Privacy policy

Last updated: 7 November 2026

This notice explains what data the CloneSync Discord bot and its website process, why, for how long, and what rights you have. Data controller: Varjas Máté János, [email protected].

1. Summary

• While running a backup (live copying), the bot does not store the text of messages: the messages live on Discord, on the backup server. The bot only remembers which original message became which copy (IDs).
• The bot uses message content (Discord's "Message Content" intent) solely to copy messages to the backup server and – if the server's admin asks for it – to include them in a server snapshot. It does not analyse, profile or use it for anything else.
• Message text is stored only in Snapshots (at the request of the server's owner – or an admin they allow): the latest messages of each channel, as many as the plan allows, so that the server can be restored. What each plan includes (how many servers, how often, how many snapshots are kept) is shown on the Pricing page. The admin can delete them at any time.
• Attached files (images, videos) are kept only temporarily while they are being uploaded, then deleted immediately.
• We never see your password: you sign in with Discord.
• We do not sell data, use it for advertising, share it with data brokers, or use it to train artificial intelligence.

2. What data we process

Data	Purpose	Retention
Which server is synced to which, who started it, what is cloned and synced (settings)	Running the backup	Until the backup is stopped
Mappings between the IDs of channels, messages, roles and emojis (original → copy), edit times, deletion status	So that edits and deletions are applied in the backup too, and no message is duplicated or missed after a restart	While the backup runs; after it is stopped, it stays on the bot's server so that a restart does not copy anything twice. Deleted when the account is deleted, or on request.
The parts of a message currently being copied (which parts have been sent)	Resuming after an interruption	Until the message has been copied
Website sign-in: Discord ID, username, avatar, the list of your servers, the Discord access token (only the "identify" and "guilds" scopes – we do not ask for your e-mail address)	Running the dashboard	At most 7 days, or until you sign out
Discord name and avatar of users the team looks up on the admin page who share no server with the bot	So that the admin page shows a name instead of just a number	Until the account is deleted; the team can refresh it at any time
Support staff (admin page only): permissions, full name and phone number (if provided – visible to admins only), the login username and a hashed fingerprint of the password (if any), whether two-factor authentication is enabled, whether the e-mail address is verified (the address itself is not stored), what they viewed and what they did	Access control, accountability	While they are on the team; what they did stays in the audit log (see section 3)
Who invited the bot to a server (Discord ID)	Contact if there is a problem with the server or the backup	While the bot is on the server
Personal messages from the team (on your dashboard): text, sender, time, whether you have read it; the notification sent on Discord	Customer support	Until the account is deleted (the latest 200 per user); the team can withdraw them at any time. The notification log: see section 3
Subscription: plan, end date, renewal, history, the subscription ID at the payment provider; expiry reminders	Providing the service	Until the account is deleted; each entry of the history at most 5 years (after the account is deleted, see section 7)
(Now, in the test period, there are no payments – no such data is created.) Payments: amount, currency, plan, period, status, the payment provider's transaction ID, the card type and its last 4 digits. We never see or store the full card number.	Invoicing, accounting, refunds	8 years, as required by accounting law (even after the account is deleted), then deleted automatically
IP address	Protection against overload and abuse (rate limiting, temporary bans)	For rate limiting, in memory only; in the security log it is anonymized after 90 days (see section 3)
Country (provided by Cloudflare based on the IP address)	To show prices in your currency on the Pricing page; in the security log, next to the IP address	Not stored for prices; in the security log: see section 3
Server snapshots (Snapshots): the server's settings, roles and permissions, channels, members' IDs and roles, bans, the details of emojis and stickers, and the latest messages of each channel, as many as the plan allows (text, author's name, ID; of the reactions only which emoji – not how many or who reacted), and for each channel how many messages did not fit (only the number and the channel's name – not the text of the left out messages). For pictures (icon, banner, emojis, stickers, avatars) and attachments (images, videos, files), only the file name, size, type and a link to the copy stored on Discord – not the files themselves.	Creating snapshots (the first one at the request of the server's owner or an admin they allow, then automatically at the interval of the plan) and restoring them at their request	Until the user deletes them, or until newer automatic snapshots replace them (the plan's number of newest snapshots is kept per server), at the latest until the account is deleted or the service ends. The snapshots log (when, which server, who, what happened): see section 3
Abuse detection (the team's "Needs attention" list): the names of the server and its channels, the NSFW (18+) flag, the type and size of copied files (not their content), when the Discord account was created, how many backups and snapshots were started, and when an original server disappears; the team's notes, warnings and decisions (e.g. bans). Message content is not examined for this.	Enforcing the Terms and the law, filtering out illegal servers and content (legitimate interests)	While the backup or the account exists; a ban for as long as it lasts
Reports (Report a server page): the reported server, the reason, the description, your contact details (if given) and your Discord ID (if you were signed in). The IP address is used to filter out too many reports (in memory, for at most 1 hour); the fact that a report was sent (time, IP address, the server, the category and, if you were signed in, your Discord ID – not the text of the report) is also recorded in the security log (see section 3).	Investigating the report; notifying Discord and the authorities where necessary; protection against abuse of the form	The report: at most 1 year after it is closed. The security log line: see section 3
Member list (CSV download)	The main server's admin can download it	Not stored: generated from Discord at download time

