Effective date: September 15, 2026
Operator: Sharkcord
Privacy and support contact: support@sharkcord.com
1. Who this policy covers
This policy explains how Sharkcord handles information about website visitors, dashboard users, customers, and members of Discord servers that use our bot. You may be affected by an enabled server feature even if you never sign into our website.
Sharkcord is an independently operated service. Contact support@sharkcord.com about our handling of personal information. For account administration, service security, and billing administration, we determine the purposes of our processing. Server administrators decide which community features to enable and how to use their members’ information. For information we process solely on their instructions, such as operating a support desk, we may act as their service provider or processor where applicable law uses those terms. Their own privacy responsibilities remain. You may contact us directly about information held by Sharkcord regardless of whether you are a server owner.
Discord, Whop, OpenAI, and other providers have their own policies for their services. This policy does not replace those policies or authorize access outside Discord’s rules.
2. Information we receive and why
| Information and source | What we use it for |
|---|---|
| Discord account information: Discord user ID, display name or username, avatar identifier, and information about servers you can manage, received through Discord authorization. | Sign-in, displaying your account and available servers, and checking authority. Our sign-in requests identity and server-list access, not your Discord email address. |
| Authorization and security information: access and refresh tokens supplied by Discord, session identifiers, authorization state, request timing, IP-based rate-limit records, and operational error information. | Maintaining login, communicating with Discord, preventing misuse, and troubleshooting. We do not ask for your Discord password. |
| Server structure and configuration: server identity and ownership, channels, categories, roles, permissions, topics, imported snapshots, drafts, plans, and action history. | Building and synchronizing your workspace, reviewing changes, managing access, and running configured features. Some channel names or topics may themselves be private information. |
| Member and activity information: member IDs, join and departure events, roles used by features, invite attribution, last activity, channel and message identifiers, and activity counts. | Community analytics, invite reporting, workflow triggers, eligibility checks, and configured moderation or management. Some activity identifiers are hashed within a server; related records can still identify a member, so we do not describe these as wholly anonymous. |
| Widget and moderation information: votes, giveaway entries and results, role or rules choices, community application answers, review notes, moderation actions and reasons, and relevant member and staff IDs. | Providing the widget, reviewing submissions, selecting and recording outcomes, and supporting moderator decisions. |
| Join verification: short-lived challenge records linked to your Discord account, server, panel, and membership, plus completion status. | Validating a requested human-verification step before granting the configured member role and preventing replay. CAPTCHA is optional for server administrators; it may be required to access their community. |
| Ticket information: subject, description, requester and staff IDs, status, supported replies, internal notes, channel references, and action records. | Handling requests through Discord and the web support desk, keeping permissions consistent, and showing conversation history. |
| AI requests and drafts: your typed request, relevant server or blueprint context, generated proposals, and usage records. | Producing and saving builder or workflow drafts, validating them, and applying plan allowances. Section 4 explains what goes to OpenAI. |
| Purchase information: provider customer, subscription, payment, product and event identifiers; selected server and initiating account; plan, amount, currency, dates, status, refunds, and trial or usage eligibility. | Linking paid access to the correct server, handling cancellation and support, reconciling payments, and administering plan limits. |
| Direct correspondence: your email address, message, and information you provide when contacting support. | Answering requests, investigating reported problems, and maintaining necessary support records. |
You can browse public pages without a Discord account. Identity and authorization information are necessary to use the dashboard; payment-provider information is necessary for a paid purchase. AI use is optional. Omitting optional information may limit the particular feature that needs it.
3. Message content and visibility
Ordinary community-activity reporting records events and counts; it does not store the bodies of general chat messages as an analytics archive.
Ticket intake, replies submitted through Sharkcord’s supported reply controls, and staff notes are stored to operate tickets. If optional Discord ticket-message capture is enabled, the bot also copies supported text messages from eligible open ticket channels into the web support desk. This is restricted by the ticket and permission checks. It is not a general-chat transcript feature, and the current capture path does not ingest attachment files.
Information can be visible to the member who submitted it, authorized community staff, and other people allowed by the feature and Discord permissions. For example, giveaway winners or published messages may be visible in their destination channel. Discord administrators can have access to otherwise private ticket channels. Internal web notes have their own staff-access restrictions; do not assume a private note is hidden from every service operator.
Deleting or editing a message in Discord does not currently guarantee that an existing Sharkcord copy is also changed. Contact us about correction or deletion. Likewise, removing a copy from Sharkcord does not automatically remove messages, channels, or exports held by Discord or a community administrator.
