Privacy Policy

Effective Date: June 13, 2026  |  Terms of Service

AuraCast ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, and share information when you use our Services: the website, Windows Desktop App, Discord Bot, radio streaming service, and API.

1. Information We Collect

From Discord OAuth

• Discord user ID, username, and display name
• Avatar URL
• Email address (if provided by Discord OAuth scope)

Usage Data

• Radio stations played, favorites, ratings
• Voice session data (which guild, which station, duration)
• Guild membership and server configurations
• Session tokens (stored as hashes — never the raw token)
• Device identifiers (device name, platform, for multi-device management)

Technical Data

• IP addresses (for security, fraud prevention, and rate limiting)
• API request logs (retained for up to 30 days)
• Error and crash reports

Payment Data

Premium subscriptions are processed by Stripe, Inc. AuraCast does not store payment card numbers or CVVs. We receive a Stripe customer ID, subscription status, and billing event webhooks. See Stripe's Privacy Policy for how Stripe handles payment data.

2. How We Use Your Information

Purpose	Data Used
Providing the Services	Discord ID, username, session tokens, radio history
Premium subscription management	Stripe customer ID, subscription status
Security and fraud prevention	IP addresses, session data, device info
Voice session recovery (24/7 mode)	Guild ID, voice channel ID, station URL
Admin moderation	Discord ID, username, moderation actions
Analytics and improvements	Aggregated, de-identified usage data

3. What We Do NOT Do

• We do not sell your personal data to third parties.
• We do not read your Discord messages or server content.
• We do not store raw session tokens or passwords.
• We do not knowingly collect data from children under 13.
• We do not use your data for targeted advertising.

4. Data Retention

• Radio listening history: 90 days, then automatically purged.
• Session tokens: Expire after 30 days of inactivity or when revoked.
• Voice session logs: 90 days.
• Account data: Retained until account deletion is requested.
• Stripe billing records: Retained as required by financial regulations (typically 7 years).
• Moderation records: Retained indefinitely for safety purposes.
• IP addresses in logs: Up to 30 days.

5. Data Sharing

We share data only as necessary to provide the Services:

• Stripe: For payment processing (Premium subscriptions).
• Discord: The Bot interacts with Discord's API on your behalf.
• Law enforcement: We may disclose data if required by a valid legal process.

We do not share your data with advertising networks, data brokers, or unrelated third parties.

6. Discord Bot Data

When the AuraCast Bot is invited to your Discord server, we store:

• Server (guild) ID, name, member count, and owner ID
• Voice session data for radio playback
• Server configuration settings (radio channels, grace period, 24/7 mode)

This data is used solely to provide Bot functionality. We do not read message content. When the Bot is removed from a server, we mark the server as inactive but retain anonymized analytics data.

7. Desktop App Data

The Windows Desktop App sends API requests to AuraCast servers including your authentication token, radio play events, and app configuration. Network traffic from the App is subject to the same policies described in this Privacy Policy. The App does not enable microphone or camera access.

8. Android App (Future)

When the Android app is released, this policy will be updated to reflect any mobile-specific data practices. We anticipate the Android app will follow the same data practices as the Desktop App.

9. Security

We implement industry-standard security measures including:

• HTTPS/TLS encryption for all API communications
• Bcrypt hashing of session tokens
• Rate limiting and anti-abuse protection
• Two-factor authentication for owner-level admin access
• Immutable audit logs for admin actions

No system is 100% secure. If you believe your account has been compromised, contact us immediately at support@jsglow.name.

10. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and personal data.
• Portability: Request your data in a portable format.
• Objection: Object to certain processing activities.

To exercise these rights, email support@jsglow.name. We will respond within 30 days.

11. Cookies and Local Storage

The admin panel uses browser localStorage to store authentication tokens. The website may use strictly necessary cookies for session management. We do not use tracking or advertising cookies.

12. Children's Privacy

The Services are not directed to children under 13 (or 16 in the EU). If we become aware that we have collected personal data from a child under the applicable age, we will delete that data promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the Effective Date above. Your continued use of the Services constitutes acceptance of the updated Policy.

14. Contact

For privacy-related questions or requests: support@jsglow.name

For general legal questions: support@jsglow.name