Privacy Policy

Last updated: October 11, 2026

This policy explains what AutoAuth (“the bot”, “we”) collects, why, and the choices you have. AutoAuth is a Discord bot and website operated by civwest at https://autoauth-hbsb.onrender.com.

1. What we collect

When you use /auth and approve the Discord authorization, we receive and store:

• Your Discord user ID and username (or display name).
• An OAuth2 access token and refresh token for your account, limited to the identify and guilds.join scopes. Both tokens are stored encrypted (AES-256-GCM).
• The token expiry time and the time you authorized.

We do not receive your email address, password, messages, friends list, or the list of servers you are in.

When commands are used we also keep an audit log: the command used, the Discord user ID of the person who ran it, the server ID and name, and the outcome (for example, how many members were added). When an owner signs in to the private dashboard, we log the sign-in and IP address, and set a session cookie that is used only for that dashboard. Visitors to the public pages receive no cookies from us.

2. How we use it

• To add you to a Discord server when a server administrator runs /addusers or /adduser (this is the purpose of the guilds.join scope).
• To refresh your authorization so it keeps working.
• To keep the service secure and troubleshoot problems, using the audit log.

We do not sell your data, use it for advertising, or share it with anyone other than the service providers below.

3. Important: being added to servers

By authorizing AutoAuth you agree that a server administrator who has the bot in their server may add you to that server. Authorizing is your consent for this. If you do not want that, do not authorize, or revoke access as described below.

4. Where it is stored

Data is stored in a PostgreSQL database and the bot runs on Render. Discord processes the authorization and any data you give Discord under its own Privacy Policy.

5. Retention

Authorization data is kept until you opt out with /optout or ask us to delete it. Audit log entries are kept for security and troubleshooting; those that contain your user ID are deleted when you opt out.

6. Your choices

• Revoke access: in Discord, go to User Settings → Authorized Apps and remove AutoAuth. The stored tokens then stop working.
• Opt out and delete your data: run /optout in Discord. It revokes your authorization with Discord and deletes your stored record and the audit log entries that contain your user ID. You can also ask in our Discord server. Deleting your record does not remove you from servers you already joined; leave those from Discord.

7. Security

Tokens are encrypted at rest, the dashboard is limited to the owners, and connections use HTTPS. No system is perfectly secure, so we cannot guarantee absolute security.

8. Children

AutoAuth is not intended for anyone under the minimum age to use Discord in their country (13 in most places). We do not knowingly collect data from them.

9. Changes

We may update this policy and will change the date above when we do.

10. Contact

Questions or requests: join the Discord server.