Privacy Policy
Last updated: 21 October 2026
Controller and contact
Paul Frederick David Walsh is the controller for personal information processed by Disbored.org. All contact is handled digitally by email at pfdw@proton.me, including privacy questions and rights requests. Disbored is based in and operated from the United Kingdom. This notice covers the directory; Discord and linked communities have their own notices. Hosting provider: IONOS; primary hosting country: United Kingdom.
Discord information
On sign-in we request identify, guilds and guilds.members.read permissions. Discord supplies your user ID, display name and avatar reference. We temporarily obtain your guild list and owner/permission flags to check listing and review eligibility. For ordinary reviews we request your membership record for the selected guild, including its join date. We derive Discord account and guild creation dates from their IDs. We do not request email, private messages, contacts, a full guild member list or your Discord password. We retain the access token in a private server-side session; the app does not store a refresh token.
Information you submit and records we keep
Listing JSON records include guild ID, name, icon reference, invite, approximate total member count, description, tags, classification, recorded owner ID where available, submitter ID/name and timestamps. Review records include review ID, author ID/name, rating, text, date and an owner/admin-at-submission flag. Reports contain reporter ID, guild ID, target, category, review reference where relevant, details and date. Bump records contain guild ID, user ID and time. Ban records contain guild ID, recorded owner ID where available, submitter ID and date. We also process correspondence you send us. Do not include unnecessary personal or sensitive data in public content or reports.
Technical information and cookies
Your IP address and request information reach the application and hosting infrastructure. The application uses an in-memory rate limiter keyed by request IP to reduce abuse. We keep application and domain web-server logs for operation, security and fault diagnosis, using daily rotation with a seven-day retention target as explained below. A strictly necessary session cookie, normally connect.sid, identifies your server-side session. It is HttpOnly, SameSite=Lax and Secure in production, with a 24-hour expiry that may be extended by activity. It supports authentication, OAuth security and access control. The directory uses no advertising or analytics cookies and no newsletter or payment collection. Discord/CDN requests and external links involve those providers’ own technical processing.
Purposes and lawful bases
We rely on performance of our service agreement to authenticate you and provide requested listing, editing, bumping, reviewing and reporting functions. We rely on legitimate interests in securing the service, checking eligibility, preventing duplicate or fraudulent activity, maintaining the directory and rankings, moderating content and handling complaints. We balance those interests against users’ rights and the public nature of submissions. We rely on legal obligation where necessary to meet a specific legal duty, such as responding to a valid legal demand. OAuth authorisation is permission for technical access, not blanket GDPR consent. If a future optional feature requires consent, it will be requested separately. We do not seek special-category data; please do not submit it unnecessarily.
Public and private information
Server listing information, icons, invites, review author display names, review text, star ratings, affiliation labels and aggregates are public. Public listing/review API responses also expose stored Discord identifiers and timestamps, including submitter information; do not assume that an identifier is private merely because it is not shown on a card. Reports, ban records and access tokens are not public directory data and are restricted to the site owner/server administration. Reports are not anonymous to us. Public content can be copied or indexed by others.
Recipients and international processing
Our hosting/infrastructure provider processes site data to operate and secure the service. Discord receives API requests and, when a listing is created, a webhook notification containing submitter name/ID, guild name/ID, member count and listing URL in the operator’s designated Discord channel. People with access to that channel can see the message. Browsers request guild icons from Discord’s CDN, revealing technical information such as IP address to that provider. We may disclose information where legally required or necessary to protect rights and safety. We do not sell personal information. Discord and other providers may process information internationally under their own arrangements. The directory’s primary data and its Cyberaid backups are hosted in the United Kingdom. Discord operates under its own privacy notice, including its information about international processing: https://discord.com/privacy. Before introducing a new overseas processor for our own processing, we will assess the transfer and put applicable UK safeguards in place. Hosting providers may also maintain their own administrative or security records under their applicable terms and legal obligations; these are distinct from our directory backups and domain/application logs.
