Privacy Policy

1. Data We Collect

Depending on how you interact with us, we may collect:

• Discord account data: your Discord user ID, username / tag, avatar, server membership, and roles. Discord provides this to our bot when you join or interact with the server.
• Onboarding answers: if you tell us how you found us (Google, YouTube, Discord, Twitch, or other) during onboarding, we log that selection to help us understand where our members come from.
• Support & ticket content: the messages, attachments, and forwarded clips you send in support or purchase tickets (including messages you send to our automated assistant) so we can help you and keep a record of the order. When a ticket is closed a transcript of the conversation is saved.
• Purchase & invoice data: the buyer, seller, product, price, chosen payment method (e.g. PayPal, Cash App, gift card), and order date. We do not collect or store your full card, bank, or payment-account details. Those are handled directly between you and your payment provider.
• Verification data: if you verify through Discord on our website, we use Discord's OAuth to receive your user ID, username, and avatar, and to record that you are verified.
• Role-verification proof: if you ask for a role that has to be granted by staff (such as the Female role, see our Terms), whatever you send to confirm it is handled as ticket content. We ask only for what is needed to confirm the role, we do not publish it, and you can decline and go without the role.
• Reviews: if you submit a review, we store and publicly display your Discord identity, star rating, and review text.
• Invite / referral data: to run invite rewards, we record which member invited which other member, and invite-use counts.
• Voice presence: our bot can see which voice channel you are in so it can join it. While the assistant is in a channel with you it also notes the time it last heard you speak, so an unused seat can be freed for somebody waiting. That is a timestamp held in memory, not a recording; it is forgotten when you leave the channel and never written to disk. If you are disconnected for being idle, the bot tells you why in a direct message.
• Voice assistant audio: in voice channels where our assistant is present, it listens while you speak so it can reply. Your speech is transcribed to text by our AI provider, and the reply is turned back into speech by our text-to-speech provider. Audio is held in memory only for the moment it takes to do this and is never saved to disk or stored by us. We do not keep recordings, and we do not keep the transcripts of what is said in voice. The assistant announces itself when it joins, and you can avoid it entirely by not speaking in that channel or by using a different one.
• Safety-scanning data: to protect members, our bot automatically screens posted images for phishing and fake-giveaway scams. It reads any text inside an image using on-device text recognition, so it can catch things like fake crypto, casino, or celebrity giveaway posts and "claim your prize" images. These are most often posted by members whose accounts have been hacked, so the post is removed rather than the person being blamed. We also screen message text and links for the same scams, and file attachments for malicious file types. Anything flagged is deleted and logged to a staff-only channel so we can help the account owner recover.
• Website analytics: our site records anonymous, aggregate visit counts using a random identifier stored in your browser. This contains no name, no account data, and no IP address, and is not used to track you across other sites. We also use our hosting provider's cookieless web analytics: it records the page visited, the referring site, and coarse details such as country, browser, and device type. It derives a temporary anonymous identifier that is discarded daily, so it cannot follow you between sessions or across other sites.

2. How We Use Your Data & Legal Bases

We use your data for the following purposes. Where the GDPR applies, our legal basis is shown in brackets:

• To process orders, deliver products, issue invoices, and grant purchased access (performance of a contract)
• To provide support and respond to tickets, including via our automated assistant (contract / legitimate interests)
• To run community features such as welcomes, roles, reviews, invite rewards, music, and our voice assistant (legitimate interests)
• To detect and prevent scams, malware, fraud, chargebacks, and abuse, and to moderate the community (legitimate interests)
• To understand where members come from and improve our services (legitimate interests)
• To send you service-related messages, such as order confirmations and transcript links, via Discord (contract / legitimate interests)

Where we rely on legitimate interests, we balance those interests against your rights and only process what we reasonably need.

