Privacy Policy

Discord account data. When you sign in with Discord, Discord shares your Discord user ID, username, avatar, email address, and the list of servers where you have administrator permissions. We use this to create your Skillbase profile and determine which Organizations you can access. We request only the OAuth scopes we need for the feature you're using (for example, we request the bot scope only when you connect the Skillbase bot to a server).

Discord server data (via the Skillbase bot). When an Organization Admin adds the Skillbase bot to a Discord server, the bot receives data from Discord necessary to power the features that Organization has enabled, which may include: server member lists and roles, member online/presence status (for roster and activity features), voice channel state, message reactions, moderation events, and, for specific opt-in features (such as slash commands or intake panels), the content of the messages that trigger those features. We do not log or store the general content of your server's channels; message content is processed only where a specific feature requires it (for example, reading the text of a VOD-review intake submission), and only for as long as needed to provide that feature.

Organization Content. Organization Admins and staff may enter data into Skillbase about members, applicants, and recruits — such as roles, notes, application answers, event attendance, and VOD review annotations. Skillbase processes this content on behalf of the Organization; the Organization Admin is responsible for the lawfulness of what they collect, as described in our Terms of Service.

Content you provide directly. Forms you fill out (such as applications or polls), documents, message templates, and VOD clips or comments you upload.

Technical and log data. IP address, browser/device information, timestamps, and similar data collected automatically for security, fraud prevention, and troubleshooting.

Early Access signups. If you join our Early Access waitlist, we collect the email address you provide.

We use a small number of strictly necessary cookies: to keep you signed in (authentication session), to remember your preferred language, and to protect the Discord OAuth sign-in flow against forgery (state/CSRF cookies). We do not currently use third-party advertising or analytics cookies. If that changes, we will update this Policy and provide any consent controls required by applicable law.

We use the information described above to:

• Provide, operate, and maintain the Service, including syncing roles, presence, and content between Discord and Skillbase;
• Authenticate you and enforce Organization-level permissions;
• Send transactional communications (such as application status updates or event notifications) through the dashboard, Discord DMs, or email;
• Maintain audit logs of administrative and security-relevant actions for accountability;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Respond to support requests and Early Access signups;
• Comply with legal obligations and enforce our Terms of Service.

We do not use Discord message content, or any other data obtained through the Discord API, to train machine-learning or AI models, and we do not sell your personal data.

If you are located in the European Economic Area or the UK, we process your personal data based on: performance of a contract (providing the Service you asked for), our legitimate interests (such as securing the Service and preventing abuse, balanced against your rights), your consent (where we ask for it, such as certain optional features), and compliance with legal obligations.

We share information only in the following circumstances:

• With Discord. Using the Service necessarily involves an ongoing exchange of data with Discord's platform (for example, role and nickname sync). Discord's handling of that data is governed by Discord's own Privacy Policy.

• With your Organization. Data you provide as a member of an Organization (profile info, application answers, activity) is visible to that Organization's admins and staff according to the permissions they configure.

• Service providers. We use infrastructure and hosting providers — currently Supabase for database, authentication, and file storage — to operate the Service. These providers act as our processors and are contractually restricted from using your data for their own purposes.

• Legal and safety reasons. Where required by law, legal process, or to protect the rights, safety, or property of Skillbase, our users, or the public.

• Business transfers. If Skillbase is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to this Policy.

We do not sell your personal data, and we do not share Discord message content with third parties for advertising purposes.

We retain personal data for as long as needed to provide the Service and for the purposes described in this Policy. In general: account data persists while your account exists; Organization Content persists while the Organization exists or until an Organization Admin deletes it; audit/activity logs are retained for a longer period to support accountability and security investigations; and message content processed for a specific feature is retained only as long as that feature requires, unless you or an Organization Admin chooses to save it (for example, as a VOD review comment).

When an Organization or account is deleted, we schedule the associated data for deletion, though some records may be preserved temporarily in backups or in soft-deleted form, or retained longer where we have a legal or audit obligation to do so.

Depending on where you live, you may have rights to access, correct, delete, export (portability), or restrict our use of your personal data, and to object to certain processing. California residents have similar rights under the CCPA/CPRA, including the right to know what personal information we collect and to request deletion; we do not sell or share personal information for cross-context behavioral advertising.

To exercise these rights, contact us at [CONTACT EMAIL]. If your data was entered into Skillbase by an Organization you belong to (rather than by you directly), it may be faster to contact that Organization's admins, since they control that data; we will still assist with requests directed to us. We will respond within the time required by applicable law.

The Service is not directed at children under 13 (or the higher minimum age required in your country), consistent with Discord's own age requirements. We do not knowingly collect personal data from anyone below that age. If you believe a child has provided us with personal data, contact us at [CONTACT EMAIL] and we will delete it and take appropriate action, which may include disabling the associated account.

We use technical and organizational measures designed to protect your information, including encryption in transit, access controls scoped by Organization and permission, and audit logging of sensitive actions. No system is completely secure, and we cannot guarantee absolute security. We do not currently hold formal third-party security certifications (such as SOC 2); if that changes, we will update this Policy to reflect it accurately.

Skillbase's infrastructure providers may process and store data in countries other than your own. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for transfers of personal data out of the EEA, UK, or Switzerland.

To operate certain features, the Skillbase bot requests privileged Discord Gateway intents — Server Members, Presence, and Message Content. Here is what each is used for:

• Server Members — to sync your Discord roster into Skillbase's member directory and keep role assignments in sync.
• Presence — to power "who's online/active" roster and readiness features.
• Message Content — used only where a specific feature you or your Organization enabled requires reading a message (for example, a slash command argument or an intake-panel submission); we do not passively log general channel conversation.

You can revoke this access at any time by removing the Skillbase bot from your server or revoking Skillbase's OAuth authorization in your Discord User Settings → Authorized Apps. Doing so stops new data collection but does not automatically delete data already stored for the Organization; an Organization Admin can request deletion as described in Section 7.

The Service may link to third-party sites, including Discord. We are not responsible for the privacy practices of sites we don't operate. Review their policies before providing information to them.

We may update this Policy as our practices, the Service, and applicable law evolve. We will update the "Last updated" date and, for material changes, provide reasonable notice before they take effect.

Questions or requests regarding this Policy? Contact us at [CONTACT EMAIL].