Privacy Policy

1. Who is responsible

The Perminator team operates the Service. Contact us at hello@perminator.xyz for privacy questions or deletion requests.

Discord Inc. operates Discord. Their handling of your Discord account is described in Discord’s Privacy Policy. We are not Discord.

2. Information we collect

We collect only what we need to run Perminator.

Account information (when you sign in)

Through Discord OAuth with the identify, email, and guilds scopes, we receive:

• Your Discord user ID, username, display name, and avatar URL
• Your email address (if Discord provides it)
• The list of Discord servers you belong to, plus whether you own them or have Manage Server / Administrator

We do not receive or store your Discord password. We do not store your Discord OAuth access or refresh tokens after sign-in; we keep our own session cookie so you stay logged into the dashboard.

Server and bot information (when you connect a server)

• Server name, icon, approximate member count, and owner Discord ID
• Roles (name, color, position, Discord permission bits, member counts)
• Channels and categories (name, type, parent, position)
• Members we cache for management and search: Discord user ID, username, display name, roles, join time, and presence-style status if provided
• Permission grants, channel overrides, and bot configuration you set in Perminator
• Audit entries of actions taken or denied in the Service (actor, action, target, permission, timestamp, result)

Member lists may be fetched using Discord’s Server Members Intent and cached so the dashboard can search and assign roles without repeatedly hitting Discord’s rate limits.

Billing information

If you subscribe, Stripe processes your payment card. We store Stripe customer and subscription IDs, plan, seat count, and subscription status. We do not store full card numbers.

Technical information

• A session cookie (perminator_session) after you sign in
• The last selected server ID in your browser’s local storage
• Standard server logs (IP address, user agent, request time) for security and debugging, retained only as long as needed

Advertising on public pages

Public content pages (such as our educational guides) may show ads through Google AdSense. We do not show ads on the homepage, pricing, legal, sign-in, or dashboard screens. Google and its partners may set cookies or similar identifiers and collect information such as your IP address, browser and device type, approximate location, and the pages you visit on those public pages, including to measure and personalize ads. That collection is described in Google’s Privacy Policy and How Google uses information from sites or apps that use its services.

AdSense does not run inside the signed-in dashboard. We do not send Discord API data — including usernames, emails, server lists, member caches, or audit logs — to Google for advertising.

3. How we use information

We use API and account data only to:

• Authenticate you and show servers you are allowed to manage
• Sync and display roles, channels, and members in the dashboard
• Apply the permission rules you configure and record an audit trail
• Perform the Discord actions you request (for example, move a channel or time out a member)
• Enforce plan limits and process payments
• Send optional in-product notifications you enable (denied actions, role changes, syncs, weekly digest)
• Keep the Service secure and fix outages
• Show ads on public guide pages through Google AdSense

We do not sell personal information. We do not use Discord API data for advertising. We do not use member data to contact people outside the servers you manage. Aggregated or de-identified metrics may be used to improve the Service in line with Discord’s Developer Policy.

4. How we share information

• Discord — to authenticate you and to carry out bot and dashboard actions on your servers.
• Stripe — to process paid subscriptions. Stripe’s processing is described in Stripe’s privacy policy.
• Google — to serve and measure ads on public guide pages through Google AdSense. Google’s processing is described in Google’s Privacy Policy.
• Hosting and infrastructure — servers and databases we operate or contract to host the Service.
• Legal and safety — if required by law, to protect the Service, or to respond to a valid legal request.

Other dashboard users who also manage the same connected server can see that server’s synced data and audit log according to their access. We do not sell or rent your data to third-party marketers.

5. Retention

• Account and session data: until you sign out, the session expires, or you ask us to delete your account.
• Connected server data: while the bot remains in the server and at least one authorized user keeps it connected.
• Audit log: about 7 days on the Free plan and about 90 days on Pro, unless you delete the account or disconnect the server sooner.
• Billing records: as long as needed for accounting, tax, and fraud prevention.
• Security logs: typically a short operational window, unless we need them for an incident.

6. How to delete your account and data

You do not need to email us. Sign in, open Account Settings, and choose Delete account and data. That immediately deletes your Perminator profile, sessions, and any connected servers that no other manager still uses. Kick the Perminator bot from a Discord server if you also want it removed there.

Server-wide records that other remaining managers still need stay until they disconnect the server or delete their own accounts. Billing records we are legally required to keep may be retained. If you cannot sign in, write to hello@perminator.xyz and we will help — that is a fallback, not a requirement.

7. Your rights

Depending on where you live (including the EEA, UK, Brazil, and California), you may have the right to access, correct, delete, or export personal information, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. You can delete your account from Account Settings without contacting us. For other requests, email hello@perminator.xyz. We will not discriminate against you for exercising these rights.

You can opt out of personalized Google ads at Google Ads Settings and through industry tools such as aboutads.info and Your Online Choices. Blocking third-party cookies in your browser also limits AdSense cookies.

If we process data as a “service provider” or “processor” for a server you manage, the server’s operators may also receive requests from their members. We will help those operators respond where we hold the data.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us data, contact us and we will delete it.

9. Security and international transfers

We use HTTPS, session cookies, and access controls so only users who manage a server can see that server’s data. Discord API data we store off Discord (account profile fields, server and role names, member cache, audit actor/target, and similar content) is encrypted at rest with AES-256-GCM. Discord snowflake IDs used as database keys stay unencrypted so the Service can look up the records they identify. No method of transmission or storage is completely secure. If we become aware of unauthorized access to Discord API data, we will notify Discord and affected users as required by Discord’s Developer Terms.

We may process data in the United States or other countries where we or our processors operate. Where required, we use appropriate safeguards for those transfers.

10. Changes

We may update this policy. The “Effective” date at the top will change. The current version will always be posted at /privacy. Material changes will be highlighted on this page.

11. Contact

Perminator privacy requests and questions:
hello@perminator.xyz
Website: https://perminator.xyz

Related: Terms of Service.