Privacy Policy

From Discord (when you use bot commands or sign in to the dashboard):

• Your Discord user ID (snowflake)
• Your Discord username/display name and avatar, provided during dashboard login
• The list of Discord servers you belong to, read during dashboard sign-in (Discord's guilds OAuth scope) to find servers you share with the bot. This list is read on demand and is not stored in our database.
• The Discord server, channel, and role IDs your guild configures

From Tacticus:

• Your in-game User ID, supplied via /register or the dashboard Player Profile page
• Your guild's Tacticus API key, supplied by a Leader/Co-Leader via /register_guild or the dashboard setup page
• Your personal Tacticus API key if you register one for token alerts
• Your guild ID/name and guild roster data fetched from the Tacticus API, including member names and IDs, used to verify membership and officer permissions and to display player names in features like leaderboards and replays
• Your in-game guild role (Leader, Co-Leader, Officer, Member), used to authorise commands and dashboard access
• Guild Raid attack records fetched from the Tacticus API — which player attacked which boss, the damage dealt, and the team used — read to detect kills and, where configured, to build raid leaderboards

Operational data:

• Notification settings (which roles are pinged for which bosses, kill thresholds, custom message URLs)
• Content of Discord messages that officers link as custom notification messages, read for dashboard previews and outgoing notifications
• Current rotation state per guild (current boss, primes alive, season number)
• Leaderboard settings (channels, participating guilds, display options, and any players officers exclude — excluded players are stored by in-game ID and name)
• A dashboard session cookie used to keep you signed in

Black Library / replay data:

• Replay videos and optional descriptions submitted with the Submit to Library command
• Library setup data, including forum, thread, channel, tag, composition, and access role IDs
• Library thread IDs and season plan index message IDs used to keep library organisation in sync

Guild Raid replay collection (optional, enabled per guild by a guild leader — see the section below):

• Replays that guild members share into in-game guild chat: the replay ID, the sharing player's in-game user ID and display name, the boss fought, and when it was shared
• The full battle data of each shared replay — team composition (units, ranks, star levels), Machine of War, battle result, rounds played, and damage dealt
• The Tacticus account credentials (user ID and client secret) from the settings file a guild leader uploads to enable collection, stored encrypted — see "Replay collection credentials" below

We do not request email addresses from Discord, use analytics, intentionally store IP addresses in Ahriman's database, or collect telemetry about how you browse the dashboard. Hosting and security providers may process transient logs as part of operating the service.

If you register a personal Tacticus API key for token alerts, Ahriman stores it encrypted at rest and uses it solely to poll your token regeneration status. The key is never shared, logged in plaintext, or used for any purpose beyond sending you the DM notifications you configured. You can remove your key at any time via /token_alert or the dashboard, which immediately deletes the encrypted key and all alert configuration.

Guild Raid replay collection works by connecting to the game's realtime service as a member of your guild. To enable it, a guild leader uploads their Tacticus settings file via /replay_settings. The file is read once and discarded; only the account user ID and client secret are kept, with the client secret encrypted at rest.

These credentials give account-level access to the game, so we treat them like the personal API keys above: they are used solely to maintain the guild-chat connection that detects shared replays and to fetch those replays, and are never shared or logged in plaintext. The leader who registered them can remove them at any time by deleting their data from the Player Profile page, and they are also removed when a guild's data is deleted. You can contact us to have them removed directly.

Some of the data above describes guild members who may never have used the bot or the dashboard: guild rosters, Guild Raid attack records, and replays shared into in-game guild chat all cover the whole guild. We process this data because your guild's leadership registered the guild or enabled the feature that produces it. If you are a guild member and want your data removed, contact us (see below) or ask your guild's leadership.

Discord may make baseline server information available to bots in servers where they are installed, such as basic member profile details, role membership, channel metadata, message metadata, and interaction data. Ahriman uses this access only as needed to respond to commands, verify permissions, manage configured roles, preview officer-linked messages, and send or copy content into the channels your server configures. We do not use Discord data for advertising, profiling, resale, or unrelated analytics.

• Polling the Tacticus API for your guild to detect boss kills, prime kills, and season transitions
• Sending notifications to the Discord channel and roles you configured
• Previewing and sending custom notification text from Discord messages your officers explicitly link
• Authorising who can change settings (in-bot commands and the web dashboard)
• Copying submitted replay videos into the Discord library threads configured by your server
• Managing library threads, plan indexes, tags, compositions, and access roles
• Building raid leaderboards, if your guild configures them: player names and damage figures from Guild Raid attack records are posted to the Discord channels your officers choose. Multi-guild leaderboards combine and display this data across all participating guilds.
• Collecting replays shared in in-game guild chat (if enabled) and showing them to your guild via the /replays command and the dashboard replay browser and viewer
• Cross-guild replay sharing: on Discord servers hosting multiple guilds ("clusters"), officers can mark collected replays as shared with the cluster, making them viewable by members of the other guilds on that server

We don't sell your data or share it for advertising. We share or process it only as needed to run the service, including with the providers listed below and in the Discord servers or channels your guild configures.

The developer has administrative access to stored data, including collected replays across guilds, used only to operate, support, and debug the service.

• Discord — the bot uses Discord's API to read commands, send messages, manage roles, and copy submitted replay videos into configured library channels or threads. Discord's privacy policy governs what happens on their platform.
• Snowprint Studios (Tacticus API) — the API key your guild provides is sent to Snowprint when we fetch guild raid and membership data.
• Supabase — your configuration and player records live in a Supabase-hosted PostgreSQL database.
• Fly.io — the bot and web dashboard run on Fly.io infrastructure.
• Object storage — the battle data of collected Guild Raid replays is stored in an S3-compatible object storage bucket operated for Ahriman; share metadata stays in the database.

• Guild records, API keys, notification config, rotation state, and library config: kept until a guild officer or server admin asks us to delete the records.
• Player records: kept while you're registered with Ahriman. Removed on request.
• Replay videos and descriptions: kept in the Discord channels or threads they were submitted to until removed from Discord by someone with access or on request.
• Collected Guild Raid replays (battle data, stats, and share metadata) and leaderboard configuration: kept until the guild's data is deleted or we receive a removal request. Deleting a guild's data also deletes its stored replay files from object storage.
• Removing the bot from your Discord server does not, by itself, delete guild database records. Guild officers can permanently delete all guild data from the Guild Setup page in the dashboard or via the /guild_settings command.

You can ask us to show you what data we hold about you, correct it, or delete it. For deletion of guild records or individual player data, contact us directly (see below).

You can also delete the data linked to your account from the Player Profile page in the dashboard. This removes your player record, your token alert configuration (including the encrypted personal API key), your queued library uploads, and any replay collection credentials you registered. Guild officers can remove the guild API key or permanently delete all guild data — including collected replays — from the Guild Setup page or the /guild_settings command.

Collected Guild Raid replays and Guild Raid attack records are guild data rather than account data: they are deleted with the guild, or individually on request — contact us to have specific replays or records removed.

Ahriman is built on top of Discord and Tacticus. You must meet their minimum age requirements (Discord: 13+, or higher in some regions) to use it.

If we materially change this policy we'll update the effective date above and post a notice in the support Discord. Continued use after changes means you accept the new version.

• Discord: Pants of Horus server — primary support channel
• Developer: @igap on Discord
• Privacy requests: contact @igap on Discord through the Pants of Horus server.