BETA
Sign in

CLOSED BETA

Privacy

Guild OS stores the minimum Discord and community information needed to install the service, authorise members and operate guild events.

What we store

  • Discord user, server and role identifiers, usernames and display names.
  • Community configuration, characters, events, signups, confirmation and attendance history.
  • OAuth credentials where required for Discord login and server reconciliation. Credentials are encrypted at rest.
  • Operational records such as durable jobs, grants and code-redemption audit data.

Why

This data lets Guild OS provide tenant-scoped dashboards, Discord interactions, reminders, event history and access control. Guild OS does not sell user or community data.

Optional FFXIV activities store your own self-reported period status, journal issue/deadline, reminder preferences and delivery outcomes. These are private to your current community membership, not detected in-game completion or raid attendance. Minimal private history is removed in bounded daily batches after 90 days beyond its period/deadline; community deletion removes it immediately. Public Fashion Report data is limited to attributed links and challenge metadata, separately from your checklist. A community guide override is public to that community. Previously delivered Discord messages and recovery backups are not erased by local cleanup.

For optional personal reminders, we store your selected activities and offsets, display timezone, quiet hours and delivery outcomes. These preferences and recent outcomes are private to you. Unsubscribing stops future delivery while retaining history; permanent community deletion removes these community-scoped records.

Optional welcome, newcomer-role and message-cleanup tools retain minimal community, member, channel, count and outcome records. Message IDs are held only for pending cleanup and retry safety, then cleared; deleted message bodies and attachments are not archived. Bounded cleanup removes these audit records after their action expiry plus 30 days. This local privacy cleanup continues when a community is archived or disconnected; permanent community deletion removes its utility records immediately.

Conversation messages and attachments stay in Discord. Guild OS stores the opening summary and ticket lifecycle details: community/requester/support identifiers, readable support identity, membership and lifecycle timestamps, exact channel ownership references, a short subject, optional opening description, closure and reopening reasons, and private closure-notice delivery status/references. A subject may appear in a new ticket's Discord channel name; do not include sensitive information in it. Descriptions and reasons are restricted to the current requester or designated support staff; actual Discord server owners and Administrators inherently retain their Discord access powers. No transcripts or attachment archive are created.

Automatic closed-channel deletion is off unless a community administrator selects a 1–365 day delay. Local ticket-text retention is separate, defaults to 90 days after closure and is configurable from 30 to 365 days. Expired summaries/reasons are redacted and minimal ownership/delivery references remain where needed for safe channel management and duplicate-notice prevention. Expired records for deleted channels are removed by bounded cleanup. Local redaction does not erase a previously delivered Discord message or DM, or a retained recovery backup. Archiving does not delete Discord conversations; permanent Guild OS community deletion removes its local ticket records. Discord remains responsible for its own stored content.

Backups and disaster recovery

Optional FFXIV Company Actions stores editable community definitions, private planning notes, approved schedule revisions, explicitly reported activation/correction history and exact Discord agenda references. Planning does not prove in-game activation. Private drafts and correction reasons remain staff-only; approved schedules and recorded status are visible to current community members. Disabling the module preserves history; permanent community deletion removes these local records. Delivered Discord messages and retained recovery backups have separate retention.

Optional ROM God Gear stores community item/recipe definitions, material and equipment counts, staff-configured rotation eligibility, minimal loan/craft snapshots, usage and adjustment history, and exact Discord board references. Exclusions are explicit and private staff notes are not published in member summaries or boards; attendance is not inferred. Records stay with the community when the tool is disabled or a member leaves, so an outstanding physical loan is not silently erased. Permanent community deletion removes its local God Gear records. Previously posted Discord snapshots and retained recovery backups have their own retention. Individual data requests can be raised through Support.

Optional Teams stores community arrangements, member and optional character references, contextual leaders, and minimal historical display names, roles and availability in event line-up revisions. A planned place is not a signup or proof of attendance. Staff drafts remain restricted until explicitly published. Archiving a formation preserves its history; completed line-ups do not change when names or usual teams change. Permanent community deletion removes these local arrangements, line-ups and publication references. It does not erase already-delivered Discord boards or retained recovery backups. Individual privacy requests can be raised through Support; no portraits or team-photo uploads are stored.

Guild OS makes operational database backups to recover from service failures, accidental data loss or a failed deployment. These backups can contain the community and member information listed above. They are recovery copies of the service, not a separate backup service for individual guilds.

Local database backups have restricted file permissions and currently use a 14-day retention setting. One encrypted off-server Google Drive recovery copy has been uploaded, retrieved and restored into an isolated test database. Automatic off-server uploads and retention scheduling are not yet enabled. Recovery copies are encrypted before upload to a private Google Drive account controlled by the Guild OS operator; the planned automatic retention period is 14 days.

Google Drive access for the backup agent

The separate Guild OS Backup Agent is authorised only by the operator. Guild members are not asked to connect a Google account, and the agent does not access their Google Drive files or store backups in their accounts.

The planned connection uses Google's limited per-file permission to manage backup files it creates or files explicitly made available to it. Backup files and their metadata are used only for upload, integrity checks, recovery and retention management, not advertising or sale. Google provides the off-server storage; access to the backup account and recovery credentials is restricted to the operator.

The operator can revoke the agent's Google authorisation to stop future access. Revoking access does not itself delete already-uploaded recovery copies; those must be removed through the backup retention process or by the operator.

Retention and deletion

Disconnecting or archiving a community preserves its history. A community administrator can separately request permanent deletion from the community data-controls page. Deleted data may remain in restricted recovery copies until those backups expire. Backup data is not used for ordinary service activity while awaiting expiry.

Discord

Discord is a separate service with its own terms and privacy practices. Guild OS does not control Discord accounts, servers or message retention.

Questions or deletion help are available through Support.