Privacy Policy

1. Overview & Commitment to Privacy

At Apps4You ("we", "our", "us"), we take your privacy and data security seriously. This Privacy Policy details how we collect, use, store, share, and protect your personal data when you visit our website at apps4you.org.uk, interact with our Discord bot, log in using Discord OAuth2, or submit an application through a community portal.

We adhere to the principles outlined in the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the Discord Developer Policy.

2. Data Controller & Data Processor Roles

Under data protection legislation, the role distinction is important:

• Apps4You as Data Controller: For your basic Discord account information used to establish your session, dashboard configurations, billing details, and platform security logs, Apps4You acts as the Data Controller.
• Apps4You as Data Processor: For responses submitted to a specific server's staff application form, the respective Discord server administrators act as the Data Controller, and Apps4You acts as a Data Processor hosting the portal and routing submissions to the server's staff review channel.

3. Information We Collect

We collect only information necessary to deliver application and role distribution services:

4. Automated Server Telemetry & Opt-Out Controls

Apps4You collects aggregate operational telemetry data from connected Discord servers. This allows our platform to publish platform statistics, monitor system capacity, and present our public "Top Communities" directory showcase on the Apps4You homepage.

• Data Elements: Server ID, server display name, server avatar/icon URL, approximate member count, custom or free portal web addresses, and public vanity or invite links.
• Default Active State: Telemetry collection is active by default upon inviting the Apps4You bot to provide server owners with immediate visibility in the public community directory.
• How to Opt Out: Server owners and managers can turn telemetry data off at any time by navigating to their server dashboard > Settings tab > Platform Telemetry & Showcase toggle. When toggled off, all public leaderboard appearances, homepage cards, and member statistics for that server are hidden immediately.

5. Purpose of Processing & Legal Basis

Under UK GDPR and EU GDPR, we process personal data under the following lawful bases:

• Contractual Performance (Art. 6(1)(b)): To verify your server membership, authenticate your session, deliver your application to server staff, and automate outcome roles.
• Legitimate Interests (Art. 6(1)(f)): To maintain platform security, prevent spam submissions, enforce rate limits, prevent DDoS attacks, and diagnose technical errors.
• Explicit Consent (Art. 6(1)(a)): Provided when you click "Authorize with Discord" and submit answers through an application portal.
• Legal Obligation (Art. 6(1)(c)): To comply with financial reporting laws and law enforcement requests when legally required.

5. Third-Party Sub-processors

We do not sell personal data. We utilize trusted infrastructure partners to operate our platform securely:

• Discord Inc.: For user authentication, bot commands, channel message delivery, and role assignment. Governed by Discord's Privacy Policy.
• Cloudflare Inc.: For edge DNS routing, DDoS protection, Web Application Firewall (WAF), and SSL/TLS termination.
• MongoDB Inc. (MongoDB Atlas): Secure cloud database cluster utilizing AES-256 encryption at rest and TLS 1.3 in transit.

6. Data Storage & Information Security

We implement industry standard technical and organizational security controls to protect your personal data:

• Encryption in Transit: All HTTP requests are strictly encrypted with HTTPS and TLS 1.3 with automated HSTS headers.
• Encryption at Rest: Database records are encrypted at rest with industry standard AES-256 encryption.
• Session Security: Web sessions use cryptographically signed, HTTP-only, SameSite=Lax cookies to protect against cross-site scripting (XSS) and cross-site request forgery (CSRF).
• Access Control: Administrative access to production databases and servers is restricted to authorized personnel using multi-factor authentication (MFA) and SSH keys.
• Encrypted AI API Keys: Third-party AI model provider tokens (such as OpenAI, Anthropic, Gemini, DeepSeek, or Groq keys) supplied for candidate AI Overviews are never permanently stored in plaintext. They are encrypted at rest using authenticated cryptography (AES-256 / Fernet encryption) with securely isolated environment encryption keys. Even platform developers and administrators cannot view your raw API keys.

7. Data Retention & Automatic Purging

We retain your information only as long as necessary:

• Application submission records are kept accessible to guild administrators until deleted via the dashboard or upon applicant request.
• If a Discord server removes the Apps4You bot, server configuration data is retained for a grace period of 30 days to facilitate re-invitation before being permanently purged.
• Temporary OAuth state tokens expire and are discarded within 15 minutes of generation.
• Server diagnostic and connection logs are automatically purged every 14 to 30 days.

8. Your Rights (UK GDPR, EU GDPR & CCPA/CPRA)

Depending on your jurisdiction, you possess the following statutory rights regarding your personal information:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request that inaccurate or incomplete information be corrected.
• Right to Erasure ("Right to be Forgotten"): You can request the permanent deletion of your application responses and user records.
• Right to Restriction: You can ask us to pause the processing of your personal data under certain conditions.
• Right to Data Portability: You can request your data in a structured, machine-readable JSON format.
• Right to Object: You can object to processing based on legitimate interests.
• Non-Discrimination: We will never discriminate against you, diminish your service quality, or charge different prices for exercising your privacy rights.

9. Right to Erasure & Deletion Procedure

We make exercising your right to be forgotten simple and straightforward:

1. Discord Support Ticket (Recommended): Join our Support Server and open a "Data Erasure Request" ticket. Provide your Discord User ID.
2. Email Request: Send an email to legal@apps4you.org.uk from the email address linked to your inquiry with the subject line "GDPR Erasure Request - [Your Discord ID]".
3. Verification & Execution: Our team will verify your identity to prevent fraudulent deletions and permanently erase your submissions across our primary databases and backup indices within 30 days, confirming execution upon completion.

10. Cookie Notice & Local Storage

Apps4You uses strictly necessary first-party cookies only:

• session: A cryptographically signed session cookie used to keep you logged in to your Discord profile across our dashboard and hosted subdomains (.apps4you.org.uk).
• theme_preference: Stored in browser localStorage to remember your chosen theme or UI preferences.

We do not use advertising cookies, tracking pixels, Facebook Pixel, Google AdSense, or third-party behavioral analytics cookies. Because our cookies are strictly necessary for core functionality and authentication, explicit cookie consent banners are not legally mandated under PECR and ePrivacy regulations, but we remain fully transparent about their function.

11. Children's Privacy

In compliance with Discord's Terms of Service and applicable child protection legislation (such as COPPA and UK Age Appropriate Design Code), the Service is not directed to individuals under the age of 13 (or under 16 in certain European jurisdictions). We do not knowingly collect personal information from children under these age limits. If you become aware that a child has provided us with personal information without parental consent, please contact us immediately so we can promptly delete the data.

12. Privacy Questions & Contact Details

For questions, concerns, or requests relating to this Privacy Policy or our data handling practices, please contact our Data Protection Officer: