Privacy Policy

1. Overview

This Privacy Policy explains what information Auralink collects, how we use it, and the choices you have. It applies to the dashboard, documented public API endpoints, public pages, Discord bot hosting, and all related features described in our Terms of Service.

Auralink is an API platform that lets you connect and use your own Discord bot. If you add a Discord bot token, Auralink uses it only to authenticate your own bot and provide the Discord features you request. Your bot remains yours, and Auralink does not own or operate it.

We collect only what we need to operate the platform, connect the Discord bots you provide, enforce limits, prevent abuse, and process optional purchases. We do not sell your personal information.

2. Account and identity data

When you create an account, we collect information such as your email address, display name, and profile details from Discord, GitHub or Google if you choose to sign in with one of those providers. We store a hashed password if you register with email and password.

We also store account settings, connected sign in identifiers, alpha redemption status, your AI token balance, whether you have claimed the welcome bonus, subscription state, which version of the Terms of Service you accepted, and internal account flags related to abuse review or enforcement.

You are responsible for keeping your login credentials secure. We may require verification before restoring access after a suspected compromise.

3. API keys and bot tokens

API keys are generated in your dashboard and stored in hashed form, never in plaintext, so they cannot be recovered from our records. We retain only key details such as label, creation time, last used time, and enabled scopes so you can manage access. The full key is shown to you once at creation and is never displayed again.

If you provide a Discord bot token, it is encrypted when stored. It is only decrypted when a request or an active bot session requires it, is never shown in your dashboard, and is never sent to your browser. We retain only details such as your bot's username and connection status. You may update or remove your bot token from Settings at any time. Removing it disconnects the bot session.

Auralink never requests, stores, or uses Discord user account tokens or your Discord login. Only bot tokens you choose to provide are used, and only for bot authentication and the Discord API features you request.

4. API usage and logs

When you use public API endpoints with an API key, we log request details such as the endpoint accessed, the method used, whether the request succeeded or failed, response time, timestamp, approximate size, and the associated account or key identifier.

We do not routinely log full request bodies unless a feature requires storing the content you submit. Examples include transcript messages, card data, QR code payloads, search queries needed to fulfill a lookup, and AI conversation memory tied to a prompt code.

Usage logs help us enforce rate limits, diagnose errors, detect abuse, and understand platform load. We may retain aggregated analytics derived from logs even after individual log entries expire.

5. Auralink AI data

If you use Auralink AI for chat, summarize, translate, or moderation, we process the text you send, optional system instructions, and conversation context needed to fulfill the request. Chat may store short term memory using prompt codes and, for multi user threads, speaker labels you provide.

To generate a response, the text you send is passed to the AI provider that runs the model you chose: OpenAI, Google, Mistral, Cloudflare or Anthropic. Each provider handles it under its own terms and privacy policy, and we do not control how a provider treats the data it receives. Choose your model with that in mind, and do not send information you are not comfortable sharing with that provider.

We do not use your prompts or AI responses to train models of our own. We record how many tokens each request used, along with the model, the endpoint and the time, so that we can bill you, show your usage in the dashboard, and enforce limits.

We automatically check AI requests and replies for certain categories of harmful content. Child sexual abuse material is blocked. For other categories we do not block the request, but we may keep a short excerpt, the category matched, a count of detections, and a related security event so that we can review activity and enforce our terms. Repeated detections may flag an account for review, and serious or repeated violations may lead to suspension or referral to authorities where required by law.

AI memory and related stored content count toward your account storage limit. You can delete AI memory from Settings, or delete your entire account to remove associated information.

6. Transcripts and stored content

Transcripts you create through the API or dashboard may include message text, author identifiers, timestamps, channel information, and optional passwords for protected viewers. Cards, QR codes, cached lookup results, and similar stored items are kept until you delete them or your account is removed.

You choose whether to publish public viewer links. Anyone with a link and correct password, if set, may access that content. We may remove stored content that violates our terms, exceeds quotas, or creates legal or security risk.

7. Public endpoints and viewer access

Some features expose unauthenticated public routes, such as transcript viewer pages and documented public API paths marked as public in our documentation. Access to those routes may be logged with IP address, user agent, timestamp, and requested resource identifier for security and abuse prevention.

Do not share public links to content you do not want others to see. Password protected transcripts still rely on you choosing a strong password and limiting distribution of the link.

8. Cookies and sessions

The dashboard uses session cookies to keep you signed in. These cookies are tied to your account and are required for dashboard authentication. Dashboard actions use separate account routes from the public API and are tied to your logged in user identity.

The first time you visit, we ask whether you agree to our use of cookies, and we remember your answer on your device. You must agree in order to create an account. If you decline, you can still browse the public pages.

We do not use third party advertising cookies on the core dashboard. Essential cookies needed for login, security, and checkout redirects may still be set when you use those features.

9. Payments and billing records

If you purchase AI tokens, start a subscription, or make a donation, payment is processed by Stripe. We do not store your full card number on our servers. Stripe provides us with transaction identifiers, payment status, amount paid, currency, and subscription state so we can add the right tokens to your account.

Purchase history, token grants, and entitlement records may be retained for billing support, fraud prevention, and dispute resolution. If you donate and earn a role in our Discord community, we use your Discord identifier to give you that role. See our Terms of Service for our strict refund policy.

