Codunot - Privacy Policy

How we handle and protect your information when using our Discord bot and app.

Last Updated: April 24, 2026

1. Introduction

This Privacy Policy explains how we collect, use, store, and protect information when you use Codunot, our Discord bot and related app pages ("Codunot", "we", "us", "our").

Codunot operates in compliance with the Discord Developer Terms of Service and Discord Developer Policy.

By using Codunot, you agree to the practices described in this policy. If you do not agree, you should stop using the bot and app.

Codunot provides AI chat features, generation tools, moderation-adjacent utilities, and interaction commands for Discord communities and direct messages.

2. Information We Collect

When you interact with Codunot, the following types of information are processed:

Discord identifiers: user IDs, guild IDs, channel IDs, and message IDs.
Message content: messages sent to Codunot in DMs or when Codunot is mentioned/replied to.
Command and interaction data: command names, modes selected, model selection state, and feature usage events.
Attachments and media: images, files, and other content you submit for bot features, including optional avatar uploads used for /customise_bot_profile.
Usage and limits data: counters for message limits, attachment limits, and tier usage.
Vote unlock data: vote status checks and vote unlock timestamps for gated features.
Configuration data: server/channel configuration choices made by authorized admins.
OAuth and app auth data: authorization response parameters returned by Discord for app authorization.
Website OAuth parameters: temporary authorization response parameters returned to the redirect page.
Website preference data: cookie consent choices and UI preferences (theme, density, motion) stored locally.
Music and audio data: song names, URLs, and audio filter preferences for music playback via YouTube, SoundCloud, and Spotify.
Chess game data: chess moves, game state, and board positions during chess mode sessions.
Moderation data: moderation actions, warnings, cases, notes, and configuration choices.
Operational diagnostics: error logs, model/API errors, and system health events.
Location queries: location names, search terms, and place preferences you submit for mapping features.
Web URLs: URLs shared in messages for automatic or explicit content extraction.
Code submissions: code snippets submitted for testing and validation.
Web search and browse queries: questions, topics, and URLs submitted through /browse or enabled search integrations.
Transcription routing metadata: temporary channel/user delivery targets (including DM flag) needed to return completed transcripts.

We do not receive raw user IP addresses from normal Discord bot message events.

3. Message Content Handling

Codunot processes message content only when necessary to provide requested functionality (such as generating AI responses when mentioned or executing commands).

The bot retrieves recent messages from the active channel solely to provide conversational context.

We store a runtime context window capped at 10 messages and persisted encrypted memory capped at 15 entries per channel/DM to improve reply continuity. Older entries are overwritten or pruned as new messages arrive.

Codunot does not use user messages to train AI models.

This rolling context may include recent messages, timestamps, and active mode/model state for the current channel or DM.

4. Server Member Data Usage

Codunot accesses limited server member data (such as user IDs and usernames) solely to resolve AI-generated username references into valid Discord mentions.

The bot does not maintain independent user profile databases and does not store or share full member lists.

5. Privileged Discord Intents

Codunot uses Discord privileged intents including message_content and members for core chat behavior and moderation flows.

6. Code Execution Environment

The /test_code feature executes user-submitted code with a blocked-pattern filter and a 10-second timeout.

It only runs the submitted code and returns error reports (no AI fix calls).

This feature has guardrails, but it is not a full sandbox/isolation guarantee for every possible payload.

No submitted code persists beyond its execution session.

7. Music Playback

Codunot streams audio temporarily for playback within Discord voice channels. Music sources include YouTube, SoundCloud, and Spotify via Lavalink.

The bot does not download, store, cache, or redistribute copyrighted audio content.

8. Why We Use This Information

We process information to:

Provide bot replies and requested outputs.
Run generation features (images, video, text-to-speech, transcription, editing, merging).
Enforce daily and periodic usage limits.
Apply vote-based access controls and unlock durations.
Provide a limited rolling encrypted conversational context window for reply continuity.
Remember website preferences and cookie consent choices.
Maintain reliability, security, abuse prevention, and service quality.
Troubleshoot bugs and improve feature performance.
Comply with legal obligations and platform requirements.
Provide location and place search results via mapping services.
Extract and summarize web content from shared URLs.
Test, validate, and debug code submissions using guardrails (such as blocked patterns and time limits).
Retrieve web content via explicit /browse requests and any enabled search integrations.
Detect and prevent abuse, spam, or misuse of the service.

9. OAuth and App Authorization

When you authorize Codunot through Discord OAuth, Discord returns authorization data to the configured redirect page. Codunot uses this flow only to complete app authorization and update the website UI state.

Codunot does not automatically join your account to unrelated servers through this website flow.

10. Third-Party Processors and APIs

Codunot relies on third-party infrastructure and model providers to deliver features. Depending on your request, relevant prompt/media data may be sent to those processors.

