Privacy Policy

This Policy applies to all websites, apps, Bots and other parts of the Service and to requests sent to Support, whatever sign-in method or device you use.

This Policy does not apply to Third-Party Services (Discord, Google, GitHub, Telegram, payment services, Roleplay Projects and others), even if you reach them from the Service. Their processing of data is governed by their own policies.

We process only the data the Service needs, we do not sell personal data, we do not share it for advertising, and we do not use advertising networks or third-party analytics.

Reevun processes the data of Reevun ID Accounts, Support requests, payments and technical data.

Reevun processes Family Data — information about Discord Server Members handled by the Bot — on behalf of the Family Owner, who decides which modules are on and how they are set up. The terms are set out in the Data Processing Agreement.

For any question about personal data, contact [email protected].

Account data:

• —name (display name), username and avatar (uploaded by you or taken from a connected service);
• —email address, and previous addresses if you changed it (to protect against account takeover and to review recovery requests);
• —IDs and names of connected Discord, Google, GitHub and Telegram accounts;
• —interface language, Account creation date and other settings.

Security and sign-in data:

• —a password hash (if you set a password) — we never store the password itself;
• —the authenticator app secret (encrypted), public keys and metadata of passkeys, and hashes of backup codes;
• —sign-in sessions: client type (website or app), browser and operating system, approximate location from the IP address (country), time of sign-in and of last use;
• —security events: sign-ins, failed sign-in attempts, security setting changes, IP address, country, a random device identifier, browser details and the result of the automated risk assessment;
• —one-time sign-in and confirmation codes (only as hashes, while they are valid).

Identity verification and account recovery data:

• —if your Account is restricted by an automated security check or you submit an account recovery request, verification is carried out by Didit. Didit processes a photo of your identity document and an image of your face (including a liveness check) under its own policy;
• —from Didit we receive the verification ID, its status and result and, for a recovery request, also the name shown on the document, to compare it with the Account. We do not store document or face images;
• —a recovery request: email address, full name, what you know about the Account's registration (date, place, IP address), the devices and sign-in methods you use, your description of the situation, and the IP address, country and browser details of the device the request is sent from.

Discord data:

• —your Discord ID, username, display name and avatar;
• —OAuth access and refresh tokens (encrypted) — to get the list of servers you manage and check your rights on them;
• —the list of Discord Servers where you can manage the Bot and your rights on them.

Family Data (processed on behalf of the Family Owner):

• —IDs, names, nicknames, avatars and roles of the Discord Server's Members;
• —ranks, the history of promotions and demotions, warnings and punishments, with their reasons and who issued them;
• —applications to join and answers to application questions, including attached files, statuses and decisions;
• —Members' requests (tickets) and the conversations in them, AFK entries and their reasons, blacklist entries, and the log of actions by the Bot and Family Administrators;
• —Bot and module settings, message templates, and the server's channels and roles.

Support data:

• —requests, their categories and statuses, messages, attached files and quality ratings;
• —live chat messages, including Reevun AI's answers;
• —information needed to answer: name, email address, Account ID, and Discord Servers and plans when they relate to the question;
• —diagnostic codes you choose to create: a log of technical errors on your device, the app version and browser details.

Payment data:

• —the Discord Server, plan, period, amount, any Promo Code or Activation Code used, the payment service chosen, the payment ID and status, the time of payment, and the Account that made the payment;
• —we do not receive or store bank card, e-wallet or other payment instrument details — the payment service processes them.

Technical data:

• —IP address, date and time of a request, the requested address, the response code, and browser and device details — in server logs;
• —cookies and browser storage entries described in the Cookie Policy;
• —data exports you requested (for as long as they are kept).

We do not deliberately collect special categories of data (health, religion, political views and so on). Please do not post such data in the Service. Biometric data used in identity verification is processed by Didit; we do not receive it.

We get data directly from you — when you register, set up your Account, use the Dashboard, contact Support or pay.

From Third-Party Services you connect or sign in with: Discord, Google, GitHub and Telegram — to the extent you allow on their consent screens.

From Discord — about the Discord Servers where the Bot runs and their Members, to the extent Discord's permissions give the Bot access and the Family Owner has configured.

From Family Owners and Family Administrators — information about Members they enter in the Dashboard (ranks, warnings, blacklist and so on).

From Didit — the result of identity verification; from payment services — the status of a payment.

Automatically — technical data when you use the Service.

Providing the Service and performing the contract (the Terms of Service and the Public Offer): creating and maintaining the Account, signing in to websites and apps, running the Bot and the Dashboard, providing Support and Paid Plans, and sending service messages.

Security and abuse prevention: protecting Accounts from hacking and takeover, automatic risk assessment, rate limiting, protection against automated access, investigating incidents, handling access recovery requests.

Records and mandatory requests: payment records, answering requests from public authorities that are binding on us, handling your data requests.

Improving the Service: analysing technical errors, Support requests and aggregate load figures to fix errors and develop features. We do not use third-party analytics for this.

Consent: optional (functional) cookies and widgets, identity checks by Didit. You can withdraw consent at any time; this does not affect processing before withdrawal.

Family Data is processed on the Family Owner's instruction; the Family Owner is responsible for letting Members know about this processing.

To protect Accounts, the Service automatically assesses the risk of sign-ins and security setting changes using signals such as a new device or country, the number of failed attempts, how often settings change, a device or IP address matching other Accounts within a short time, and other signs of abuse.