10. Collaboration and shared dashboards

If you use Collab to share your dashboard, the people you invite can see the areas you grant them, such as cards, analytics, keys, AI usage, or transcripts. That is information about your account and your content, and sharing it is your choice. We keep a record of who has been granted access and with which permissions so the feature works and so you can revoke access at any time. If you join someone else's dashboard as a collaborator, the owner can see that you have access.

11. Account security and sign in data

To protect accounts we keep records of your sign in sessions, security events such as new sign ins and password changes, and the devices you use. If you register a passkey, we store the public part of it. If you mark a device as trusted, we store a record of that device so we can skip extra checks on it. If you turn on email based two factor authentication, we send you sign in codes by email.

We may record the IP address tied to a sign in, and the approximate area it points to (the state or region and the city), to help detect suspicious activity. We do not collect your exact address. You can review your sessions and sign out other sessions from Settings.

12. Anonymous reports

You can submit a report on our reports page without an account. A report includes the message you write and its category. You may also add a Discord username, a Discord user ID, a page URL, and the people or items involved, all of which are optional. Please do not include passwords or API keys.

We also keep the time of the report and a hashed network identifier, which lets us apply cooldowns and spot abuse of the form without storing your IP address in readable form. We use reports to look into the issue raised and to protect the reporting system, and we keep them for as long as we need to do that.

13. Referral links

If you arrive through a referral link, we record which link was used and some technical details about the visit, including your IP address, browser and device details, and a device identifier. We use these to credit the referral to the right person and to catch abuse such as fake sign ups. If you sign up afterwards, we connect that sign up to the referral link.

14. Transparency reports

We publish transparency reports about enforcement activity, such as how many accounts were banned, how many appeals were made and how many data requests we received. These reports are written in aggregate. They do not name or identify any individual user, and they do not include the content of anyone's account.

15. Abuse detection and law enforcement

We monitor for abuse using automated systems and human review where appropriate. Signals may include rate limit breaches, AI content detections, duplicate account patterns, chargeback history, and reports from rights holders or users.

We may preserve and disclose information when we believe disclosure is necessary to comply with law, respond to lawful requests, protect the safety of any person, address fraud or security issues, or enforce our terms.

Child safety and credible threats of violence are treated as highest priority matters. Relevant data may be retained longer and shared with appropriate authorities when required or permitted by law.

16. How we use your information

We use your information to authenticate you, provide API and dashboard services, generate usage analytics, enforce rate limits and AI token limits, process payments, detect and stop abuse, respond to support requests, comply with legal obligations, and improve platform reliability. Your Discord bot token is used only to connect and authenticate your own bot and to make requests to the Discord API on your behalf when you use the Discord features you request.

17. Data storage and retention

Data is stored on private infrastructure operated by the project owner. We apply reasonable access controls and security practices to protect stored information. Passwords and API keys are hashed before storage, so they cannot be recovered. Discord bot tokens and other sensitive credentials, along with sensitive sign in details such as the IP address tied to a login, are encrypted when stored and are only decrypted when needed to fulfill your requests. They are never logged or shown to you or anyone else.

We retain account data while your account is active. Stored content remains until you delete it or your account is removed. AI memory and certain cached items may expire automatically based on feature settings or storage limits.

After account deletion, we remove or anonymize associated personal data within a reasonable period, except where we must retain records for legal compliance, fraud prevention, billing disputes, or enforcement of our terms.

18. Data sharing

We do not sell, rent, or share your personal information with third parties for their marketing. Data is transmitted to third party services only as necessary to operate the platform. These include Discord, GitHub and Google for signing in, YouTube, search providers, Mojang, Stripe for payments, Resend for email delivery, and the AI providers that run the models you choose (OpenAI, Google, Mistral, Cloudflare and Anthropic).

Service providers process data under instructions needed to deliver their function. We require appropriate safeguards where feasible, but each third party also has its own privacy practices.

Public transcript viewer URLs allow anyone with the link, and password if set, to access transcript content you chose to publish. That access is intentional on your part when you share the link.

19. Your rights and choices

You can delete your account and associated data from Settings or by contacting support. You may clear cache, transcripts, cards, QR codes, and AI memory without deleting your account. You may update or revoke your Discord bot token and API keys from the dashboard at any time.

Depending on where you live, you may have additional rights to access, correct, or request deletion of personal data. We will respond to valid requests where applicable law requires us to do so, subject to exceptions for security, fraud prevention, and legal retention obligations.

20. Children's privacy

Auralink is not directed at children under 13, or the minimum age required in your jurisdiction. We do not knowingly collect personal information from children below that age. If we learn that we have collected such information, we will take steps to delete it and may terminate the associated account. Parents or guardians who believe a child has provided us data should contact us through the support channels listed on the dashboard.

21. International users

Auralink may be accessed from different countries. Your information may be processed and stored in locations where we or our service providers operate. By using the service, you understand that your data may be transferred to jurisdictions that may have different data protection rules than your own, subject to the safeguards described in this policy.

22. Security

We take reasonable measures to protect your data, including password hashing, encryption of sensitive credentials, access controls, and monitoring for suspicious activity. However, no system is perfectly secure.

You are responsible for keeping your API keys, bot token, and account credentials secure. Notify us promptly if you believe your account or keys have been compromised.

23. Changes to this policy

We may update this Privacy Policy from time to time. Material changes may be reflected by updating the date at the top of this page, and we may ask you to review and accept the updated terms before you continue using the dashboard. Continued use of the service after changes constitutes acceptance of the updated policy. If you do not agree, you must stop using the service and may delete your account.

24. Contact

For privacy related questions, contact us through the support channels listed on the dashboard.