Bot Privacy Policy

NoryxBot is in development and not yet available to the public. This policy is published in advance: it will apply from launch. The policy of the noryxbot.com website is on a separate page.

1. Who is responsible

NoryxBot is created and run by Studio Zératik inc. (NEQ 1182750753), a corporation registered in Québec (Canada). Studio Zératik is responsible for the information described here, under Québec’s Act respecting the protection of personal information in the private sector.

This policy covers the NoryxBot bot (Discord, Twitch and Kick), the noryxbot.com dashboard and NoryxBot Presence.

2. In short

• NoryxBot only collects what it needs to work.
• It doesn’t read the content of your server’s messages.
• Nothing is sold, nothing is used for advertising or profiling, and nothing is used to train artificial intelligence.
• Removing NoryxBot from your server deletes that server’s data.

3. What we collect, why and for how long

Discord servers where NoryxBot is added

• What: the server ID, the chosen language, the modules turned on and their settings (for example the channel where stream alerts are posted, the welcome message or the moderation log channel), the linked Twitch and Kick channels (their ID and name, and the ID of the person who linked them), and the RSS feeds followed (their address, title, the channel where they are posted and the IDs of the last items already posted).
• Not kept: moderation actions (bans, kicks, timeouts, deleted messages) go to Discord and to your server’s log channel, not to NoryxBot. New members are only read to post the welcome message; NoryxBot doesn’t keep member lists. Button role panels store nothing on NoryxBot’s side.
• Why: to run NoryxBot the way you set it up.
• How long: as long as NoryxBot is on the server. This data is deleted as soon as it is removed.

Studio Zératik’s official servers

• Community stats: the number of members, arrivals and departures per day of the studio’s own servers. Only numbers, never who joined or left. Kept 400 days at most.
• Synced roles: which role on one studio server gives which role on another (role and server IDs).
• Le Refuge Zératik rules: when you accept them on the Refuge’s Discord server, your Discord ID is sent to studiozeratik.com to add the acceptance to your Studio Zératik account, if you have one. Its privacy policy applies there.

Commands

• What: when you use a command, Discord sends us your ID, the server, the channel and the command’s options.
• Why: to answer the command. This information isn’t kept, except for the settings the command changes.

The dashboard (sign-in with Discord, Twitch or Kick)

• What, with Discord: your Discord ID, username, display name, avatar, the list of servers you can manage and the IDs of the servers you’re in.
• What, with Twitch or Kick: your account’s ID, name and picture, which are public on the platform. We ask Twitch for no permission and Kick only for the one that says who you are. The access the platform gives us is used once to read this, then given back right away: no token is kept.
• We don’t ask for your email address on any platform.
• Why: to sign you in and only show you what is yours: with Discord, the servers you’re allowed to set up and where your profile shows; with Twitch or Kick, your own channel. Each account only opens its own part of the dashboard.
• How long: 7 days at most. The session is deleted when you sign out or when it expires, and you can take one account out of it at any time. We only keep a hashed fingerprint of the session ID, never the ID itself.

Twitch and Kick

• What: the live state of the channels followed (live, title, category), which is public on Twitch and Kick.
• Why: to post stream alerts and run the Twitch and Kick features you turn on.
• How long: the live state isn’t kept. A linked channel is kept until you unlink it or remove access in the platform’s settings.

The chat bot of your channel

• What: when you turn the chat bot on for your own channel: the channel’s ID and name, the bot’s language, your commands and regular messages, how many times each command was used, and the permissions you gave. We only ask for the permissions of the feature you turn on, at the moment you turn it on. On Twitch, NoryxBot keeps no access token of your account. When the chat bot comes to Kick, the token Kick gives us to write in your chat will be kept encrypted on our server in Québec, and erased as soon as you turn the chat bot off.
• Chat messages: NoryxBot reads each message of a chat where the chat bot is on, with the name and ID of the person who wrote it, to see whether it is a command and whether that person may use it. Messages aren’t stored: once read, and answered if it is a command, a message is forgotten.
• Why: to answer your chat’s commands and post your regular messages during your lives.
• How long: until you erase it on the dashboard (“Erase everything about my channel”), or one year after your last visit to the dashboard.

Your NoryxBot profile

• What: only what you write on the dashboard: a description, a location, your birthday (day and month only: we never ask for the year), whether to show and celebrate it, game profiles (the game and your name in it) and the servers where your profile shows.
• Who sees it: members of the servers you chose (or of every server you share with NoryxBot, if you chose that), with /profile. Your birthday is posted in a server’s birthday channel only if you turned it on and that server uses the Birthdays module. Game profile links open public pages of those games’ sites (stats, Steam, Xbox…).
• Why: to show your profile to your friends and wish you a happy birthday, as you chose.
• How long: until you change it or delete it on the dashboard (“Delete my profile”): it is erased right away.

RSS feeds

• What: NoryxBot reads the feeds a server follows, like a news reader, and posts the new items. It only reads public addresses and keeps the IDs of the last items posted, so it doesn’t post them twice.
• How long: until the feed is removed or NoryxBot leaves the server.