Examples may include:

AI model and generation providers (including Groq, Google AI Studio, Hugging Face, and Replicate).
Transcription and media processing providers.
Vote verification providers (including Top.gg for vote-gated access).
Hosting and operational infrastructure providers (including deAPI where applicable).
Mapping and location service providers (such as Google Maps/Places API).
Web content extraction/search providers (including enabled browse/search integrations).
Music infrastructure providers (including Lavalink, Spotify integrations, and yt-dlp ecosystem sources).

Each third party processes data under its own terms and privacy practices.

11. Information Sharing

We do not sell personal information. We may share limited information only when necessary:

With processors required to run requested bot features.
With server administrators where functionality requires it (for example moderation/configuration context).
When required by law, legal process, or enforceable authority request.
To protect rights, safety, and service integrity in abuse or security incidents.

12. Encryption Scope by Datastore

The table below describes what is encrypted by app logic versus not encrypted by app logic.

Datastore	Encrypted by app logic?	Notes
Memory data	Yes (Fernet helpers)	Encrypted in code.
Moderation data	Yes (Fernet helpers)	Encrypted in code.
Playlists	Yes (Fernet helpers)	Encrypted in code.
Vote unlock file	Yes (Fernet helpers)	Encrypted in code.
top.gg votes datastore	No	Not encrypted by app logic.
chat configuration datastore	No	Not encrypted by app logic.
usage database	No	Not encrypted by app logic unless disk-level encryption is applied externally.

13. Data Retention

Retention depends on data type and operational need. Some data is short-lived, while some configuration or usage records may persist until removed, reset, or no longer required.

Data Type	Typical Retention	Reason
Conversation context (messages/timestamps/mode/model)	Limited rolling window per channel/DM; older entries overwritten	Reply continuity
Usage counters, attachment history, and tier data	Daily counters are separate; attachment rolling-window logic is 60 days and pruned by timestamp	Limit enforcement and abuse prevention
Vote unlock timestamps	Short-term, tied to unlock duration windows	Feature access gating
Guild/channel configuration and chat scope settings	Until changed or removed	Server setup behavior
Operational logs and errors	Limited operational period	Monitoring, debugging, security
Website local auth flag	Until browser clears it or user action resets	UI state only
Location search queries	Not stored persistently	Real-time API pass-through only
Web URLs and extracted content	Temporary processing only	Content extraction and summarization
Code test submissions	Not retained after execution output is returned	Real-time testing and validation
Web browse/search requests	Temporary processing only	Real-time information retrieval
Chess game state	Session duration only	Real-time game tracking
Moderation records (warnings, cases, notes)	Until cleared or server removed	Moderation history and accountability
Bot profile customization inputs (nickname/avatar)	Until changed or removed by authorized admins	Apply `/customise_bot_profile` settings
Transcription routing metadata	Temporary in-memory routing metadata, removed with pop after delivery attempt	Deliver transcript to the intended channel or DM
Music playback history	Session duration only	Queue management and playback

14. Security

We use reasonable technical and organizational safeguards to protect information. However, no internet system is fully risk-free, and no transmission/storage method is 100% secure.

Users should avoid sharing highly sensitive personal information in bot prompts or file uploads. Location searches are passed to third-party mapping services and should not include sensitive addresses or personal locations you wish to keep private. URLs submitted for browsing are accessed and may be logged by destination websites. Code submissions are processed with runtime guardrails (such as blocked patterns and time limits), but complete isolation is not guaranteed.

15. Children's Privacy

Codunot is not intended for users below the minimum digital age required by applicable law and platform policies. If you believe personal data from a child was provided improperly, contact us so we can review and handle the request.

16. International Data Processing

Because Codunot uses global cloud infrastructure and API processors, data may be processed in multiple jurisdictions. By using Codunot, you acknowledge this cross-border processing where legally permitted.

17. Your Rights

Depending on your region, you may have rights to:

Request access to information associated with your use.
Request correction of inaccurate information.
Request deletion of eligible information.
Request restriction or object to certain processing.
Request portability where legally applicable.

We may require identity verification before fulfilling requests.

You can manage website cookie preferences at any time using the Cookie Preferences button.

18. Data Deletion Requests

You may request deletion of eligible data through our support contact channels. Some records may be retained where required for legal, security, anti-abuse, or accounting obligations.

19. Premium and Payments

If premium access is provided, limited transaction and entitlement records may be processed for support, fraud prevention, and account/tier management.

Payment processing, where applicable, is handled by designated payment providers under their own policies.

20. Changes to This Policy

We may update this Privacy Policy at any time. Updates become effective when posted on this page. Continued use of Codunot after updates means you accept the revised policy.

21. Operator

Codunot is developed and operated by the independent developer known as MaggiCoder.

22. Contact Us

For privacy questions, legal concerns, or data requests, contact us through the Support page.

Open Support Page

Codunot Privacy Policy