Your data

The short version

• Your Nitrado token is encrypted before it's stored, and the key that unlocks it is kept apart from the database, outside the website.
• The token is only ever used on our server to talk to Nitrado about your game server. It's never shown on any page, never sent to a browser and never written to our logs.
• Disconnect your server and its token is deleted. You can also switch the token off at Nitrado at any time.
• We never ask for passwords or real names, and we never see card details.

Your Nitrado token

To run a killfeed and manage your server, BeardoBot needs a Nitrado long-life token. It's the key Nitrado gives you for exactly this: letting a trusted tool reach your game server without your Nitrado password. Here's how we look after it.

• What it's used for. Reading your server's log files (for the killfeed, stats and zones), reading and saving the settings and files you change from the dashboard or Discord, and the actions you ask for, like restarts. Nothing else, and only for the server you connected.
• Encrypted at rest. Before your token touches our database it's encrypted with AES-256, using a fresh random value for every token. What's stored is unreadable without our key.
• The key lives somewhere else. The encryption key, like the site's other secrets, is kept outside the website's files and can only be read by the server itself. A copy of the database on its own reveals no tokens.
• Only ever unlocked on our server. The token is decrypted only at the moment BeardoBot talks to Nitrado, and only on our server. No page ever sends it to a browser (not even an encrypted copy), and it's never written to our logs.
• Checked before it's kept. When you add or replace a token, we first check that it really reaches your server. A token that doesn't is never stored.
• Encrypted in transit. The website only works over HTTPS, so your token is encrypted on its way to us too.
• Who can get to it. Only BeardoBot's developer can access the server and the database. Nobody else, including other server owners and Discord staff, can see your token or your settings.

You stay in control

• Disconnecting deletes it. When you disconnect a server from BeardoBot, its token is deleted from our database straight away. The same happens if BeardoBot is removed from your Discord and the server is cleaned up.
• Switch it off at Nitrado any time. You can revoke the token on Nitrado's Long-life tokens page whenever you like. BeardoBot stops being able to reach your server at once, and the dashboard tells you so you can add a new one if you want to.
• Rejected tokens are wiped. If Nitrado tells us a token has expired, we clear it rather than keep it.

What we keep about players

BeardoBot only keeps what it needs to run the features your server uses:

• Your Discord account basics. Your Discord ID, username and avatar, and which Discord servers you're in (so the dashboard knows what you can manage). When you log in we ask Discord for nothing more: not your email, not your password.
• Your gamertag, if you link it. Linking connects your Discord account to your in-game name, so stats, the economy and rewards can find you.
• What happens in game. Kills, deaths, weapons, distances, playtime, positions and connections, read from the server's own log files. This powers the killfeed, leaderboards, stats and zones.
• Feature records. Virtual currency, purchases in the shop, faction membership and similar records you create by using BeardoBot. They're all in-game and have no real-world value.
• Subscriptions. For owners who subscribe, the subscription status and PayPal's reference numbers. Payments go through PayPal, so card details never reach us.

What we never ask for

• Your Nitrado password. The long-life token means we never need it.
• Your PlayStation, Xbox or Nintendo account password.
• Your real name, address or phone number.
• Your email address. Discord login doesn't share it with us.
• Your card or bank details.

What's public

Some things are meant to be seen. The killfeed, the leaderboards and player stats on beardobot.com, and the bot's posts in Discord show gamertags with kills, deaths, weapons, distances and times, and, if the server's owner switches it on, where a kill or zone alert happened. That's what a killfeed is. Discord IDs, which Discord account is linked to which gamertag, server settings and tokens are never public. A server's owner can see the links and gameplay for their own server, so they can run it.

Removing your data

• Owners: disconnecting your server deletes its token and its account links.
• Players: you can unlink your gamertag at any time. If you'd like your gameplay history anonymised, so your name is replaced everywhere it appears, just ask and we'll do it.

The full legal detail, including your rights, is in our Privacy Policy.

Questions

Ask in our Support Discord, or email [email protected]. We're happy to explain anything on this page in more detail.