Document

Last updated: 3 November 2026

This Policy explains what the VoidBox Discord bot ("the Bot") collects, why, and what you can do about it. It covers the Bot and its web dashboard at voidbox.games.

The Bot is a separate product from VoidBox Cyberverse (the game), which has its own Privacy Policy. One account can hold entitlements in both, but the two keep separate databases, and data does not move between them except where this document says so.

The legal terms for using the Bot are in the Discord Bot Terms of Service, and the rules about what you may do with it are in the Acceptable Use Policy.

1. Who we are

VoidBox Labs™ is the operator ("we", "us"). Contact: scurf-truffle9l@icloud.com.

2. The short version

• We store your Discord user ID and the server's ID — not your email, not

your real name, not your password.

• We do not store the text of your messages for levelling. Levelling records

only that a message happened, and when.

• Message text reaches an AI provider only when you **deliberately use an AI

feature** — pinging the Bot, an AI command, or a chat summary you asked for.

• Server administrators can see and change everything the Bot stores for their

own server.

• Removing the Bot from a server stops all collection for that server.

3. What we collect

a) Per member, per server

• Your Discord user ID.
• XP, level, and message/voice activity counts — not content.
• Economy state: balance, bank vault, debt, inventory, job, company membership.
• Moderation state: warnings recorded by your server's moderators, strike count,

and trust score.

• Timestamps for cooldowns and streaks (daily claim, voting streak).
• Any rank-card appearance settings you choose.

This data is per server. Your XP in one server is not visible to, or shared with, another server.

b) Per server

Your administrators' configuration: which features are on, the currency name, jobs, shop items, companies, welcome messages, rules, FAQs, application forms, and similar. Also the server's plan and its expiry.

c) Cached from Discord for display

Your username and avatar, so cards and leaderboards can render. These are refreshed from Discord and are not authoritative copies.

d) The dashboard

Signing in to the dashboard uses Discord OAuth. We receive your user ID, your username and avatar, and the list of servers you administer — used only to decide which servers you may configure. We do not receive your Discord password. A session cookie keeps you signed in; it is not used for tracking.

e) What we never collect

Message content for levelling, direct messages between other users, voice audio, payment card details, and your email address.

4. Message content — the exceptions

The Bot reads messages in channels it has access to in order to count activity and run the features your administrators turned on. Content leaves our systems only in these cases:

• AI replies. Your prompt and any image you attach go to OpenRouter and on

to the model provider. Retention differs by tier — this is set out in detail in §3 of the Bot Terms, including the two cases where retention may not be zero (when no zero-data-retention provider is available, and image generation). Prompts are never used for training.

• Voice chat (/ai-vc, Premium+). While the Bot is in a voice channel

through /ai-vc, what members say there is recorded one turn at a time and sent to OpenRouter to be turned into text. The text is answered like an AI reply, and the answer is sent to OpenRouter to be turned into speech. The audio is held in memory only for that turn and is never saved. The words and the reply are posted in the voice channel's own chat, where they stay like any other message. These speech requests are not limited to zero-data-retention providers, so the provider's own retention terms apply to them. The Bot says in the channel when it starts listening, and /ai-vc leave stops it.

• Voice messages (Premium, off by default). If a server turns on voice

message transcription, or a voice message pings or replies to the Bot, the recording is sent to OpenRouter to be turned into text. The text is posted as a reply (or answered like a typed AI message). The recording itself is not saved by VoidBox.

• YouTube subscriber role (/verify-youtube, Premium). If a server uses it and

you choose to verify, you sign in with Google on voidbox.games and allow read-only YouTube access. VoidBox asks YouTube one question, whether that account is subscribed to the server's channel, gives the role if it is, and revokes the access straight away. Nothing from your Google account is stored: no token, no email address and no list of your subscriptions.

• **Alt and VPN check on web verification (Premium, off unless a server turns it

on). When you verify on voidbox.games for a server that uses it, VoidBox stores a one-way, salted fingerprint of your IP address for that server only, never the address itself, and checks the address once against proxycheck.io to see if it belongs to a VPN, proxy or data centre. If your fingerprint matches another account verified in the same server, or a banned one, the server's staff see an alert. The fingerprint is deleted after 30 days**. The verify page tells you when a server has this check on.

• Alt-account signals (free). When someone joins, VoidBox compares what

Discord already shows (account age, profile picture, name, which invite was used) with members banned or kicked from that server in the last 30 days, and may alert the server's staff. Those departure records are deleted after 30 days.

