Privacy Policy

Last updated 3 October 2026

This describes what the havocish Discord bot and the dashboard at havocish.com store, why, and how to have it removed. It is written against what the code actually does rather than in the widest terms we could get away with.

What we do not collect

The bot does not have Discord’s Message Content intent. It cannot read what you write, and it stores no message text. Awarding XP uses only the fact that you sent a message in a configured channel, and when.

We also never collect:

the content of messages, attachments or direct messages;
voice audio — voice XP counts time connected to a channel, nothing more;
your email address, real name, phone number or IP-based location;
payment details, because havocish takes no payments.

There are no third-party analytics, trackers or advertising on the dashboard, and your data is never sold or shared for marketing.

What the bot stores

For each player, and separately for each server they play in:

your Discord user ID, and your username and avatar URL so the dashboard and profile cards can show who you are;
progression: XP, level, gold, streak count, inventory, equipped items, quest progress, achievements and combat stats;
timestamps for your last message and last daily claim, which is how cooldowns and streaks work;
your own privacy and DM preferences for the bot;
trade offers you send or receive: the two user IDs, the items and gold on each side, the status and the timing.

For each server:

the server ID, name and icon URL;
the configuration its owner set: XP rates, level curve, role rewards, shop items, quests, achievements, enemies, logging and style settings.

The bot also keeps an event log so a server’s owner can audit what happened: entries such as “XP gained”, “daily claimed”, “item bought”, “level changed” or “trade completed”, each with the user ID involved, the amounts and a timestamp. No message content appears in it.

What the dashboard stores

Signing in uses Discord OAuth with the identify and guilds scopes: your account and the list of servers you are in, so we can show the ones you own. Your session, including the Discord access token, is held in an encrypted cookie in your browser — the token is not written to our database. Signing out clears it.

One strictly necessary cookie carries that session. There are no advertising or analytics cookies, so there is nothing to opt into.

Where it is stored

Data sits in a PostgreSQL database hosted by Neon in the United States. The bot runs on Fly.io and the dashboard on Vercel. Those providers process data on our behalf, as does Discord, which is where the bot operates. If you are outside the United States, using havocish means your data is handled there.

Uncaught errors are posted to a private Discord channel we watch, so a crash gets noticed. Those reports can include a user or server ID, never message content.

How long it is kept

Progression is kept while you keep playing. Removing the bot from a server does not delete that server’s data: it is marked as removed, so progression survives an accidental kick and is there again if the bot is re-added. Event log entries are kept for auditing. Everything is deleted on request, as below.

Your choices

You can ask us to send you a copy of everything stored about your account, correct it, or delete it. Email support@havocish.com from an address we can tie to your Discord account, or contact us from an account that can prove ownership, and include your Discord user ID. We answer within 30 days.

Deleting your data removes your progression, inventory, gold and trade history for the servers you ask about, which cannot be undone. Depending on where you live you may also have rights to object to or restrict processing, or to complain to a data protection authority. A server owner can ask for their server’s configuration and event log to be deleted the same way.

You can also simply stop: leaving the server, or asking its owner to remove the bot, means nothing new is recorded.

Children

havocish is not for anyone under 13, or under the minimum Discord age in your country. We do not knowingly keep data for such an account; if you believe we have, email us and it will be removed.

Changes

This policy changes when what we store changes. The date at the top says when it last did, and the Terms of Service cover the rest of the arrangement.