment, or other blocked terms.

This processing is performed to enforce dashboard safety controls.

Case may mask blocked terms when displaying Discord messages in the dashboard.

Automated filtering is imperfect and may produce false positives or miss harmful content.

8. Transcript information

If transcript functionality is used, Case may store a snapshot or structured record of ticket content needed to provide the transcript.

A transcript may include message text, author information, timestamps, ticket identifiers, attachments or attachment references, and close metadata.

Transcripts are intended for support records and should not be used for unrelated profiling or surveillance.

Transcript access may be limited, expired, or deleted when no longer necessary or when required by applicable rules or law.

9. Application information

Case may process application form configuration, questions, answers, applicant Discord identifiers, reviewer actions, application status, timestamps, and role-assignment information.

Application questions are created by server administrators, not by Discord.

Server administrators should not request passwords, authentication codes, financial credentials, protected health information, or other unnecessary sensitive information.

Application information is used to provide the server's configured application workflow.

10. Dashboard permissions

Case may store which Discord users or roles are allowed to access dashboard features.

Permission records may include Discord user IDs, role IDs, and capability names such as viewing, ticket management, replies, applications, settings, or permission management.

These records are used to authorize dashboard access and reduce unauthorized disclosure or changes.

11. Audit and activity logs

Case may store dashboard and bot activity records for security, troubleshooting, accountability, support, and administration.

Dashboard audit records may include server ID, actor ID, actor name, action, target, details, and timestamp.

Bot-related records may include ticket events, application events, transcript events, blacklist changes, or other operational records.

The dashboard may provide filters to search or categorize these records.

Case may limit the number of records shown or retained.

12. Terms acceptance records

Case may record that a Discord user accepted the Case Terms or Privacy Policy.

Acceptance records may include Discord user ID, server ID where applicable, acceptance time, Terms version, and Privacy Policy version.

Case uses these records to determine whether a user must be shown an updated agreement before continuing.

Acceptance records do not remove rights that cannot legally be waived.

13. Website and session information

Case may process ordinary technical information needed to operate a website and authenticated dashboard.

This can include session identifiers, request information, timestamps, security events, browser-related information, and network information made available to the service infrastructure.

Session cookies or similar mechanisms may be used to keep users signed in and protect dashboard requests.

Authentication cookies and session identifiers should be treated as confidential.

14. Information Case asks users not to submit

Do not submit Discord passwords, account tokens, session cookies, two-factor authentication secrets, one-time login codes, banking credentials, payment-card secrets, government authentication credentials, or malware through Case.

Do not use Case forms to intentionally collect protected health information or highly sensitive personal data unless the collection is specifically lawful, permitted by Discord, and necessary for an approved feature.

If Case receives information it should not have received, it may remove or restrict that information where reasonably possible.

15. Purposes for processing

Case processes information to authenticate users and determine server access.

Case processes information to create and manage tickets.

Case processes information to display and send authorized support messages.

Case processes information to generate and display transcripts.

Case processes information to run server applications and reviewer workflows.

Case processes information to apply permissions and security controls.

Case processes information to provide audit history and operational logs.

Case processes information to prevent abuse, investigate failures, enforce terms, and protect the service.

Case processes information to maintain, debug, and improve service reliability in ways consistent with Discord requirements and applicable law.

16. Legal bases where applicable

Depending on jurisdiction and context, processing may rely on performance of a requested service, legitimate interests in operating and securing Case, consent where required, or compliance with legal obligations.

The appropriate legal basis can vary based on the feature, the person involved, and the jurisdiction.

Server administrators may have separate legal obligations and legal bases for their own decisions about using Case in their community.

This Privacy Policy does not provide server administrators with a legal basis they do not otherwise have.

17. Data minimization

Case should not intentionally request or retain more Discord API data than is reasonably necessary for stated functionality.

Server administrators are expected to configure forms and ticket workflows in a data-minimizing manner.

Case may remove unused fields, reduce stored content, aggregate information, or limit history when appropriate.

18. Data sharing

Case does not sell Discord API data.

Case does not disclose Discord API data to advertising networks or data brokers.

Information may be processed by service providers that help operate Case, such as hosting, networking, database, security, or infrastructure providers, where permitted and subject to applicable requirements.

Information may be disclosed when required by valid law, legal process, or regulatory obligations.

Information may be shared when a user expressly directs an authorized Case function to share it, such as intentionally generating or sharing a transcript link, subject to applicable rules.

Case may share information with Discord where required for platform compliance, security incidents, abuse investigations, or developer obligations.

19. Service providers

Case may rely on third-party infrastructure to host the website, bot, database, networking, domain, monitoring, or related service components.

Service providers should receive only the information reasonably necessary to perform their service.

Provider availability, locations, and subprocessors can change as Case's infrastructure evolves.

Case will update this Policy when a material change requires additional disclosure.

20. International processing

Depending on hosting and service-provider infrastructure, information may be processed in countries other than the country where a user lives.

Where applicable law requires safeguards for international transfers, Case will seek to use appropriate safeguards.

Discord separately controls its own international processing under Discord's policies.

21. Retention

Case aims to retain Discord API data only for as long as reasonably necessary for the functionality for which it was obtained, unless law requires a longer period.

Different records can have different retention needs.

Live API caches may be retained for relatively short periods and refreshed automatically.

Ticket metadata may remain while needed for ticket history and administration.

Transcript records may remain while needed for the server's configured support-record functionality.

Application records may remain while needed for application history or administration.

