What we know about you, and why.

1. What we collect

Your Discord username, avatar, ID and email address, plus what it takes to run your bots.

When you sign in with Discord we receive your Discord user ID, username, display name, avatar and the email address on your Discord account, and store them against your BossHosting account. We use that address only for account and billing notices, such as a payment receipt or a warning that your bot is about to be stopped. We never use it for marketing and never sell or share it.

Beyond that, we store what is needed to run your bots: the files you upload, the environment variables you set, and your bot's console output while it runs. If your variables hold a Discord bot token, we use it to ask Discord for that bot's name, picture and server count every few hours, so the dashboard can show them, and for nothing else.

If you connect GitHub, we keep your GitHub username and ID, which repositories and branches your bots deploy from, and a log of each deploy (the commit, its message and author). We download the code only from repositories you gave our GitHub app access to, and only to deploy it. We don't keep your GitHub sign-in token: it's used once when you connect.

identity

Discord user ID, username, display name, avatar, and the email address on your Discord account.

your bots

Files, environment variables, and console output.

technical

Your IP address and browser details, in our server logs, to keep the service running and stop abuse.

sign-in

Discord gives us a one-time access token to add you to our Discord server. We use it once and never store it.

2. How we use it

To run your bots, bill you, and stop abuse. Not to profile you or sell anything.

Your data is used to run the service you asked for: starting your bots, enforcing your plan's limits, sending you account notices, and investigating abuse. We do not build advertising profiles ourselves and we do not sell data to anyone, ever. Google, which shows the ads on our pages, uses cookies as described below.

3. Environment variables and secrets

Encrypted at rest with a key unique to your account, and only shown when you ask.

Environment variables, including your Discord token, are encrypted at rest with a key unique to your account. They are decrypted only to start your bot, or when you choose to reveal one in the dashboard.

Your bot can read its own variables, so anything your bot prints, including a token, will appear in its console. Staff do not look at your variables, and there is no support tool that shows them.

4. Who else sees your data

Four companies: our hosting provider, Discord, Google for ads, and Resend for email.

Our website loads your avatar straight from Discord, so Discord sees that request. Our pages also load Google AdSense, which is described under Ads. We do not use a CDN or an analytics service.

hosting

OVHcloud, which runs our servers in Virginia, United States. Your files and account data are stored there.

discord

Sign-in, your avatar, and our support server.

google

Google AdSense, which shows ads on our pages and sets its own cookies.

resend

Sends our account and billing emails. It receives your email address and the message we send you.

5. Ads and payments

Google AdSense shows ads and uses cookies; you can turn off personalized ads. Payments aren't live yet.

Our pages use Google AdSense. Google and other third-party vendors use cookies to serve ads based on your previous visits to this website and other websites. Google's advertising cookies let it and its partners show you ads based on your visits to our site and other sites on the internet.

You can turn off personalized ads in Google's Ad Settings at adssettings.google.com, and opt out of some third-party vendors' use of cookies for personalized advertising at www.aboutads.info. Google explains how it uses data from sites that use its services at policies.google.com/technologies/partner-sites.

If you are in the EEA, the UK or Switzerland, you are asked for your consent before Google uses cookies for ads. You can change your choice at any time with Cookie settings at the bottom of every page.

Earning credits by watching ads is not live yet. When it is, a video ad for credits will play only when you choose to watch one.

Paid plans are not live yet. Before they launch, we will update this policy to name the payment provider and say what it receives. We will never see or store your card number.

6. Retention and deletion

Delete a bot and its files, variables, backups and console output go straight away. Logs go after 14 or 30 days.

Deleting a bot deletes its files, environment variables and backups immediately. Your bot's console output from its last 5 runs is kept for up to 30 days, so you can see why a run stopped after starting it again, and is deleted with the bot.

Each bot's files are backed up once a day, and you can keep as many backups as your plan has slots (1, 3 or 5). A newer backup replaces the oldest automatic one, and you can delete any backup yourself. Backups hold your bot's files only, never the environment variables you set in the dashboard.

For each place you're signed in, we keep the browser and the IP address it was last used from, so you can see your sessions in Settings and sign out the ones you don't recognise. A session's record is deleted when you sign it out, or after 30 days unused. We also keep a history of your sign-ins (when, the IP address and the browser) for 90 days, so you can check it in Settings and so we can email you when someone signs in from a device your account hasn't used before. We also keep a log of what's done on your account for 90 days (for example signing in, starting a bot, saving or downloading a file, setting a variable, or a plan change), with the IP address it came from, to investigate problems and abuse. It records names and file paths, never your variables' values or files' contents. Some emails we send you contain a small invisible image; when your email app loads it, we learn that the email was opened, when, and the IP address and software that loaded it (often your email provider's rather than yours). We keep that for 90 days and use it only to know our emails reach real people. Turning off images in your email app stops it. If you report a bug, we keep what you wrote, any screenshots you attach, the page you were on and your browser's name, until 180 days after the report is fixed or closed. Web server logs, which include IP addresses, are deleted after 14 days. Application logs, which record actions such as starting a bot, are deleted after 30 days. Your account details are kept while your account exists.

7. Your rights

Ask for a copy of your data, a correction, or full deletion in #tickets.

To get a copy of your data, correct it, or have your account and everything in it deleted, open a private ticket from #tickets on our Discord server. We will act on it within 30 days. If you are in the EU or UK, data-protection law gives you these same rights directly.

You can delete your bots yourself, at any time, from the dashboard.

8. Cookies

Our own: a sign-in cookie and a device cookie. Google's: advertising cookies. No analytics.

We set two first-party cookies. One keeps you signed in and lasts up to 30 days. The other is a random ID that lets us recognise a browser you've signed in from before, so a sign-in from a new device can be flagged; it lasts up to 400 days and holds nothing else.

Google AdSense sets its own advertising cookies, as described under Ads, and you can control them there. We do not use analytics cookies.

9. Changes to this policy

Material changes get a Discord announcement 30 days ahead.

When we change something that materially affects you, we announce it in our Discord server and update the revision history below at least 30 days before it takes effect. Continuing to use the service after that date means you accept the change.