3. Logs: what we record and how long we keep it

The service keeps structured logs. Each line records what happened, when, and who did it; message text is never logged. Logs about a user or a server are kept in that user's or server's own folder, so they can be found and deleted together. The keeping times below are the ones the system enforces:

Log	Legal basis	Kept for
Audit: What the team did on the admin site: who, when, what, on whom and why (what they viewed too). Each line is chained to the previous one with a hash, so it cannot be changed unnoticed.	Legitimate interest (Art. 6(1)(f) GDPR): accountability of the team's actions, for the 5-year limitation period of civil claims.	5 years
Security: Every sign-in attempt on the website and the admin site (successful, failed, blocked) and every sign-out, the reports sent on the Report a server page (IP address, server, category), requests on the website refused for the lack of a right or a sign-in (what was asked), payment notifications refused for a wrong signature, IP bans: time, Discord ID and name if known, IP address and country, sign-in method. For a password sign-in the username entered; the password is never stored.	Legitimate interest and security of processing (Art. 6(1)(f) and Art. 32 GDPR). IP addresses are anonymized after 90 days.	1 year (IP addresses anonymized after 90 days)
Billing: Payment events and coupon codes: amount, plan, period, the payment provider's IDs, who redeemed a code.	Legal obligation (Art. 6(1)(c) GDPR): accounting records must be kept for 8 years (Hungarian Accounting Act, Section 169).	8 years
Account: Your account's events: first sign-in, account changes, changes of your subscription.	Performance of the contract (Art. 6(1)(b) GDPR), for the 5-year limitation period of civil claims. Deleted with the account.	5 years
Notifications: The messages sent to you (DMs and website messages) and whether they arrived.	Performance of the contract (Art. 6(1)(b) GDPR). Deleted with the account.	1 year
Server: Events of a server: the bot joining or leaving, who started, changed or deleted a backup on it, webhook messages sent to it.	Performance of the contract (Art. 6(1)(b) GDPR). Deleted with the server's folder.	1 year
Snapshots: Snapshots of a server: who started, finished, stopped, resumed, renamed, downloaded, restored or deleted one, what was refused or failed, and the automatic saves. It contains no message text.	Performance of the contract (Art. 6(1)(b) GDPR). Deleted with the server's folder.	1 year
Backup activity: The running backup's activity: what was copied, members who joined or whose roles changed (Discord name and ID), errors, clone reports. It contains no message text.	Performance of the contract (Art. 6(1)(b) GDPR): troubleshooting of the running backup. The dashboard shows the last 7 days.	30 days
Commands: Use of the bot's commands: which command, when, where, by whom (Discord ID, name, roles), the result. Message text is not stored.	Legitimate interest (Art. 6(1)(f) GDPR): abuse prevention and support.	90 days
System: The program's technical log: errors and how it works. If a line refers to you (e.g. the delivery of a message), your Discord ID can be in it.	Legitimate interest (Art. 6(1)(f) GDPR): keeping the service running. Lines naming a deleted account are deleted at once.	90 days

Automatic deletion: when a keeping time is up, the lines are deleted by themselves (the system checks every hour) – nobody has to do anything for it. The deletion itself is recorded only as numbers (how many lines of what), never with the content. The dashboard shows the last 7 days of a backup's activity. Logs cannot be edited or deleted by hand, not even by the team: this is what makes them reliable.

