Privacy Policy

1. Who is responsible, and what this policy covers

Both services are maintained as a personal project by a single individual, who is responsible for processing the data and can be reached at ozreinherz@gmail.com. That is the address for the access, correction and erasure requests covered in section 12.

• Nyanko — the Discord bot, with the commands listed under Commands. It runs on Fly.io, in the dfw region (United States), and keeps what it needs in Google’s Firebase.
• Sala de Tela — the screen-sharing activity, plus this website. It runs on its own server, with no database.

This policy applies to the two services operated by the maintainer: the Nyanko bot on Discord and whatever is served at this address.

2. What both receive from Discord

In common, both services handle identifiers from your Discord account:

• your numeric identifier;
• your username or display name;
• your profile picture, in order to show it;
• the identifiers of the server and the channel where the command was used or the room was opened.

Neither receives, nor has any way of obtaining, your e-mail, your password, your friend list or the list of servers you belong to. Sala de Tela asks only for the identify scope at login.

3. The Nyanko bot

3.1 What it keeps about you

Every row below exists only if you used the matching feature. Someone who never called the command has no record there at all.

3.2 What it keeps about the server

Per server, the bot keeps the configuration made by the /guild commands: the channels chosen for leveling, emoji polls, schedules and the event log; whether artificial intelligence is on; which Digimon Masters World trackers are active; and the role panels created with /roles manager. It also keeps the contents of the information categories built with /bot insert, which is what /help shows.

3.3 Images

The images you attach to a giveaway, a party or a blacklist entry are kept in Firebase Storage. Giveaway and party images are deleted when the giveaway ends and when recruitment is closed with /dmw party finish.

3.4 What it does not keep

The bot does not keep the text of your messages. It reads the messages in the channels it sits in, because that is how a bot works on Discord, but what is left of that in the database is counts and settings — with two exceptions, set out in sections 4 and 5, which are there precisely because they are exceptions.

4. Credentials for other services

Two commands store a credential for an account that is not your Discord one. They sit in the same database as everything else:

• /mihoyo set token — the session cookie of your HoYoLab account. It is what lets the bot do the daily check-in on your behalf, and it is also what would grant access to your account to anyone who held it.
• /announcements twitch auth — a Twitch access token, used to know when you go live.

You can delete both whenever you like: /mihoyo disable check-in deletes the whole record, credential and preferences alike; /announcements twitch disable turns the announcements off. While a credential is stored, it is used only for the purpose above.

5. Artificial intelligence

When a server’s administrators turn the feature on with /guild set chatgpt, the content of that channel’s messages starts being sent to OpenAI, in the United States, so that it can write the reply. Depending on the mode, either your message alone goes, or your message together with that channel’s last 24 hours of messages and the username of whoever called it.

That is data leaving Discord for a third party, which is why it has a section of its own. The feature ships off; turning it on is the server administrators’ decision, and it is their responsibility to tell the people who talk there. OpenAI’s handling of the data follows OpenAI’s own policy.

6. Server event log

With /guild set logs on, the bot reposts into a #📃logs channel of the server itself: the content and attachments of deleted messages, the previous text of edited messages, and who left or was kicked from the server.

That stays inside your server: none of it is written to the bot’s database. But it is a copy of deleted messages, visible to anyone with access to that channel, and it is worth knowing it exists before turning it on.

7. Sala de Tela

7.1 Data you provide

• Nickname: if you change your display name, that becomes the name shown to the other people in the room.
• Room name: free text, visible to anyone who sees the list of public rooms.
• Room password: kept only in scrambled form (a salted hash, scrypt algorithm). The original password is recorded nowhere and cannot be recovered.

When the activity is opened inside a call, Discord reports the identifiers of the instance, the server and the voice channel. They exist so that the room for that call can exist, and so that only people in the call can enter it. If a bot is configured, it asks Discord whether you are in the voice channel — and nothing beyond that.

7.2 Broadcast content

The image of your screen and, if you choose, the sound are split into pieces and relayed to the people who asked to watch. Those pieces pass through the server’s memory only for the instant of the relay.