When the bot sends you a direct message

Our bot direct-messages you only in response to something you did: an order confirmation or invoice for a purchase you made, a transcript when your ticket closes, records or a listing you asked it for, or an explanation when it disconnects you from the assistant's voice channel for being idle. It does not send marketing, and it does not message you because somebody else named you. If your direct messages are closed it says so where you asked rather than storing the message to send later.

3. Automated Assistant & AI Processing

To help buyers quickly, the messages you send in a purchase ticket may be sent to a third-party AI provider, which runs the large-language model behind our ticket assistant so that it can answer you. This is used only to write a reply in the moment.

Separately, and never inside tickets, the same provider helps us check posts in public channels for the phishing and fake-giveaway scams described in section 1: fake crypto, casino and celebrity giveaway images, and "claim your prize" links. This exists to protect members from posts made by hacked accounts. It is not a check on buyers or sellers, and it does not look at your purchase conversations: ticket channels are excluded from this screening entirely.

Neither the assistant nor the screening is used to build advertising profiles.

Where our voice assistant is in a voice channel, what you say there is sent to that same AI provider to be transcribed and answered, and the answer is sent to a third-party speech provider to be turned into spoken audio. This happens live, only while you are speaking to it, and only so it can reply to you. We do not save the audio or the transcript, and neither is used for advertising.

4. How Verification Works

Verifying proves you are a real person rather than one of the bot accounts that raid Discord servers. It is one click, and Discord shows you a consent screen listing exactly what is being asked for. There are two permissions on it and no more:

• identify — your username, user ID and avatar. The same things anyone in the server can already see.
• guilds.join — permission to add you to a server.

Those permissions do not let us read your messages, send messages or post as you, see your email, password or payment details, see which other servers you are in, or change anything on your account. Discord does not allow an app to request more than what appears on that consent screen, so if you are ever shown a verify link asking for more, from us or from anyone else, do not click it.

Alongside your account details we keep a re-invite authorisation: a token Discord gives us that allows us to invite you back to a server. It exists for one reason. If this server is ever deleted, hacked or taken from us, it is the only mechanism Discord offers that lets us rebuild somewhere new instead of losing all members overnight. It is encrypted before it is stored, with a key kept on a separate system, so a copy of our database on its own does not unlock it.

You can withdraw it yourself at any time without asking us: in Discord, open User Settings → Authorised Apps, find D10 Leaks and choose Deauthorise. That revokes it immediately on Discord's side. You can also ask us to delete what we hold, and we will.

5. Who We Share Data With

We do not sell, rent, or trade your personal data. We share data only with the categories of service provider we need to operate D10 Leaks:

• Discord: the platform our community and bot run on, and our verification login (Privacy Policy)
• Website hosting and analytics provider: hosts our website and its API endpoints, and provides the cookieless analytics described in section 1
• Database provider: stores our invoices, ticket transcripts, verification records, and analytics counts
• AI provider: powers our ticket assistant and scam detection, and transcribes speech for our voice assistant
• Speech provider: converts our voice assistant's replies into spoken audio
• Content delivery networks: public hosting for the website's fonts and background music files; when a page loads, your browser's IP address is shared with them in order to fetch those files
• Payment providers (PayPal, Cash App, and gift-card issuers): you transact with these directly; we never receive your full payment credentials

We name the specific companies behind each category on request. If you would like the current list, or the privacy policy of any provider we use, contact us via Discord (see the Contact section) and we will provide it.

We may also disclose data where required by law or to protect our rights, our members, or the public.

6. International Transfers

Several of the providers above are based in the United States and other countries outside the EU/EEA and UK. This means your data may be processed outside your home country. Where required, we rely on those providers' safeguards (such as Standard Contractual Clauses) for these transfers. By using our services you understand that your data may be handled in these locations.