• AI memory and personality notes. The Bot remembers your last few

exchanges with it (names removed) for 7 days, so follow-up questions make sense. Separately, every few chats it writes a short AI-generated personality note about you: how you talk, your humour, your interests and running jokes. It is used to shape later replies in any server, and is stored until you delete it. It never records health, sexuality, religion, politics, ethnicity, your real name, age, location, contact details or passwords. You can see and edit it at voidbox.games → dashboard → Preferences → What Boombox knows about you (seeing it needs a quick captcha). Deleting needs no captcha: one click deletes everything, only the notes or only the recent chats, and /ai memory forget does the same in Discord. Delete my data removes it too.

• Message log. When a server turns on its message log with edit logging,

VoidBox keeps a copy of the text of recent messages in that server's logged channels for 24 hours, then deletes it. It is used only to show what a message said before it was edited, including edits made while the bot was restarting. Messages in channels the server excludes, and (by default) bot messages, are not kept.

• Personal data in AI chat. Before a message is sent to the AI provider or

saved to AI memory, VoidBox removes card numbers, passport and ID numbers, bank account numbers (IBAN), social security numbers, full dates of birth, phone numbers and email addresses, replacing them with a label such as "[card number]". This runs on our own server; the removed text is not sent or kept. The member is warned in the reply, and a server can choose to have such messages deleted from the channel.

• About me. If you choose to, you can write a short note about yourself

(/ai about or Preferences → About me, up to 600 characters). The Bot uses it in any server and may joke about it. It is stored until you clear it, and it refuses emails, phone numbers, passwords, tokens and invite links. The VoidBox operator can see these notes to run and moderate the service; server admins cannot.

• Chat summaries. When somebody asks the Bot to summarise a channel, the

recent messages in it are sent to the model that writes the summary. They are not stored afterwards.

• Server health analysis (a paid feature). A sample of recent public

messages is scored for toxicity, summarised into aggregate numbers, and discarded. The text is not stored.

• AI moderation (paid plans only). On Premium servers with AI moderation

on, messages that the rule-based filters find suspicious are sent to OpenRouter for a toxicity and scam score, together with a few earlier lines from the channel for context and the server's own rules. Links on their own to well-known sites are not sent. Only the outcome is stored (the score, the category and any action taken), not the text. Free servers do not send messages for AI moderation.

• AI-written games. When the Bot writes a game, its code is test-run in an

isolated sandbox on our own server for a few seconds to check it does not crash. Nothing from your server goes into that test, and the code is not kept after the reply is sent.

• Image moderation. Pictures are checked for nudity by a model running **on

our own server** — those images are not sent to any AI provider. Paid servers additionally get a scam check that does send the image to OpenRouter.

• Operator review of a server. To enforce Discord's Terms and our

Acceptable Use Policy, the VoidBox operator can ask an AI for an overview of a server the Bot is in: its public profile, channel and role names, and a sample of recent messages with authors replaced by "member 1", "member 2" and so on. This is done by hand, only when needed, and the result is not stored. Images are never opened as part of it. A review never acts on its own: any ban is a decision a person makes, and the server owner is told why and can appeal.

Automatic moderation (spam, links, banned words) runs on our own infrastructure and stores only the outcome — what action was taken and why — not the message.

5. How we use it

• To run the features your server enabled: levelling, economy, moderation,

welcome messages, applications, tickets.

• To show your server's own statistics on the dashboard.
• To enforce cooldowns, rate limits, and the anti-abuse caps that stop one

member draining a shared reward pool.

• To bill and apply paid plans.

We do not sell your data, and we do not use it for advertising.

5.1 Our legal basis (GDPR/UK GDPR)

Where this Policy is read under GDPR or UK GDPR, VoidBox Labs™ is the controller for the data described here, and we rely on:

We do not rely on consent for any of the above, so there is no consent to withdraw — the equivalent is turning the feature off, removing the Bot, or deleting your data (§8). Where you object to processing based on legitimate interests, contact us and we will weigh it.

We do not carry out automated decision-making with legal or similarly significant effects. The Bot's automatic moderation acts inside one Discord server, on a server administrator's configuration, and a human moderator can undo any of it.

6. Who can see it

• Your server's administrators and moderators can see everything the Bot

stores for that server, through the dashboard and through commands. Warnings and trust scores are visible to moderators.

• Other members see only what a feature is meant to show publicly:

leaderboards, rank cards, and shop or company activity.

• Your standing on the trust scale is not public — an ordinary member can

look up only their own.

7. Third-party services

Each has its own privacy policy, and it governs what they do with what they receive.