Based on that assessment, the Service may automatically ask for additional confirmation, temporarily restrict the Account, end its sessions or require identity verification.

You have the right to have such a decision reviewed by a person, to express your point of view and to contest the decision by contacting Support or [email protected].

Support live chat messages, the information needed to answer (name, language, and plan and Discord Servers when they relate to the question) and excerpts from the documentation are sent to Anthropic, PBC (USA), which generates Reevun AI's answers.

Anthropic processes this data only to generate the answer on our behalf and under its commercial terms, which do not allow the data to be used to train models.

Please do not share passwords, sign-in codes, backup codes, payment details or information about third parties that is not needed to solve the issue in the live chat.

We share personal data only with providers without whom the Service cannot work, to the extent they need to provide their services, under contracts that require them to keep the data confidential and secure:

• —Selectel JSC (Russia) — application hosting, databases, file storage and sending email (sign-in codes and service notifications);
• —Cloudflare, Inc. (USA) — domain names, traffic delivery and protection, and checks against automated access (Turnstile);
• —Discord Inc. (USA) — sign-in with Discord and the Bot's operation;
• —Google LLC, GitHub, Inc. and Telegram — sign-in with these services if you connected them;
• —Didit (didit.me) — identity verification when an Account is restricted and during account recovery;
• —Anthropic, PBC (USA) — Reevun AI answers in the Support live chat;
• —the payment services 2328 and Lolzteam Market — accepting payment for Paid Plans; they receive the amount, description and payment ID;
• —GitHub, Inc. (USA) — distributing installation files of the Reevun apps.

We disclose data to public authorities only on a request binding on us and to the extent required, and where needed to protect the rights, safety and property of Reevun, Users or third parties.

In a reorganization, sale or transfer of the Service, data may be transferred to a successor that must comply with this Policy; we will notify Users in advance.

Family Owners and Family Administrators see their Discord Server's Family Data in the Dashboard. Other Users get no access to your data apart from what you publish on a Discord Server yourself.

The Service's main databases and files are stored on Selectel JSC servers in Russia.

Some of the providers listed above are in other countries, including the USA. They receive only the data needed for the relevant functions.

We apply organizational and technical safeguards appropriate to the risks of processing:

• —TLS (HTTPS) encryption of connections on all websites, apps and the API;
• —encryption of tokens, two-step sign-in secrets and other secrets in databases (AES-256-GCM);
• —storing passwords, sessions, one-time and backup codes only as strong hashes;
• —two-step sign-in and passkeys for Users, and mandatory two-step sign-in for staff with access to administrative features;
• —separate databases for different parts of the Service and least-privilege access;
• —an administrator activity log and automated detection of suspicious sign-ins;
• —rate limiting and protection against automated access and attacks;
• —regular dependency updates, code security reviews and backups.

No method of transmitting or storing data is completely secure. If a personal data breach puts your rights at risk, we will notify you without undue delay.

We keep data no longer than the purposes require:

• —the Account and its data — while the Account exists; after a deletion request, the Account is deleted after 7 days (you can cancel within that time), and the data is then removed from backups within 30 days;
• —sign-in sessions — until you sign out or for up to 60 days without use;
• —one-time sign-in codes — while valid (up to 10 minutes), deleted within an hour at the latest;
• —security events — 180 days;
• —unfinished account recovery requests — 7 days; reviewed requests — up to 1 year, to protect against repeated takeover attempts;
• —Support requests, messages and files — while the Account exists; they are deleted together with the Account;
• —diagnostic codes — 14 days;
• —records of requested data exports — 90 days;
• —Family Data — while the Bot is installed on the Discord Server and the Family Owner has not deleted it; after the Bot is removed — deleted within 30 days at the Family Owner's request;
• —payment records — up to 5 years;
• —server logs — up to 30 days.

When these periods end, data is deleted or anonymized so that it can no longer be linked to a person.

You have the right to:

• —learn how your data is processed and get a copy of it, including in a machine-readable format (you can request a data export in the Reevun ID settings);
• —correct inaccurate data (most data can be changed in the Reevun ID settings);
• —delete your data and Account (in the Reevun ID settings or on request);
• —restrict processing or object to it;
• —withdraw consent (for example, to optional cookies — with the "Cookie settings" button in the site footer);
• —disconnect sign-in with Discord, Google, GitHub or Telegram;
• —not be subject to a decision based solely on automated processing, and have it reviewed by a person;

Send requests to [email protected] from the email address on your Account, or through Support. We may ask you to confirm your identity so as not to disclose data to someone else. We answer within 30 days; for complex requests the period may be extended by another 30 days with notice.

A Discord Server Member should address requests about Family Data first to the Family Owner; if a Member contacts us, we will forward the request to the Family Owner and help fulfil it.

Exercising your rights is free. We may refuse manifestly unfounded or excessive requests.

The Service is not intended for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has given us their data, tell us at [email protected] and we will delete it.

Users under the age of majority in their country use the Service with the consent of their legal guardians, who may contact us with requests about the minor's data.

We may change the Policy, including when the Service or providers change. The current version is always on this page with its effective date.

We announce material changes in advance on the Website, in the Service's interface or by email. If a change requires your consent, we will ask for it separately.

Personal data questions and exercising your rights: [email protected].

Security questions and incident reports: [email protected].