Server Wrapped Privacy Policy

Draft, have a lawyer review before launch. This is a launch-ready draft, not legal advice. Items in [square brackets] must be filled in before publishing.

Last updated: 2026-10-29
Operator: [legal entity name], trading as 2Space Group ("we", "us"), [registered address].
Contact: [privacy@serverwrapped.com] (placeholder)

1. Short version: zero retention

Server Wrapped is a Discord bot with two commands, /wrapped (everyone) and /wrapped-setup (admins), that turns a server's activity into animated, Wrapped-style story GIFs for that same server.
We read only the channels you pick (public only by default), make your GIF, then burn the data. Nothing stored.
Posted GIFs auto-delete after 7 days unless you tap Save.
Private and admin channels are never included unless an admin picks them, and they never show on public cards.
The only things we keep are your server's settings (including how long posts live: 1 day, 7 days, 30 days or never), Agency seat bookkeeping if you use that plan (a scrambled code for the subscriber, when the subscription ends, and which server ids hold a seat), and a do-not-include list for members who opt out.
We never sell data, never use it for ads or AI training, and never mix one server's data with another's.

2. What we read, and when

We only read anything when someone asks for a card with /wrapped (members for their own Me card; admins or a "Wrapped Manager" role for the whole-server story) or when a scheduled report the admins set up is due.

What is read	Why	What happens to it
Recent message history in the picked channels: time sent, channel, author's Discord user id, length, whether it had a file, reactions	To work out the stats on the card (busiest hours, top channels, top members, most reacted, awards)	Processed in memory, then discarded as soon as the GIF is made
Message text (only if Discord grants the Message Content intent and the server is on Pro with Topics on)	To count common words, phrases and emoji for the "What we talked about" card, and to show a short quote on "Most reacted"	Processed in memory, then discarded. Never written to disk. Links, mentions and rude words are never shown
Member list and join dates (only if Discord grants the Server Members intent)	The "New faces" stat	Processed in memory, then discarded
The server's subscription status, from Discord	To unlock paid features	Read live from Discord when needed

How far back we read depends on the plan: Free covers Today, This week and This month; Pro adds the last 90 days, custom ranges, This year and All time.

Channels: by default only channels that @everyone can see are read. Every card says "Counting N channels", and anyone in the server can tap 👀 What Bowbit reads in /wrapped to see the exact list. Private and admin-only channels are read only if a server admin picks them in /wrapped-setup > Channels, and their stats never appear on cards posted in public channels.

3. What we store

Data	Why	How long
Server settings chosen by admins: timezone, admin role, picked channels, report channel and schedule, card theme or colour, blocked words, whether the top-members list is shown	To run the bot the way the admins asked	Until changed, or 30 days after the bot is removed
Do-not-include list: the Discord user ids of members who tapped Leave me out in that server	So we can leave them out of every future card	Until they tap it again to come back, or 30 days after the bot is removed
Upgrade-prompt counters (shown, tapped, upgraded)	To improve the product	Plain numbers per server, no user ids
Error logs	To fix bugs	Command name and error type only, no message data, kept up to [30] days

We do not store message text, message ids, per-member counts, reactions, voice activity, or any copy of the GIFs.

4. The GIFs

Each GIF is made in memory and posted to your Discord channel. We keep no copy.
Posted GIFs auto-delete after 7 days. Tapping Save sends that person their own copy by Discord DM (or a private reply if their DMs are closed); it is theirs from then on, and we keep no copy. A server admin can tap Keep to stop the auto-delete for one post, which then stays as a normal Discord message under Discord's own policies.
The Me card is shown only to the person who asked for it.

5. How we use data

Only to make cards and scheduled reports for the same server the data came from, and to run the settings that server chose. We do not: - combine data across servers or build a profile of anyone; - sell, rent or share data with advertisers or data brokers; - use data for advertising, or to train AI models.

6. Who can see what

Server-wide stats and a top-members list are visible to members who can see the card. Admins can hide the top-members list.
Stats about one specific person (the Me button) are shown only to that person.
Stats from private or admin channels never appear on posted cards. They are only shown in private replies to people who can already see that channel, and only if an admin turns this on.

7. Opting out (Leave me out)

Type /wrapped in a server and tap Leave me out to be left out of every future card in that server. It works straight away.
Tap it again to come back in. Admins can see and manage the list in /wrapped-setup > Data/privacy.
Because we store no chat data, there is nothing else to delete. If you want a GIF you appear in removed before its 7 days are up, ask a server admin to delete the message, or ask us.
For any privacy request, email [privacy@serverwrapped.com] with your Discord user id. We answer within 30 days.

8. When the bot is removed

There is no chat data to delete, because none is stored. The server's settings and do-not-include list are deleted 30 days after the bot is removed. Re-adding the bot within 30 days keeps them.

9. Subprocessors

Who	What for	Where
Discord Inc.	Delivers messages and events to the bot; hosts posted GIFs; processes subscription payments (via its payment partners)	United States
[Hosting provider, e.g. Hetzner / DigitalOcean / Fly.io]	Runs the bot and stores the settings database	[Region]
Cloudflare, Inc.	Hosts the static website (serverwrapped.com). May process visitors' IP addresses for security, as any web host does	Global

We will update this list before adding a new subprocessor.

10. Security

Message data exists only in the bot's memory while a GIF is being made, typically for seconds.
Settings are stored in a database on [hosting provider, region], encrypted in transit and [at rest]. Backups of settings are kept up to [14] days.
The bot token and keys are kept outside the code and are never shared.
If a breach affects personal data, we will notify affected server owners and, where required, the relevant authority within 72 hours of becoming aware of it. [Counsel to confirm.]

11. Children

Discord requires users to be at least 13 (or the higher minimum age in their country). Server Wrapped is for Discord users who meet Discord's age requirement. We do not knowingly process data about anyone under 13. If you believe we hold data about a child under 13, email [privacy@serverwrapped.com] and we will delete it.

12. Your rights under GDPR (EU/EEA and UK)

Controller: [counsel to decide: we act as controller / the server owner is controller and we are processor]. Contact: [privacy@serverwrapped.com]. [EU/UK representative, if required.]
Lawful basis: legitimate interests (showing a community its own activity), balanced by zero retention, a server-only scope, public-only channels by default and an easy opt-out. Subscription records: performance of a contract.
Your rights: access, correction, deletion, restriction, objection (including to appearing in per-person rankings), and data portability. Tap Leave me out or email us. Because we store no chat data, an access request will normally return only settings and whether you are on the do-not-include list.
Transfers: data may be processed in the United States by Discord and [hosting provider]. Transfers rely on [Standard Contractual Clauses / the EU-US Data Privacy Framework]. [Counsel to confirm.]
Complaints: you can complain to your local data protection authority.

13. Your rights under CCPA/CPRA (California)

Categories processed: identifiers (Discord user ids) and internet activity within the server (message metadata), processed briefly in memory; commercial information (a server's subscription status).
Sale or sharing: we do not sell or "share" (for cross-context behavioural advertising) personal information, and have not done so in the last 12 months.
Sensitive personal information: none collected.
Retention: as in sections 3 and 8.
Your rights: to know, delete, correct, and not be discriminated against for using these rights. Tap Leave me out or email [privacy@serverwrapped.com]. We verify requests by asking you to confirm from the Discord account concerned.

14. The website

serverwrapped.com sets no cookies and runs no analytics or trackers.

15. Changes

We will post changes on this page and update the date at the top. Big changes will also be announced in the Server Wrapped support server.

16. Contact

[privacy@serverwrapped.com] · Support server: https://discord.gg/33fdhR4hrY