Privacy Policy

Last updated: 2026-07-23

What we collect

When you use the bot in a Telegram group or Discord server, we store the minimum needed to run a feedback board: your platform user id and display name, the communities you belong to, and the suggestions, votes, comments, and follows you create. Admins additionally have a web account (email + password, or a Discord/bot-linked passwordless login). We also store moderation records — warnings, mutes, and bans, with the reason given — and, where content was removed for violating the rules, a copy of that content (see Retention & deletion).

How we use it

Solely to operate the service — show boards and roadmaps, count votes, notify followers, deduplicate similar requests, and let admins moderate. We do not sell your data or use it for advertising.

AI processing

Suggestion text may be processed to generate a title, category, to detect duplicates, and to flag content that appears to violate the Acceptable use rules (for example threats, which no keyword list can reliably catch). By default this runs on a self-hosted local model (no third party). On a paid plan, suggestion text for that community is sent to our AI provider to perform the same tasks — upgrading is what changes this, not a separate setting.

Cookies

The bot itself sets no cookies. The web dashboard uses a strictly-necessary cookie to keep admins signed in (an HttpOnly session/refresh token). If you arrive from a referral link (?ref=) we also set one first-party cookie, qb_ref, for 30 days, so we can tell which link brought you — that one is attribution rather than strictly necessary, and it is not shared with anyone. During a paid checkout, our payment providers (Stripe / PayPal) may set their own cookies to process the payment and prevent fraud. We use no advertising or third-party tracking cookies. See our Cookie policy for details.

Subprocessors

We rely on a small set of providers to run the service: Stripe, PayPal and Razorpay (payments, for paid plans), Cloudflare (network/CDN), and — only if a community turns them on — an email provider for notifications and a paid AI provider for suggestion processing. Each receives only the data needed for its function. Some of these providers are based in the United States, so your data may be processed outside your country. Self-hosted instances use whichever providers their operator configures. See the full list of subprocessors. A Data Processing Addendum (DPA) is available on request at [email protected].

Your rights

Depending on your jurisdiction (e.g. GDPR / CCPA) you may request access to, correction of, export of, or deletion of your personal data, and object to certain processing. We don’t sell personal data. To exercise any of these, use the steps on the Data deletion page or contact us below.

Retention & deletion

Data persists while you use the service. You can request deletion of your personal data or an entire community at any time — see Data deletion.

One narrow exception. If content was removed for violating the Acceptable use rules — threats, hate speech, harassment — we keep a record of it: the content itself, the account it came from, and the moderation decision. We rely on the legitimate interest of establishing, exercising or defending legal claims (GDPR Art. 17(3)(e)), because a moderation decision that can be erased on request by the person it was made about cannot be reviewed, appealed, or defended afterwards.

This record is kept until an admin marks the matter closed, and deleted 30 days after that. An open case is not deleted on a timer — a dispute can surface long after the incident, and evidence that expired on a schedule would be gone exactly when it was needed. It is visible only to that community’s admins and to us, and it is never used for anything else. A ban is enforced after deletion by a one-way fingerprint of the account — it holds no readable personal data and cannot be reversed into an identity, but it stops the same account returning. Everything else about an erased account is deleted as described above.

Contact

Questions about this policy or your data: [email protected]. For a self-hosted instance, contact the operator of your community’s instance.

Changes to this policy

We may update this policy as the service evolves. Material changes will be reflected by the “Last updated” date above.