Audit and security logs may remain while reasonably needed to investigate actions, protect accounts, and maintain accountability.

Terms acceptance records may remain while needed to prove and enforce the accepted policy version.

Case may delete or anonymize records when they are no longer needed or when deletion is required.

22. Deletion requests

Users may request deletion or modification of personal data processed by Case where applicable.

Requests should be submitted through the official Case support or privacy contact method made available on the website or dashboard.

A request should identify the relevant Discord account or server without sending passwords, tokens, or other authentication secrets.

Case may verify identity before deleting or disclosing protected information.

Case may need to distinguish data controlled by Case from information that remains independently stored by Discord.

Deleting Case data does not automatically delete the original Discord messages or data controlled by Discord.

Case may retain limited information when legally required or when another lawful exception applies.

23. Server removal and discontinued use

Removing the Case bot from a server stops future bot functionality for that server unless Case is later re-added.

Case may delete server-related API data when it is no longer necessary for permitted functionality.

Some security, legal, or acceptance records may be retained where permitted and necessary.

If Case permanently stops operating, stored Discord API data should be deleted as required by Discord's Developer Terms and applicable law.

24. Discord requests

Case may update or delete Discord API data when Discord requests it and the request is applicable under Discord's Developer Terms.

Case may cooperate with Discord audits, app reviews, compliance requests, and security investigations as required by the Developer Platform rules.

25. Security safeguards

Case uses technical and administrative controls intended to reduce unauthorized access to service data.

Access to protected dashboard features is authenticated and checked against configured permissions.

Case may cache authorization information to improve performance while applying expiration or refresh behavior.

Sensitive application secrets should be stored in protected environment configuration rather than displayed to dashboard users.

Case may log security-relevant administrative actions.

Case may block dangerous or abusive dashboard input.

No security system can guarantee that unauthorized access will never occur.

26. Security incidents

If Case becomes aware of unauthorized access to personal or Discord API data, Case may investigate, contain, remediate, rotate credentials, invalidate sessions, restrict features, or take other protective steps.

Case will provide notifications required by applicable law.

Case will notify or cooperate with Discord regarding API-data incidents when required by Discord's Developer Terms.

Users should report suspected vulnerabilities responsibly and should not exploit them to access other users' or servers' information.

27. User rights

Depending on where you live, privacy law may provide rights to access, correct, delete, restrict, object to processing of, or receive a portable copy of certain personal data.

Some rights are subject to legal exceptions and identity verification.

Where processing is based on consent, applicable law may provide a right to withdraw that consent.

Where applicable, you may have the right to complain to a competent data-protection authority.

Exercising a privacy right should not require you to disclose your Discord password or authentication token.

28. Children and age restrictions

Case is not intended to bypass Discord's age requirements.

Case must not be directed to people below Discord's applicable minimum age or the minimum age required by law in their jurisdiction where higher.

Case should not knowingly be used to collect Discord API data about people whom the Developer Platform rules prohibit Case from processing.

If prohibited underage data is identified, Case may delete it and take appropriate steps.

29. Automated moderation

Case may automatically evaluate text against blocked-term rules.

Automated moderation is used as a safety and administration aid rather than as a guarantee of correctness.

Server staff should review context before making serious moderation decisions based solely on automated filtering.

30. No advertising profiling

Case does not intend to use Discord API data to create behavioral advertising profiles.

Case does not sell Discord API data to advertisers or data brokers.

Case should not use ticket, application, transcript, or audit content to target unrelated advertising to Discord users.

31. Data accuracy

Some Case information comes from Discord and may change when a user changes their name, avatar, roles, server membership, or other account information.

Cached information can temporarily differ from current Discord information.

Case may refresh API data when needed for functionality or when a user or Discord requests an appropriate update.

32. Administrator privacy obligations

Server administrators decide many of the purposes for which their communities use Case.

Administrators should tell community members how tickets, applications, transcripts, and logs are used where applicable.

Administrators should restrict staff access and remove unnecessary permissions.

Administrators should not retain or export Case information longer than necessary for their own legitimate purpose.

Administrators are responsible for complying with laws that apply independently to their community's processing decisions.

33. External links and attachments

Tickets and transcripts may contain links or attachments hosted by Discord or third parties.

Opening external links or attachments may cause the third party to process information under its own policies.

Case is not responsible for the independent privacy practices of third-party websites.

34. Changes to this Privacy Policy

Case may update this Privacy Policy when functionality, data practices, infrastructure, Discord requirements, or applicable law changes.

The effective date and version identifier will be updated for material revisions.

Case may require users to review or accept a new version before continuing to use protected dashboard functionality.

Material changes should be reflected in the publicly available Privacy Policy used for the Discord application.

35. Contact

Privacy questions, data requests, and security reports should be sent through the official Case support or privacy contact method provided on the Case website or dashboard.

Do not send passwords, bot tokens, OAuth client secrets, session cookies, or one-time authentication codes in a privacy request.

Case may request reasonable verification before providing, modifying, or deleting protected records.

Case owner security records

When a user signs in to the Case website, Case may record the connecting IP address, Discord user ID, username, browser user-agent, and login time for security, abuse prevention, and account-access review.

Raw security records are restricted to the configured Case owner account and are not displayed to normal server administrators or delegated dashboard users.

Case automatically removes these owner security login records after 90 days unless a shorter period is required by configuration or applicable law.

A shared network or IP address is only a security review signal and is not treated as proof that two Discord accounts belong to the same person.