Privacy Policy
Last updated: July 2026 · In accordance with GDPR
1. Controller
The controller for data processing within the meaning of the GDPR is the person named in the Imprint.
2. What Data We Process
The following data is processed when using the Nephthys Discord bot and the associated web dashboard:
When logging in via Discord OAuth2, your Discord user ID, username, and avatar hash are stored. This data is required for dashboard authentication (Art. 6 para. 1 lit. b GDPR).
To provide bot functionality, server-specific settings, warnings (infractions), XP points, birthdays, and reminders are stored. All data is kept server-side in a SQLite database.
The dashboard uses a session cookie for authentication (HttpOnly, no tracking). The consent decision is stored in a dedicated first-party cookie.
We use Umami, a privacy-friendly web analytics software, to measure reach. Umami is operated within our own infrastructure — no data is transmitted to third parties. Only anonymised usage data is collected (e.g. pages visited, referrer, approximate country of origin, and browser and device type). Umami works entirely without cookies and without personal identification; no information is stored on or read from your device, and no cross-device tracking takes place. As no personal data is processed, no consent is required (Art. 6(1)(f) GDPR — our legitimate interest in providing a needs-based website).
The DNS management of our domain is handled via Bunny.net (BunnyWay d.o.o., Ljubljana, Slovenia — EU). Each time you access our website, your IP address is — for technical reasons — transmitted to Bunny.net's DNS servers in order to resolve the domain and route your request to the correct server. This processing serves the secure and reliable provision of our website (Art. 6(1)(f) GDPR — legitimate interest). A data processing agreement is in place with Bunny.net; as the provider is based within the EU, no data is transferred to third countries.
3. Cookie Consent Management
This website uses a custom-built, privacy-friendly cookie consent system. No data is transmitted to third parties (such as Cookiebot, OneTrust, etc.). The consent decision is stored exclusively in a first-party cookie (nephthpy_consent) in the user's browser.
The consent cookie qualifies as "strictly necessary" under Art. 5 para. 3 of the ePrivacy Directive, as it solely stores the user's own consent decision — no prior consent is required for this. It expires after 365 days. You can change your settings at any time via the 🍪 icon in the bottom left.
4. Third-Party Services
The bot can optionally integrate the following third-party services (depending on server configuration):
- Discord — Base platform, privacy policy: discord.com/privacy
- Twitch — Stream notifications
- YouTube / Google — Video notifications
- Kick — Stream notifications
- X (Twitter) — Post notifications
- Ko-Fi — Supporter roles via webhook
- Patreon — Membership roles via OAuth2 & webhook
- Steam — Game data queries
These services are only activated when the server administrator explicitly configures them in the dashboard. No data is transferred to third parties without the server operator's consent.
5. Data Storage & Deletion
Personal data is only stored for as long as necessary for the respective purpose. Session data is automatically deleted after 24 hours. Server configuration data is deleted upon request when the bot is removed from the server. Bot-related user data (XP, birthdays, etc.) is deleted upon request by the server administrator.
6. Your Rights (GDPR)
Under the GDPR, you have the following rights:
- Access — Art. 15 GDPR
- Rectification — Art. 16 GDPR
- Erasure — Art. 17 GDPR
- Restriction of processing — Art. 18 GDPR
- Data portability — Art. 20 GDPR
- Objection — Art. 21 GDPR
To exercise your rights, please contact the person listed in the Imprint. You also have the right to lodge a complaint with the competent data protection supervisory authority.
7. Changes to This Policy
We reserve the right to update this privacy policy as needed. The current version is always available on this page. Date of last update: July 2026.