YouTube. VoidBox uses YouTube API Services to find the YouTube channel behind a handle or link that a server admin enters, and receives upload notifications from YouTube for the channels a server follows. No member's personal data is sent to YouTube, and VoidBox never accesses anyone's YouTube account. By using YouTube alerts you agree to the YouTube Terms of Service, and Google's use of data is governed by the Google Privacy Policy. Video details received from YouTube are kept only as long as needed to post the alert, and are deleted automatically after three days.

Website analytics (Whop Pixel)

The website (the game, the bot pages, the dashboard and checkout) loads the Whop Pixel, an analytics script from our payment provider Whop. It tells us:

• your device type (for example phone or computer),
• your country,
• which pages you visit, recorded by page name only (for example "Plans"),
• how often you open checkout and leave it without paying.

It does not give us your card details, payment information, messages, game saves or anything you type. Whop may store a small identifier in your browser to count visits; we don't use any of this to show you ads (ads on free dashboards come from Google AdSense, below). Whop's own handling of it is covered by Whop's privacy policy.

Your cookie choice (Europe)

If your device's time zone is in Europe, voidbox.games asks before loading the Whop Pixel or Google AdSense, and loads neither until you press Accept. Reject is remembered just like Accept, and every page works either way. To change your choice, open voidbox.games/?cookies=1 and choose again. Your choice is stored only in your browser.

Ads (Google AdSense)

When a free server's dashboard is open, the page loads Google AdSense, which shows ads. Google receives your IP address and browser details and may set cookies to measure the ads and, where the law allows and you have not opted out, to personalise them. Premium and Premium+ dashboards load no ads, and ads are never shown inside Discord. We do not send Google your Discord account, messages or server data. You can manage ad personalisation at adssettings.google.com; Google's use is covered by Google's privacy policy.

Google Search Console

We use Google Search Console to see how people find voidbox.games in Google search: which search terms showed the site and how many people clicked. Google gives us these as totals only; it runs no code on our pages and tells us nothing about who you are.

8. Retention & deletion

• Removing the Bot from a server stops all collection for that server

immediately.

• After removal, that server's data is kept for **30 days and then deleted

automatically**. The delay exists so that an accidental removal — or a permissions change, or a raid — does not destroy a community's history. Add the Bot back within 30 days and everything is exactly where you left it.

• We may send one direct message to whoever removed the Bot, asking why.

One message, never a second, and it carries a button that stops us asking you about any server ever again.

• Messages to server admins. VoidBox may send a small number of direct

messages (or posts in the server's mod log channel) to the people who manage a server, about that server only: a free-trial offer (once per server), trial reminders (at most three, around the trial ending), setup tips for an active server (at most one a week and three ever), and one-time notices about a change to the server's settings, such as AI chat being switched on by default. They use only the server's own activity totals, never members' messages. To stop them, contact us (below) and we will exclude you.

• You can delete your data yourself, without asking us: the dashboard has

Delete my data for your own records, and Delete this server's data for server owners. Both take effect immediately.

• You can also revoke the Bot's access to your Discord account at any time from

Discord's own Authorised Apps settings. That is your action to take — we cannot do it for you — and it is separate from deleting stored data.

• If you would rather we did it, contact scurf-truffle9l@icloud.com or the

support channel linked on voidbox.games.

• Moderation records are kept while you are in the server, because a warning

history that vanishes on request would make the feature useless to the moderators who rely on it. They are deleted with the rest of the server's data.

9. Children

The Bot is not directed to children under 13, or the minimum digital age in your country (for example 16 in parts of the EU). Discord's own minimum age applies regardless.

10. Security

Data is transmitted over encrypted connections and stored on access-controlled infrastructure. Payment card data is never transmitted to or stored by us — it is handled by Whop. No system is perfectly secure, but we take reasonable measures to protect your data.

11. International transfers

Our servers are hosted in Kazakhstan, and this Policy is governed by the laws of Ukraine. AI providers reached through OpenRouter may operate elsewhere. By using the Bot you consent to your data being processed in Kazakhstan and by the processors listed in §7.

12. Your rights

Depending on your region (e.g. GDPR/UK GDPR, CCPA), you may have the right to access, correct, export, or delete your data, and to object to processing. Contact scurf-truffle9l@icloud.com to exercise these rights.

13. Changes

We may update this Policy. Material changes — especially to how AI data is handled — will be reflected here with an updated date at the top.

14. Contact

VoidBox Labs™

• Email: scurf-truffle9l@icloud.com
• Discord: https://discord.gg/UjEQW8uQeU