Discord bot privacy notice
Effective .
ChoiceSpin uses your Discord identity to put one account entry on a shared wheel. Your entry is visible to people who can access that wheel in its Discord server.
Who runs this bot
ChoiceSpin is operated by Γεωργιος Συκιωτης / GEORGIOS SYKIOTIS, based in Greece. He is responsible for deciding why and how this bot processes personal data. You can contact him at choicespin@gmail.com or through the ChoiceSpin contact page.
This notice covers the ChoiceSpin Discord bot and its embedded live wheel, called an Activity. The main ChoiceSpin website has its own privacy notice.
What the bot processes and why
- Discord identity: your user ID and global display name, or username when no global name is available. The bot uses your ID to keep one entry per account and to check the host's controls. Names are copied when you create or join a wheel.
- Wheel records: a wheel ID and title, the host's ID and name, server and channel IDs, Discord message IDs, creation and expiry times, the entry list, and the current or most recent draw. A draw saves its own entry snapshot, chosen account, round number and delivery timing so a retry can recover the same result.
- Activity verification: a Discord authorization code, a short-lived OAuth access token, the Activity instance and its verified server, channel and user membership. These let the bot verify who is opening the wheel. You authorize through Discord; the bot does not ask for your Discord password.
- Recovery and abuse controls: relevant Discord interaction and reaction events, event identifiers, delivery receipts and bounded request counters. The cloud version saves an event inbox so an interrupted action can be recovered. An event can include a Discord interaction token or identity information supplied by Discord.
The bot uses this information to provide the wheel you request, enforce access and host controls, prevent duplicate actions, recover interrupted draws and keep the service working. It does not introduce advertising or analytics tracking. This bot does not use Vercel or Firestore for its wheel storage.
Legal basis
Identity, wheel entries and Activity verification are processed to provide the service you request under these terms of use (GDPR Article 6(1)(b)). Bounded recovery records and abuse controls support the operator's legitimate interests in preventing duplicate actions, protecting server access and maintaining a reliable service (Article 6(1)(f)). These controls use limited records with short retention rather than tracking people across unrelated services.
Who can see an entry
Joining puts your Discord name and account identity on a shared server wheel. Other people authorized to view that wheel can see its roster and results. The host can spin or end the wheel. The host's name is also displayed.
A spin fixes a snapshot of the entries before choosing a result. Joining or leaving during the animation changes the next roster; it does not change that saved draw. Your name may therefore still appear in the current draw or a completed round image after you leave.
Discord posts, wheel images, animated GIFs and results follow the channel's access settings. People with access may save, share or screenshot them. Discord and the server's administrators control that message history.
Storage and retention
- Active wheel data: a wheel expires 24 hours after creation. Expired wheel records are removed at the next successful cleanup. Outages or storage errors can delay cleanup.
- Ending a wheel: this clears its active entry list and saved draw from the wheel record. Host details, the title, message references and basic wheel metadata remain until the record expires. Completed Discord posts and GIFs can remain in the channel.
- Activity sessions: opaque sessions are held in memory for up to six hours in the cloud version, capped by the Discord OAuth token's remaining lifetime. The private PC pilot uses a ten-minute cap. Expired sessions stop working; their memory entries are removed during later access or when the process ends.
- Cloud recovery inbox: processed or declined events are removed after handling. Events that repeatedly fail are eligible for removal 24 hours after the bot accepted them, at the next successful cleanup. Outages or storage errors can delay that removal.
- Copies and backups: deleting an active record does not instantly erase provider backup copies or information already delivered to Discord. Any separate support correspondence follows the relevant email provider's storage and the handling needed for that request.
The cloud version stores wheel records and its recovery inbox in Cloudflare Durable Objects SQLite. Bot credentials are kept in provider secret storage, separate from the public frontend. The private PC pilot stores wheels in a local JSON file. These environments are alternatives; the PC file is not the cloud database.
Discord and hosting providers
Discord supplies identity, server events and message delivery. Cloudflare provides the cloud application's hosting, storage and network services. These providers may process network and security information under their own terms, including outside your country. Read Discord's privacy policy, the Discord Developer Terms and Cloudflare's privacy policy for their practices.
Your choices and requests
Use Leave or remove your wheel reaction to leave the next roster. The host can end a wheel to clear its active entries and draw. Neither action guarantees removal of earlier Discord messages, saved media or screenshots.
For access, correction, deletion or another privacy question, email choicespin@gmail.com. Include your Discord user ID and, if available, the server, channel or wheel message link so the operator can find the relevant records. Do not send passwords, bot tokens or authorization codes. The operator may need to verify the requester's identity and explain any retained records or provider limitations.
Requests are handled by the operator, rather than an automatic account-deletion tool. This notice does not promise instant erasure of Discord history, failed recovery events or provider backups. Your rights under applicable data-protection law are not limited by this notice.
Where applicable, you can request access, correction, erasure, restriction or portability of your data, and object to processing based on legitimate interests. The operator will normally respond within one month; a permitted extension or a refusal will be explained. You can complain to your local supervisory authority, including the Hellenic Data Protection Authority in Greece.