None of it is recorded, stored or analysed. There is no recording, no frame capture, no transcription, no image recognition and no other processing of what appears on your screen. Anyone who did not ask to watch a given broadcast receives not a single piece of it — the filtering happens on the server, not in the viewer’s browser.

There is no database on the Sala de Tela side. The program writes no files: rooms, participants and scrambled passwords live only in the process’s memory while it is running.

8. Where the data lives and for how long

Restarting the Sala de Tela server erases everything that was in memory. Diagnostic messages may appear in the terminal of whoever operates the installation, but the program writes no log files.

9. Who the data is shared with

We do not sell, rent or hand data to anyone. There is no advertising and no analytics. Data reaches third parties only where the feature depends on them:

• Discord: authenticates you and is what everything travels through. Discord’s use of the data follows its own privacy policy.
• Google (Firebase): hosts the bot’s database and images.
• Google Cloud (Translation and Vision): receives the text or image you ask to translate, and nothing else.
• OpenAI: receives channel messages when artificial intelligence is on — see section 5.
• Twitch and HoYoLab: receive the credential you handed over yourself, for the purpose you asked for.
• Instagram, Reddit, YouTube and Tenor: receive the address you asked the bot to fetch. Nothing of yours goes with it.
• Fly.io: hosts the bot.
• Cloudflare: carries the traffic between you and the Sala de Tela server, as a network provider.
• Other people in the server or the room: see your name, your picture and — if you broadcast — your screen. Whoever broadcasts also sees the list of who is watching.

Some of those services sit outside Brazil, mostly in the United States. Using them is what makes the features possible, and it is what you accept when you use the matching feature.

Data may be disclosed if there is a court order or a legal obligation — in Sala de Tela’s case, though, there is no history to hand over: nothing is retained.

10. Storage in your browser

We use no cookies and there are no trackers. This website stores nothing in your browser.

When you open the home page, the server looks at two things to choose the language: the two-letter country code Cloudflare infers from your IP and stamps on the request, and the language your browser reports. Brazil and Portugal open in Portuguese; everywhere else opens in English, and the switch in the top corner changes it at any time. Neither is recorded: they vanish with the request, and your IP address is never read by this application.

The Sala de Tela activity keeps these keys in localStorage, all removable at any time by clearing the site data:

• identity — signed badge that avoids logging in again on every reload.
• displayName — the nickname you chose.
• sala:<id> — permission to return to a room you have already entered, so that reloading the page does not require typing the password again.
• volume and stripW — volume and sidebar width preferences.

11. Security

• All traffic is encrypted with HTTPS and WSS.
• The bot’s database sits behind an administrator credential and is not public.
• Room passwords are kept scrambled only, with an individual salt.
• Repeated password attempts are temporarily blocked.
• Access badges are signed; a tampered badge is refused.
• The server checks who each piece of video came from before relaying it.

No system is immune to failure, and a personal project does not have a company’s structure. Share your screen only with people you trust, close windows with sensitive information before broadcasting, and think twice before trusting any bot — this one included — with a credential for another account of yours.

12. Your rights

Brazil’s General Data Protection Law (Law 13.709/2018) grants you the right to confirm, access, correct and erase your data, to know who it was shared with, and to withdraw consent. Much of that you can settle yourself, on the spot:

• Delete the credentials: /mihoyo disable check-in and /announcements twitch disable.
• Delete an Aura Kingdom class: /ak class delete.
• Leave a room: once it empties, everything that was in it ceases to exist.
• Correct your nickname: with the profile button, inside the activity.
• Delete on your side: clear the site data in your browser.
• Revoke access: in Discord Settings → Authorized Apps.
• Remove the bot for good: take Nyanko out of the server. To erase what is left in the database — level, lists, settings — ask through the contact below.

For any access, correction or erasure request not in the list above, use the contact in section 14. Erasure requests are met as soon as we confirm the account is yours.

13. Minors

Both services follow Discord’s minimum age: 13 years, or the higher age required by the law of your country. We do not knowingly collect data from anyone below that age.

14. Changes to this policy, and contact

This policy may be updated. The date at the top marks the last change. See also the Terms of Service.

To exercise your rights, report a security problem or ask about this policy: ozreinherz@gmail.com.