1. Scope and contact
This policy explains how HBot processes information for its Discord card-collecting game and these legal pages. The operator and data-controller label is HBot, operated by its development team in Germany. Contact: hbotdevs@gmail.com.
HBot is intended only for adults aged 18 or older, or any higher legal age required where they live. Registration records an adult-content self-declaration. We do not collect dates of birth, government IDs, biometric data or identity-verification documents as part of normal registration.
2. Information used by HBot
| Category | Examples and purpose |
|---|---|
| Discord identifiers and display details | User IDs, usernames/display names and avatars needed to identify participants and display requested profiles or panels. Server, channel, message and interaction IDs link commands, submissions, drops and trades to the right place. |
| Registration | Discord ID, agreement version, acceptance time, server and channel. Temporary registration prompts also store their owner, message binding and expiry. |
| Game records | Cards, prints, ownership and transfer history, collections, balances and currency transactions, items, passes, cooldowns, pity progress, daily/vote rewards, exhibition levels and efficiency, wishlists, tags, showcase and visibility preferences. |
| Commands and interaction inputs | Commands, selected cards, filter/search values, emoji-tag replies, trade offers and menu/form inputs needed to carry out a requested feature. Relevant inputs, identifiers and resulting operations may remain in session, transaction or audit records. |
| Artwork submissions | Uploaded crop images, character/series names, original-language names, source links and art-type metadata, together with the submitter/approver IDs, original message details and timestamps. We keep previews, rendered cards and rendering assets needed to operate the catalogue. |
| Support and operational records | Information you send to the support email, and technical error categories, timestamps and diagnostic records needed to investigate faults or abuse. |
During normal Discord gameplay, HBot does not receive your IP address, Discord password, private email address or two-factor authentication status. If you email us, we receive your email address and the information you choose to send.
3. Message content and attachments
HBot receives messages and interactions in server channels accessible to the bot. It checks message text to recognise commands, eligible artwork submissions and replies to active tag prompts. Attachments submitted to configured card-making features are downloaded and stored for that feature.
HBot does not operate a general chat archive, moderation scanner, translation service or private-message monitoring feature. However, it is not accurate to say that all command data is deleted immediately: submission metadata, game operations, command/message identifiers, session inputs and audit records can be retained as described here. Discord itself may retain the original messages and attachments under its own policies.
4. Purposes and legal bases
Where the GDPR applies, our processing relies on the relevant basis for each purpose:
- Providing the game and requested features — Article 6(1)(b): registration, accounts, collections, game transactions, trades, rendering and requested interactions.
- Service administration and legitimate interests — Article 6(1)(f): maintaining fair game records, preventing fraud and duplicate operations, investigating faults, securing the Service, and responding to support enquiries. We must balance these interests against your rights.
- Legal obligations — Article 6(1)(c): responding to binding lawful requests and meeting applicable legal duties.
- Consent — Article 6(1)(a), where separately requested: optional processing for which consent is the appropriate basis. You may withdraw such consent; this does not affect earlier lawful processing.
Accepting the adult-content agreement is not blanket consent to unrelated personal-data use. Required account/game information is needed to provide the corresponding features; you can decline registration and use the help and legal-information commands.
5. Public views and staff logs
Profiles, collections, inventories and supported owned-card views are public by default to other eligible players. Open hp → Preferences to change supported profile visibility. The setting controls new views and refreshes; it does not erase earlier Discord messages, screenshots or other people’s copies.
Commands and game events can publish messages, names, avatars, card IDs and game information in their Discord channel. Trade offers are visible in the trade’s channel. People with access to those channels can see the resulting messages.
HBot sends audit records to configured staff channels in its main server:
- Account logs: registration details and daily-claim snapshots such as Discord ID, reward/streak, balances, collector start date, drop/claim/burn/vote/trade counts and collection rarity totals.
- Trade logs: participants, offers, assets and amounts, revisions/status, timestamps and source server/channel information.
- Server logs: bot join/leave events, server ID/name, owner ID and member count, with a server icon where available.
These records help staff investigate errors, disputes and abuse. They are intended for authorised staff access and are separate from public-profile preferences.
7. Retention and deletion
Game and registration records are persistent: we retain information needed to maintain your account, balances, ownership, catalogue participation and transaction history while providing those features. Records may also be needed to resolve an active support issue or comply with law. Temporary panel/prompt expiry prevents further use of that panel; it does not necessarily delete every associated database record immediately.
HBot does not currently have a blanket automatic “delete everything after 30 days” rule. We assess retention against the purpose of the record and applicable legal duties, and remove or anonymise personal data when it is no longer needed or a valid deletion request requires it. Non-identifying game totals and print-allocation records may remain to preserve game integrity.
Backups may contain earlier copies of data. They are used for recovery and must be considered when handling deletion requests; deleted personal data must not be reintroduced into active use through a restore. Copies in Discord messages and staff logs under our control are also considered. We cannot delete screenshots or independent copies held by other users, or control Discord’s own separate retention.
Email hbotdevs@gmail.com to request deletion. Requests are handled manually; HBot does not currently provide an /optout command. Deletion can end your game access and remove personal game progress. Personal API data is deleted on a valid request unless retention is required by applicable law.
8. Security
We use access restrictions, staff permissions, protected credentials, transaction checks and backups to help protect game information. Safeguards must be maintained for the actual operating and hosting environment. No internet service or backup process is completely secure or immune to loss.
Report suspected unauthorised access or a data breach to hbotdevs@gmail.com. We investigate reports and provide notifications where required by applicable law.
9. Processing locations and international transfers
HBot is operated from Germany. Discord, GitHub, Google, and Cloudflare may process information in the United States or other countries under their own privacy terms and applicable transfer arrangements. Bot-Hosting.net describes EU and US infrastructure, automatic deployment placement and France-based backup storage in its policy. Its hosting processors and applicable transfer arrangements are listed in its privacy terms.
Where a transfer is subject to GDPR restrictions, it must use an applicable legal transfer mechanism, such as an adequacy decision or appropriate contractual safeguards. Contact us for information about the arrangements relevant to your data.
10. Your rights and requests
Depending on applicable law, you may have rights of access, rectification, erasure, restriction, data portability and objection to processing, and to withdraw consent where processing relies on consent. You can also complain to a competent data-protection supervisory authority, including the authority in your German federal state or where you live or work.
Send requests to hbotdevs@gmail.com. Include your Discord user ID and describe the request. We may request proportionate verification of account control, such as a message from the relevant Discord account; do not send passwords, account tokens or ID documents with an initial request.
For GDPR requests we respond within the applicable time limit, normally one month. If a lawful extension or an exception applies, we explain it. Restricting public visibility does not itself delete stored personal data or stop the processing necessary for an active account.
11. Cookies and these legal pages
These pages contain no HBot-added analytics, advertising scripts, tracking pixels, cookies, login forms or external fonts. They are static documents; visiting them does not register you for the game. Cloudflare Pages processes the network request, including the visitor IP address and related technical information, to deliver and protect the website.
Following an external link or emailing us takes you to a separate service whose privacy terms also apply.
12. Updates and contact
We update this policy when the Service or its data practices change. The current version and date appear on this page, with material changes communicated through the bot or official community channels where appropriate. New processing that requires consent will not be authorised solely by changing this text.
HBot · Germany
Privacy and support: hbotdevs@gmail.com