7. How Long We Keep Data

• Invoices / receipts: kept for up to about 3 years as proof of purchase and for fraud prevention.
• Discord re-invite authorisation: kept until you revoke it or ask us to delete it. What it is, what it cannot do, and how to withdraw it are set out in section 4.
• Ticket transcripts stored on our website: kept for about 12 months, then deleted. We keep them this long so that we can look back at what was agreed in a ticket if a payment is disputed or a problem with an order is raised later, which can happen several months after a purchase.
• Verification records: kept while you remain verified, and removed on request.
• Reviews, invite records, and order history: kept while you are part of the community and for a reasonable period afterwards for record-keeping, unless you ask us to delete them.
• Website analytics: aggregate counts only, retained for up to about 90 days; live-visitor data clears within minutes. Our hosting provider's analytics keeps its own aggregate statistics for a limited window set by our plan, currently about 30 days.
• Discord membership data: held for as long as you remain in our server.
• Voice assistant audio and transcripts: not retained. Audio exists in memory only for the seconds it takes to answer you, and is discarded immediately afterwards.

When data is no longer needed, we delete it or remove information that identifies you. You can ask us to delete your data sooner (see your rights below).

8. Your Rights

Depending on where you live, and in particular if you are in the EU/EEA or UK, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data ("right to be forgotten")
• Object to, or ask us to restrict, certain processing
• Request a copy of your data in a portable format
• Withdraw consent where we rely on it, without affecting past processing

To exercise any of these rights, contact us via Discord and we will respond within a reasonable time, normally within one month. If you are in the EU/EEA or UK and believe we have mishandled your data, you also have the right to complain to your local data-protection supervisory authority.

Getting your own records from the bot

You do not have to wait for a human for the common case. If you ask our bot for your receipts or your past tickets — in a purchase ticket, or out loud to the voice assistant — it will look them up and offer to send them to you.

• It only ever looks up the account that asked. The lookup is matched on your Discord user ID, which Discord authenticates. It never searches by a name typed or spoken in the request, so naming somebody else does not return their records.
• It only ever replies in your direct messages. Never in the channel, never out loud. In a voice channel the assistant says how many records it found and nothing about what they are.
• It asks before sending. In a ticket you are told the number found and given a button; nothing is sent to your DMs until you press it, and the button only works for the person it was offered to.

This is a convenience, not a replacement for your rights above. It returns recent orders and a list of your past tickets; for anything older, a full export, correction or deletion, contact us as described above.

9. Children

Our services are not directed at children under the minimum age required to use Discord (13, or higher where local law requires). We do not knowingly collect data from anyone below that age. If you believe a child has provided us with personal data, contact us and we will remove it.

10. Cookies & Local Storage

Our website does not use advertising or cross-site tracking cookies. The only identifier we set is a random, anonymous ID stored in your browser's local storage to count unique visits. It holds no personal information and is not shared with advertisers.

11. Security

We take reasonable technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or loss, including access-controlled links for invoices and transcripts. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this policy from time to time. The date at the top of this page reflects the latest revision. We encourage you to review this page periodically.

13. Marketplace Listings & Trending

This section covers what our bot stores when a seller lists a product, and what it counts when a buyer presses Purchase.

If you list a product. We store your Discord user ID together with the listing itself: the product name, price, any sale price, any description, the preview file you sent, and a link to the message. Listings in our public marketplace channels are published to this website, where your Discord display name is shown as the seller. Everything here is information you chose to publish in order to sell something; we do not add anything to it.

When you send a preview through the bot, your message is deleted from the channel as soon as the file has been read. The file itself is kept, because it is the product image.

If you press Purchase. We add one to a counter on that listing. The counter is what orders the "Trending" section of our shop. We do not record who pressed it — there is no per-person history behind this number, only a total per product, so it cannot be used to work out what any individual looked at or considered buying.

Opening the purchase ticket that follows is separate, and that ticket is covered by the ticket sections of this policy.

How long. Listing data lives as long as the listing does. Removing a listing deletes it from our database and from this website. Trending counts belong to the listing and go with it.

Contact

Privacy questions or data requests? Reach us on Discord (discord.gg/d10leaks).