In short
- The website sets no cookies and has no analytics, ads or trackers. Your browser only talks to this site and to my API.
- The names and image links you put into a link are used to draw your card and for nothing else. Finished cards are deleted from my server after 7 days at the latest.
- The API keeps short security logs with shortened IP addresses for 14 days. The website keeps no access logs.
- I do not sell data, I do not profile anyone and there are no ads.
Who is responsible
The controller, meaning the person responsible for your data, is:
| Name | [Owner name to be added] |
|---|---|
| Address | [Postal address to be added] |
| [Contact email to be added] |
Write to this address for any privacy request. I answer as soon as I can, and within the legal deadlines: one month under the GDPR and 30 days under the Swiss revDSG.
Where this runs
The website at www.discorddevtools.xyz and the API at api.discorddevtools.xyz run on a server that I operate myself, in Switzerland.
All traffic reaches that server through Cloudflare, which works as a CDN, proxy and tunnel in front of it. Your request therefore passes through Cloudflare's network before it reaches mine. Cloudflare acts as my processor: it handles the traffic on my behalf and may process technical data such as your IP address to deliver it and to block attacks. I do not control Cloudflare's own security processing.
Cloudflare is based in the USA. Transfers there rest on the Swiss-US Data Privacy Framework and the EU-US Data Privacy Framework, and on Standard Contractual Clauses (SCCs).
The website and its tools
DiscordDevTools is a toolbox for Discord developers. Today it holds one tool, the Welcome Image Generator, and this policy describes what that tool does. When a new tool changes what is processed, I will add it here before it goes live.
The website is a set of static pages. It sets no cookies, uses no analytics or tracking, and loads everything it needs (fonts, scripts, icons and images) from its own domain. The only other host your browser contacts is the API, and only on the generator page: it loads the template list and draws the preview of your card.
The generator keeps your settings in the address of the page, so that you can share a link. That address stays in your browser. The site stores nothing in cookies or local storage.
The web server keeps no access logs: it does not record IP addresses or which pages you open. It only writes a line when it starts and when an error happens, and those lines contain no IP addresses and no query strings.
The Welcome Image Generator and your images
When you or a bot ask for a welcome image, the API receives the settings in the link. That can include a title and text, a member's username or display name, and the addresses of an avatar and a background image. I use these values only to draw the image you asked for, which is the service you requested (Art. 6(1)(b) GDPR).
- If you give an image address, the generator downloads that image from it. Downloaded avatar and background images are held in the server's memory for up to 10 minutes.
- Finished images are cached on my server for at most 7 days and then deleted automatically.
- Once a card is posted in Discord, Discord and Cloudflare may cache the image under their own policies. I cannot delete those copies.
A link is not a secret. Do not put anything into it that should not appear on the card. If you run a bot, you decide which member names and avatars it sends me, so make sure your own privacy notice covers that.
Logs and abuse protection
The API keeps security logs to protect the service from abuse. A log line holds request details such as the time, the path and the response status, and the visitor's IP address in shortened form: IPv4 addresses are cut to their first three parts (a /24 network) and IPv6 addresses to their first 48 bits (a /48 network). The query string, which is where names and image links are, is not logged. Logs are deleted after 14 days.
The purpose is security and abuse prevention. The legal basis is my legitimate interest in running a safe service (Art. 6(1)(f) GDPR, and the equivalent principles of the revDSG).
Rate limits count requests in the server's memory for a short time. Those counters are never written to disk.
Cookies and tracking
There are none. No cookies, no analytics, no ads, no fingerprinting and no embedded third-party content. I do not sell data and I do not build profiles of people.
Your rights
Under the GDPR and the Swiss revDSG you can ask me for:
- access to the data I hold about you,
- correction of data that is wrong,
- erasure of your data,
- a limit on how I use it, or to object to its use,
- a copy of the data you gave me in a common format (portability).
Because I keep so little, and a shortened IP address cannot point to a person, I may not be able to find data about you. Tell me what you need and I will look.
You can also complain to a supervisory authority. In Switzerland that is the Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch. If you live in the EU or EEA, you can contact the data protection authority of your country.
Changes
I will update this policy when the service changes. The date at the top shows when it last changed. Questions are welcome: see the imprint or ask on the Discord server .