Retention and deletion
Active listing, review, report and bump records are kept while the listing exists and needed to operate or moderate it. Removing a listing deletes those active records from the corresponding JSON folders. Ban records remain while the ban is necessary to prevent repeat abuse; we review necessity when a ban is challenged or circumstances change. You can request correction, erasure or another applicable right by email even though there is no author-facing review edit/delete tool. Expired session files are removed on access or by a cleanup check every 15 minutes while the API is running; logout destroys the current session. In-memory rate-limit counters expire on the rate-limit window or process restart. We create a disaster-recovery copy of the five directory JSON collections approximately once every 24 hours. These backups are stored privately on the Cyberaid server in the United Kingdom and exclude session files and OAuth credentials. Backups expire seven days after creation and the maintenance process checks for expiry approximately every five minutes. Application and domain web-server logs rotate daily, keeping the active period and up to six daily archives, giving up to approximately seven days of history in normal operation. Archive expiry is also checked periodically. This is a rotation schedule, not an exact 168-hour deletion guarantee for every log entry. Server/process outages or failed maintenance can delay creation or deletion; operation must be monitored and failures addressed. Removing active data does not immediately rewrite older backups. Those copies are restricted to recovery and expire under this schedule; any restoration must respect subsequent erasure requests, removals and bans before the restored data is returned to normal use. Webhook notifications remain in Discord until separately removed, so a relevant deletion request must also consider those messages. Correspondence is kept only as long as needed to answer the enquiry, resolve a report, appeal or privacy request, and establish or defend any necessary legal claim. Its continuing necessity is reviewed when the matter is closed. Any exceptional retention required by a specific legal duty or claim is limited to the records and period necessary. The seven-day maintenance schedule concerns Disbored directory backups and its application/domain logs; it does not control third-party copies, search engine caches, provider administrative records or unrelated server services.
Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. These rights have legal exceptions; we will explain any refusal. Contact pfdw@proton.me with enough information to identify the relevant Discord account and records. We may proportionately verify identity and ordinarily respond within one month, with a lawful extension for complex requests where applicable. You can complain to the UK Information Commissioner at https://ico.org.uk/make-a-complaint/ or to your relevant local regulator. Please contact us first if possible so we can help.
Children, ranking and security
Disbored is not intended for anyone below Discord’s applicable minimum age. We do not collect a date of birth or verify chronological age; a 30-day-old Discord account does not establish that a person is an adult. Do not access age-restricted communities unless eligible. Tell us if a child’s data or unsafe content needs attention. Rankings are automatic calculations from ratings and recorded member counts; they determine directory visibility, not decisions with legal or similarly significant effects about individuals. The Pogforts eligibility exception and affiliation labels are described in the Terms. We use HTTPS, private server-side JSON storage, access controls, restricted backup file permissions and secure session cookies. No security measure is infallible. Backups are held on the same Cyberaid server and are intended for data recovery; they do not provide independent protection against loss of that entire server.
Changes
We update this notice when data handling changes and show the latest revision date. Material changes will also be highlighted on the site where appropriate. Additional uses of data will require an appropriate lawful basis and clear information before they begin.
Partner referrals
The optional referral cookie remembers the first valid referral for up to 30 days from the original visit. We ask before setting this cookie. You can decline and still use Disbored. If you are already signed in, we record eligible referral attribution against your account directly. Referral links contain the referring user’s public Discord ID. Private programme records include attribution dates, first-listing eligibility, credited server IDs, rewards, reversals and badge selections. We retain the minimum history needed to prevent duplicate rewards after a listing is removed. We do not sell your personal data. To clear a pending referral cookie, use the control below. Clearing the cookie does not change an attribution already saved to your account.
Partner rewards data
We record each partner’s current Discord username, first achievement dates, permanent achievement numbers, selected server, reward settings and automatic-bump schedule. Usernames refresh when the account next signs in. Current partners’ usernames and achievement numbers appear in public homepage shout-outs; the shout-out response does not expose account IDs. Uploaded Gold backgrounds are publicly accessible while active. Replacing or removing a background, removing its eligible partner assignment, deleting the listing or losing Gold eligibility removes the active uploaded file. Removed files may remain in restricted backups until those backups expire under the existing retention schedule. Necessary achievement and anti-duplication records survive changes in tier.
Automatic bumps and embedded video
Discord OAuth access and refresh credentials are encrypted at rest in private backend storage using the application secret, so automatic bumps can verify permissions while the lister is offline. They are excluded from directory backups. Existing sessions created before this update may require a new Discord sign-in to enable offline bumps. Revoked access pauses automatic bumps until the account signs in again. YouTube players use the youtube-nocookie.com embed domain and load directly on server pages without autoplay; loading or interacting with a player connects to YouTube and is subject to Google’s data handling. Directory backups now cover partner achievements, schedules and active uploaded server backgrounds as well as the existing collections.