4. AI processing
When you request an AI-assisted build, we send OpenAI your request and the relevant blueprint: channel, category, and role names and identifiers, purposes, permissions, and limited channel-topic text. Workflow assistance sends your request and relevant server name, available channel and role information, and widget names, kinds, identifiers, and status. Private structure can be included in builder context.
These features do not automatically attach ticket transcripts, member lists, widget answers, or general message history to the AI request. Anything you type into a prompt can still be sent, so do not include secrets, private conversations, or sensitive records. Generated drafts may be saved in your workspace and a temporary retry cache.
We do not train our own AI models on your Discord message content. OpenAI states that API inputs and outputs are not used for model training by default unless the customer opts in. Its separate abuse-monitoring and caching rules can still involve retention. We request that generated responses not be stored for later API retrieval, but this does not mean zero provider retention. See OpenAI’s API data controls.
5. Who receives information
- Discord: authenticates accounts, supplies server information and events, and receives the actions, messages, and interactions needed for the enabled features. Discord also processes native purchases where offered. See Discord’s Privacy Policy.
- Cloudflare Turnstile: when you open a protected verification page, Cloudflare processes browser and network signals such as IP address, user agent, TLS fingerprint, and site origin to distinguish automated traffic. We send a challenge token for server-side validation; we do not send Discord names or IDs to Turnstile. See the Turnstile Privacy Addendum.
- Railway and the infrastructure used to host Sharkcord: run the web service, worker, database, and related operational infrastructure. See Railway’s Privacy Policy.
- OpenAI: processes the AI request and context described above when you choose an AI feature.
- Whop and its payment partners: process purchases made through Whop. Our checkout integration sends an opaque purchase reference, plan details, and return address; Sharkcord keeps the mapping to your server internally. Whop may collect payment, contact, billing, device, or fraud-prevention information directly. Sharkcord does not receive or store your full payment-card number or security code. See Whop’s Privacy Policy.
- Google Fonts and other content hosts you interact with: the current website loads fonts from Google. Your browser therefore contacts Google’s servers and discloses connection information such as your IP address. Discord images and links or images configured by a community can involve additional external hosts. Those hosts process their own requests.
- Authorized community staff and service support: receive information needed to operate their enabled features or provide authorized troubleshooting. Our email service processes correspondence sent to support.
We may disclose necessary information in response to a valid legal obligation or to address a security incident, protect people, or handle an authorized transaction, subject to applicable law and Discord’s restrictions. A transfer of the business would require appropriate safeguards, notice, and any required consent; it is not permission to sell Discord member data.
We do not sell personal information, share it for cross-context behavioral advertising, or use Discord member data for targeted advertising. We do not use an advertising tracking pixel in the current site. Community analytics are a feature of the Service, distinct from advertising analytics.
6. Cookies and browser storage
| Storage | Purpose and duration |
|---|---|
sharkcord_oauth cookie | Binds a Discord sign-in attempt to your browser; expires after ten minutes. |
sharkcord_session cookie | Maintains sign-in; expires after seven days unless ended sooner. |
sidebar_state cookie | Remembers whether the sidebar is open; expires after seven days. |
| Local storage for demo state and tutorials | Saves demo changes, tutorial preferences, and page progress. Signed-in tutorial keys can include your Discord user ID. These records have no automatic time limit and remain until cleared or replaced. Older demo storage may use the former Guildwell name. |
| Session storage for sign-in recovery | Holds a pending personal draft, optional account identifier, and recovery metadata. The app accepts a pending draft for up to 24 hours and an authorization marker for 15 minutes. Validation expiry is not a guarantee that the stored bytes are immediately erased. Session storage generally ends when the browser tab’s session ends. |
You can clear cookies and site storage using your browser controls. Doing so may sign you out, reset tutorials, or erase unsaved drafts; it does not cancel billing or erase server-side records. Disabling optional tutorials is available in the app. Any consent required for nonessential storage or third-party loading must be obtained separately; this policy is not itself a cookie-consent mechanism.
7. Retention
We determine retention by the feature’s purpose, whether it remains active, whether information is needed to complete an operation or resolve a request, and any applicable legal requirement. Discord API information must not be kept longer than permitted by Discord’s terms. Expiry of access, bot removal, and account sign-out are different from deletion of records.
The current feature cleanup rules include:
- Join-verification links expire after ten minutes; expired challenge records are removed by maintenance. Rules-acceptance receipts follow the widget-entry retention described below.
- Expired sign-in state and sessions are removed by maintenance. Short-lived activity and widget action receipts are normally removed after seven days.
- Daily activity and member-event records are normally removed after approximately 90 days; departed-member records after 90 days from departure. Records for current members can remain while needed for active features.
