Legal

Privacy policy

As of 25 October 2026 · Loot Goblin 2.0.0 · GDPR / TDDDG

1. Controller

Joscha Alhelm
c/o Autorenglück ID 60084
Albert-Einstein-Str. 47
02977 Hoyerswerda
Germany
Email: gamesgamble@loot.rocks

The operator named above controls Loot Goblin at loot.rocks. Discord and optional integration providers process data under their own responsibility. Server operators remain responsible for their servers, content, permissions and their use of the bot.

2. Hosting, website and logs

Website, dashboard, guild site and API run at https:/loot.rocks. HTTP requests process IP address, time, method, URL, status, transferred bytes, referrer and user agent for delivery, diagnostics, abuse prevention and security. Logs are deleted under technical rotation; incident-related records may be kept until investigation and legal claims are complete.

/status and /health expose technical status without intentionally publishing user profiles. Prometheus handles technical metrics; Alertmanager may send incident notices without chat or profile content to an operator webhook. No advertising pixels or third-party analytics cookies are used. Legal basis: Art. 6(1)(f) GDPR and, for legal duties, Art. 6(1)(c).

3. Accounts, Discord sign-in and cookies

Classic dashboard accounts store username, PBKDF2-HMAC-SHA256 password hash, role, server assignment, module and beta grants, and application status. Plaintext passwords are not stored. Discord OAuth2 processes Discord ID, display name, avatar and servers where “Manage Server” is held. The guild site also checks current membership and roles.

Sessions contain a random session secret stored server-side only as a hash, CSRF data, expiry, IP and user agent. aether_sid is HttpOnly, SameSite=Lax and Secure on HTTPS, typically for 12 hours. Short-lived cookies protect login and OAuth. They are strictly necessary under § 25(2) no. 2 TDDDG. Failed-attempt counters and rate limits serve security. Legal basis: Art. 6(1)(b) and (f) GDPR.

4. Discord data

Depending on intents, permissions, enabled modules and interactions, the bot receives server, channel, role, message, interaction and user IDs; profile and role data; message content, reactions, attachments and command input where needed; voice-channel metadata; audit, moderation and configured emoji data. Discord shows an app’s specific access in its profile. API data is not sold, used for advertising or used to train the operator’s own AI models.

5. Guild and feature data

Enabled modules may store configuration and permissions, applications, profiles, ranks, skills, interests, teams, divisions, activity and absences, events and sign-ups, series, tasks, loot and distributions, currencies and transactions, inventory and ships, tickets and history, embed drafts, revisions and schedules, calendar links, alliance membership and approvals, and audit records. Profiles may contain RSI, FleetYards, TeamSpeak, Joomla or Twitch identifiers.

Shared events, tasks and loot sessions become visible across alliance guilds only under recorded approvals. Server admins must inform members about those grants.

6. Messages, files and notifications

Ticket and loot uploads are limited and checked, kept temporarily in memory and sent to Discord; the web service does not keep a permanent local copy. Discord stores the message and attachment under its rules. Message IDs, attachment metadata and URLs may be stored for the browser history. Ticket creators may receive functional Discord DMs about changes when enabled and deliverable.

Scheduled embeds store copy, media URLs, target channel, components, schedule, revisions and delivery status. Reactions and buttons can trigger configured bot or integration actions.

7. Optional integrations

• Google Calendar: voluntary OAuth with calendar.app.created. Stored are Discord user and server IDs, encrypted refresh token, client ID, the Loot-Goblin-created calendar ID, event mappings and sync state. Existing private calendars are not read. Disconnecting deletes tokens and mappings, attempts revocation and can delete the created calendar.
• OpenAI or xAI: /ai ask sends the question, configured system prompt and Discord display name to the selected provider.
• Joomla, Kunena, JEvents, DPCalendar, Raid-Helper and TeamSpeak: configured account links, display names, roles, events, calendars, forum and online status may be synchronized.
• Twitch, YouTube and X: public or token-authorized channel, stream, video and post data may be fetched for announcements and roles.
• RSI, UEX and FleetYards: handles, organization and public fleet data, searches and price requests support Star Citizen features.
• Lavalink and media sources: search terms, URLs and playback commands go to the configured audio node and media source. The bot does not send the Discord user’s IP address.

An integration processes data only after configuration or deliberate use. Each provider has its own privacy notice.

8. Guild API, webhooks and recipients

Authorized officers may create read-only guild API keys and webhooks. A key holder can retrieve its granted categories; the server admin selects and is responsible for that recipient. Webhooks can transmit data to Discord, Joomla, TeamSpeak or another configured destination. Keys and secret feed links must be revoked if lost.

9. Legal bases

• Art. 6(1)(b) GDPR for requested bot, account, calendar and integration functions
• Art. 6(1)(f) for secure operation, authorization, abuse prevention, moderation, diagnostics and legitimate guild organization interests
• Art. 6(1)(a) where a feature expressly relies on consent; consent can be withdrawn for the future
• Art. 6(1)(c) for legal obligations

Server operators must determine their own legal basis for using bot features for members. Required features cannot work without the necessary Discord IDs and input.

10. Third parties and international transfers

Recipients are the operator, technical service providers and — only when used — Discord, Google, OpenAI, xAI, Twitch, YouTube, X, Raid-Helper, Joomla/calendar, TeamSpeak, RSI, UEX, FleetYards, Lavalink or another configured provider. Some providers process data outside the EEA, particularly in the USA. Transfers rely on the safeguards available for that provider, such as an adequacy decision including the EU-US Data Privacy Framework or EU Standard Contractual Clauses. The selected provider’s current notice should be reviewed before enabling it. No disclosure for advertising or data brokerage.

11. Retention and deletion

• Sessions: until logout, revocation or expiry, typically 12 hours
• Google OAuth state: no more than 10 minutes and single-use
• Google refresh token and mappings: until disconnect or loss of authorization
• Server configuration and guild content: until deletion by an authorized person, bot removal, a justified request or shutdown; not every content type currently has a fixed automatic period
• Audit and security data: while needed for accountability, abuse prevention or claims; technical logs under configured rotation
• Third-party data: under that provider’s retention and deletion controls

Statutory retention and legal claims may delay deletion.

12. Data-subject rights

Subject to Arts. 15–21 GDPR, individuals may request access, rectification, erasure, restriction, portability and object to processing. Consent may be withdrawn for the future. Art. 77 GDPR provides a right to complain to a supervisory authority. Requests go to gamesgamble@loot.rocks; appropriate identity verification may be required.

13. Automated decisions

No decision with legal or similarly significant effect is made solely by automated processing under Art. 22 GDPR. Automod filters, role rules, beta workflows and AI responses are technical aids that responsible people can review and override.

14. Minors

The service is not directed at persons below Discord’s applicable minimum age. The operator does not perform independent age verification. Server operators must comply with Discord and applicable youth and privacy rules.

15. Security and changes

The service uses access controls, hashing, CSRF protection, rate limits, encrypted Google secrets and audit records. Absolute security cannot be guaranteed. This policy changes when features, recipients or law change; the current version is at /datenschutz.