Privacy Policy

Discord identity. When you log in to the web dashboard, we use Discord OAuth with the identify scope only. This gives us your Discord user ID, username, and avatar. We do not request your email address, and we never see the content of your Discord messages.

Gameplay data. Playing the bot generates data tied to your Discord user ID — character stats, class, inventory, gold, quest progress, and other game activity. This is the data that makes your character work, and it's what the bot and dashboard read and write as you play.

Server data. For servers (guilds) that add the bot, we store the guild ID plus that server's configuration — things like the adventure channel, prefix, and feature toggles admins set with !adventureset.

We use exactly two cookies, both functional and neither used for tracking or advertising:

• wyrmhole_session — an httpOnly session cookie that keeps you logged in to the dashboard. Expires after 7 days.
• oauth_state — a short-lived cookie used only during the Discord login handshake to prevent CSRF, then discarded.

No analytics cookies, no third-party ad trackers, no cross-site tracking pixels.

Your data is used to run the game and the dashboard that reflects it: resolving adventures, tracking progression, powering leaderboards, and rendering your server's town and profile pages.

Public leaderboards (adventure, gold, weekly, boss, seasonal, and side games) show your Discord username and avatar next to your rank. Profile pages are private by default — nobody else can view your profile unless you flip the opt-in public share toggle yourself.

All game and account data lives in our own PostgreSQL database and Valkey cache — infrastructure we operate ourselves. We do not sell your data, and we do not share it with third parties for marketing or any other purpose.

Site traffic to wyrmhole.xyz and the dashboard API is proxied through Cloudflare, which provides standard network-level protections (DDoS mitigation, TLS termination) but does not receive gameplay or account data beyond what's needed to route the request.

• Log out of the dashboard at any time — this clears your session cookie immediately.
• Keep your profile private (the default) or opt in to a public share link, and opt back out whenever you like.
• Request removal of your data by reaching out through the channels below — we'll delete your character and account records on request.

Questions about this policy, or want your data removed? Reach out via the project's GitHub repository at github.com/KingPin/Wyrmhole, or through the support Discord server (linked from the home page once it opens out of beta).