- Application entries older than 90 days are removed by maintenance. Entries for other widgets are removed after that age once the widget is no longer live or closing. Live entries and separate widget outcome records can remain longer while necessary for their purpose.
- Closed-ticket conversation text expires 30 days after closure and is then cleared by maintenance. Reopening before expiry removes that deadline until the ticket is closed again. Open-ticket text and necessary ticket identifiers, status, and action records are not covered by the closed-text timer. Discord’s channel and message copies are separate.
- Completed flow and automation history is generally eligible for cleanup after approximately 90 days; pending work and associated records can remain while needed to finish or recover it.
- A temporary AI result cache is cleaned after approximately one day. A proposal you save as a draft or workflow remains with that saved item, and usage metadata has a separate purpose.
Maintenance depends on the worker running successfully, so a cleanup threshold is not a promise of deletion at an exact second. Account profiles, encrypted authorization credentials, personal drafts, saved configuration, some audit and moderation records, team-access records, and billing or eligibility records do not all have automatic age-based deletion. They require purpose-based review and, where applicable, a verified deletion request. We do not treat an introductory-offer rule as an unlimited right to retain a person’s Discord data.
Necessary financial records may need to be retained to satisfy a specific tax or other legal obligation. That does not justify retaining unrelated member content, credentials, or every trial and usage record. We will explain any lawful retention exception affecting a deletion request. Backup and provider copies can follow separate retention processes; we do not promise that a dashboard action instantly removes every copy. Contact us for information about the records relevant to you.
8. Your choices and requests
Email support@sharkcord.com with a subject such as “Privacy request.” Tell us whether you seek access, correction, deletion, or another action, and provide enough information to locate the relevant account or server. A Discord user ID or ticket reference is helpful. Do not send a password, account token, or identity document by default.
We may ask for proportionate verification to avoid disclosing or deleting another person’s information. A member does not need a paid account, dashboard access, or a server owner’s permission to contact us about their own data. Where we process information for a community administrator, we may coordinate with that administrator without giving them an unrestricted veto over applicable privacy rights.
Depending on applicable law, you may have rights to access, correct, delete, receive a portable copy of, or restrict processing of your personal information, withdraw consent where processing depends on consent, and complain to the relevant authority. We will address requests within applicable deadlines and explain any lawful limitation or extension. You may contact the UK Information Commissioner where relevant, or your local data-protection or consumer authority.
You may also have a right to object to processing based on legitimate interests. Contact support@sharkcord.com to exercise that right. We do not use personal information for targeted advertising, and we will not discriminate against you for exercising a protected privacy right.
To stop future Discord account authorization, use Discord’s authorized-app controls. To stop the bot’s server access, an authorized administrator can remove it or change its permissions. These steps do not themselves constitute a complete Sharkcord erasure request or cancel a subscription. A server owner’s workspace-disconnect control removes many workspace records but not every account or billing-related record. Use the email request route for broader deletion. Separately clear local browser copies when needed.
9. Lawful purposes, automation, and international processing
Where a law requires a lawful basis, we rely on contract necessity for account and purchased-service administration with the contracting user, legitimate interests in securely operating the requested community features and handling support where those interests are not overridden by individuals’ rights, applicable legal obligations for required records or disclosures, and consent where required. Processing solely on a community operator’s instructions depends on that operator’s appropriate basis and our applicable service-provider obligations. A server administrator’s agreement is not blanket consent from every member.
Configured rules can automatically assign roles, route tickets, restrict participation, or take moderation actions based on triggers, conditions, and permission settings chosen by the server administrator. Those actions can affect your access to the community. Contact the server’s moderation team for human review and contact us about a technical error. Sharkcord is not offered for automated decisions about employment, credit, housing, insurance, or other comparable consequential eligibility.
Sharkcord is operated from the United States. Our providers may process information in other countries, whose laws may differ from yours. We do not offer a guaranteed country-specific data-residency arrangement. Contact support@sharkcord.com for information about the processing locations and safeguards relevant to your use of the Service.
10. Security, age limits, and changes
We use measures intended to protect information, including encrypted Discord authorization tokens, hashed server-side session identifiers, HTTPS in production, and permission checks. No system can guarantee absolute security. Report a suspected incident to support@sharkcord.com without sending credentials or exploiting access to someone else’s information.
Our dashboard and purchasing accounts are intended for adults. Bot interactions are not directed to children below age 13 or Discord’s higher minimum age where applicable. If you believe Sharkcord has collected information about an underage child, contact us so we can investigate and take appropriate deletion and access measures. Do not submit regulated or highly sensitive personal information through bot features.
We will update this policy when our practices change, identify its effective date, and give appropriate notice of material changes. Where a new use requires consent, we will seek it before that use rather than rely on this policy alone.