What the logs are used for: to keep the service running and to find faults, to protect it against abuse (for example repeated failed sign-ins or other suspicious requests can lead to a temporary IP ban), to show you and the team what happened to your account, backups and snapshots, and to hold the team accountable for what it does. The logs are not used for advertising, profiling or anything else.

4. Cookies

The website uses only cookies that are strictly necessary for it to work: your sign-in session (at most 7 days, or until you sign out), and a short-lived security cookie during sign-in. There are no tracking, advertising or analytics cookies, so no consent is needed. On the checkout page, the payment provider (Paddle) may use its own cookies.

5. Legal basis

• Performance of a contract (GDPR Art. 6(1)(b)): backups, snapshots, the dashboard, the subscription.
• Legitimate interests (GDPR Art. 6(1)(f)): protecting the service (IP addresses, logs), filtering out abuse and illegal content, investigating reports, troubleshooting, important notifications. The logs: each with its own basis in section 3.
• Legal obligation (GDPR Art. 6(1)(c)): keeping payment records as required by accounting rules (Hungarian Accounting Act, Section 169).

The server admin who sets up a backup or snapshot is responsible for the data of the members of that server (their messages are copied to the backup server and into snapshots): they must inform the server's members that the server is being backed up. If you are a member of a server and do not want your data to be included in a backup or snapshot, contact the server's admin, or us at the contact details above.

6. Who has access, and who we share data with

• Discord: the bot runs on Discord's platform (subject to Discord's Privacy Policy). Part of the audit log (e.g. what was done for which customer) is also posted to the team's own private Discord channel; messages there follow Discord's retention.
• (Now, in the test period, there are no payments – no such data is created.) Paddle (Paddle.com Market Ltd.): handles payments as our reseller (Merchant of Record); only Paddle sees your card details, billing name and e-mail address (Paddle's Privacy Policy).
• Cloudflare: forwards and protects the website's traffic.
• The data is stored on the operator's own server in Hungary (EU). Discord, Paddle and Cloudflare may also process data outside the EU, with the safeguards required by the GDPR (e.g. standard contractual clauses).
• Support staff only see what their permissions allow; every action they take is logged.
• We do not share data with anyone else, unless required by law, or when we report illegal content to Discord or the competent authorities (see the "Prohibited" section of the Terms).

7. Your rights

You can ask us what data we hold about you, ask us to correct or delete it, or to restrict its processing; you can object to the processing, and you can request your data in a machine-readable format. You can do most of this yourself:

• stop a backup: dashboard → Stop;
• delete snapshots: Snapshots page → Delete (deleting all snapshots of a server also stops automatic snapshots);
• sign out: Sign out on the website (your sign-in data is deleted immediately);
• delete your account and all your data: Billing page → Delete account and data (immediately: your backups stop, and your subscription, history, messages, snapshots, backup data and sign-in are deleted);
• remove the bot from a server: kick the bot on Discord (backups involving that server stop).

After your account is deleted, we keep only the following, separately and only for that purpose: your payments (8 years under accounting law), your subscription history (until contractual claims expire, 5 years), the security log (at most 1 year, with IP addresses anonymized after 90 days) and the audit log entries about you (at most 5 years). Your account's log, your notification log and the logs of your servers are deleted with your folder at once; lines of the technical log that name you go at once too, and in the logs of other people's servers your name and ID are removed from the lines about you. If you never paid, instead of the payments and the subscription only the fact of the deletion is kept for 30 days. After that, these are deleted automatically. Your backup servers and their messages remain on Discord – they are yours, and you can delete them on Discord.

We handle all other requests sent to the contact details above within 30 days at the latest. If you believe we have violated your rights, you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (naih.hu) or with the data protection authority of your country.

8. Children

The service may only be used by people who are old enough to use Discord (13 in most countries, 16 in some EU countries). We do not knowingly process the data of younger children; if we learn that we do, we delete it.

9. Security

• The website runs over an encrypted (HTTPS) connection, and sign-in is through Discord.
• The admin interface is only available to the team's Discord accounts, behind additional access protection (two-factor authentication is mandatory for staff), and every action is logged in a log whose lines are chained together, so that a change would show.
• Rate limits and automatic bans protect against overload and abuse.
• If a security incident affects your data, we will notify you as required by law.

10. Changes

If this notice changes significantly, we will announce it on the website; the date above always shows the latest update.