NoryxBot Presence

• Who: only members of the NoryxBot or Studio Zératik Discord servers. Joining one of them is your consent.
• What: your Discord ID, username, display name, avatar, status (online, idle…), devices in use, activities (games, streams), current Spotify track and custom status.
• Why: to make them available through the public NoryxBot Presence API, so you can show them on your website, your GitHub profile or your stream: cards (SVG or PNG), OBS overlay and social banner. This information is therefore public: anyone who knows your Discord ID can see it, and it stays visible wherever you put a card.
• How long: kept in memory only, never written to disk, and erased as soon as you leave both servers or the service restarts.
• Card images: to draw a card, the service fetches your avatar, the album art and the game image from Discord and Spotify. It keeps them in memory for 10 minutes at most, and a card converted to PNG for 15 seconds at most. None of this is written to disk.
• The social banner: the names and small lines you put in it are part of its address. The service shows them without storing them. If the banner shows a song, its album art is loaded directly from Spotify by the software that shows the banner (OBS, for example).
• People who see a card: their device (or the service that shows the image, such as GitHub) asks presence.noryxbot.com for the card. Their IP address is only used, in memory, to limit the number of requests; it is never kept. No cookies are used. A card may be cached for 30 seconds by browsers and by those services.

Subscriptions and payments

• Who: NoryxBot subscriptions are sold by Studio Zératik inc. and paid through Stripe. Your card details go to Stripe; we never see your full card number.
• What we keep: the Discord account and server the subscription is for, its status and the billing details described in the Studio Zératik privacy policy, which applies to purchases.
• How long: invoices and transactions are kept six years, as tax laws require.

Technical logs

• What: the service’s errors and events, which may contain a Discord server or user ID.
• Why: to fix problems and protect the service.
• How long: 30 days at most.

4. Who this information is shared with

• Stripe: processes subscription payments, under its privacy policy.
• Discord, Twitch and Kick: NoryxBot runs on their platforms, which process your data under their own policies.
• OVHcloud: the host of NoryxBot’s servers, located in Québec (Canada).
• Cloudflare: the host of the noryxbot.com website and dashboard, and where the server’s encrypted backups are kept.

No one else has access. We don’t sell or rent any information. We only share it with an authority when the law requires it.

Where your information is kept

• NoryxBot’s server (the bots, NoryxBot Presence, the dashboard’s sign-in sessions, server settings, profiles and birthdays): at OVHcloud, in Québec (Beauharnois, Canada).
• The server’s backups (made every night, to restore it after a failure): at Cloudflare (R2), in North America, stored encrypted. They are replaced over time and never kept longer than 6 months.
• The noryxbot.com website and reservations: on Cloudflare’s network.
• Discord, Twitch, Kick and Stripe process data mainly in the United States, under their own policies.

NoryxBot’s server is in Québec, so the information it holds stays in Québec. The backups, the website and what the platforms process are kept outside Québec. Before doing so, Studio Zératik assessed the privacy impact of these transfers and made sure the information receives adequate protection: the data processing agreements of OVHcloud and Cloudflare, encrypted backups, encrypted connections, and the security measures described below.

5. Security

Only authorized Studio Zératik personnel who need it can access the data. Connections are encrypted (HTTPS), the service’s keys and passwords are kept out of the code, and session IDs are stored as fingerprints. If a privacy incident presents a risk of serious harm, we notify the people affected and Québec’s Commission d’accès à l’information, as the law requires.

6. Your rights

At any time, you can:

• ask to access the information we hold about you, or get a copy in a common format;
• ask for it to be corrected or deleted;
• withdraw your consent.

Write to contact@noryxbot.com. We answer within 30 days. You can also file a complaint with Québec’s Commission d’accès à l’information.

7. Delete everything yourself

• A server: remove NoryxBot from the server. Its settings are deleted right away.
• The dashboard: sign out, or remove one account from your session. You can also remove access in Discord (User Settings → Authorized Apps), in Twitch (Settings → Connections) or in Kick’s settings.
• Your profile: “Delete my profile” on the dashboard (My profile). Everything is erased right away.
• Twitch and Kick: unlink your channel, or remove access in the platform’s settings (Connections on Twitch).
• The chat bot of your channel: turn it off on the dashboard, or use “Erase everything about my channel”: your commands, regular messages and permissions are erased right away.
• NoryxBot Presence: leave the NoryxBot and Studio Zératik Discord servers.

8. Young people

Discord, Twitch and Kick require a minimum age. If you are under 14, ask a parent first before signing in to the dashboard or joining a server to use NoryxBot Presence.

9. Person in charge of protecting personal information

Studio Zératik’s person in charge of protecting personal information answers any question about this policy: contact@noryxbot.com.

10. Changes

If this policy changes, the date at the top of the page is updated. A significant change will be announced on noryxbot.com and on the NoryxBot Discord server before it takes effect.