Privacy Policy

Rallyra (operated by Impulso Aleatorio) is a Discord community engagement platform. We store the minimum needed to run per-server configuration, events, and engagement tracking. We do not store the content of your members' messages, and we do not sell personal data. This is a draft; it will be finalized before commercial launch.

When you sign in with Discord we request only the identify and guilds scopes. We use this to know who you are and which servers you can manage. Discord access and refresh tokens are encrypted at rest and are never shown to the browser.

• Your Discord user id, username, and display name (an identity cache).
• Encrypted Discord OAuth tokens (never in plain text, never sent to the browser).
• Dashboard sessions, identified by a hashed session id, with the IP address and browser user agent for security.
• Server ids and the per-server settings, roles, channels, and modules you configure.
• Engagement events: who took part in a Rallyra activity, in which server, what kind of participation, and when. We do not store message content.
• Feedback you submit (title, description, and optional link), plus your browser and the page you came from.
• If a server turns on giveaway anti-fraud checks: one-way hashed indicators of the browser and network used for an entry you make through the entry portal, and whether that browser appeared automated. Never your IP address, and never a readable device profile. See the section below.

Alt-account farming ruins giveaways, so a server can choose to run its giveaway entries through a Rallyra entry page that checks whether one person is entering more than once. This is off by default and only some servers use it. It applies only if you choose to open the personal entry link Rallyra sends you, and only after you press the button agreeing to the check. If you close the page instead, you are not entered and nothing is collected.

When you do agree, we take a one-way fingerprint of coarse browser characteristics (such as screen size, timezone, language, and processor or memory class), a coarse indicator of your network, and whether the browser appears to be automated. We do not use cookies or any other storage on your device for this, so nothing is left behind and it cannot be used to follow you to other sites. We cannot read your identity, location, browsing history, or the content of any page from it.

These values are hashed in your browser and hashed again with a secret key on our servers. We do not store your IP address or a readable device profile: your address is reduced to a broad network range before it is hashed, so the exact address never reaches our database. What we keep can only be compared for equality against other entries in the same giveaway.

Staff running that giveaway see the reason for a flag (for example, that an entry came from the same device as another entry), never the underlying values. Flags are internal to that server's staff and are never shown to other members, and we never publicly label anyone. A flagged entry can always be reinstated by a person: no one is permanently excluded from a prize by an automated decision alone. To question a flag, contact the server's staff or email privacy@rallyra.gg.

Our basis for this check is your consent, which you give by pressing the button to agree, together with the legitimate interest that we and the server hosting the giveaway have in preventing fraud so the prize goes to a real participant.

These indicators are kept only while they are needed to check that giveaway, and are deleted within about 30 days of the giveaway finishing, and within 90 days in every case. Deleting them does not change any decision already made about your entry.

We do not store the content of Discord messages, direct messages, or voice. In-app points and balances are a virtual feature and carry no personal financial data.

Rallyra charges nothing during early access. If and when paid plans launch, payments are handled by Paddle, acting as Merchant of Record. That means Paddle is the seller of record for the transaction and handles billing and any applicable taxes. Card details go directly to Paddle; Rallyra never sees or stores your card number. We would store only a payment-provider customer and subscription id to know your plan status.

OAuth tokens are encrypted at rest. Access to production data is limited. Report a security concern to security@rallyra.gg.

We keep data while your server uses Rallyra. To request access to, or deletion of, your data, email privacy@rallyra.gg. Removing Rallyra from a server stops new data collection for that server.

Privacy questions: privacy@rallyra.gg.