Privacy Policy - Dox Box

1. Who we are

The data controller is Ethan Sawyer, an individual based in the United Kingdom who runs Dox Box on a non-commercial basis. Contact: privacy@doxbox.org, or any administrator in our Discord server.

We are based in the UK and process personal data under the UK GDPR and the Data Protection Act 2018. We give people in the European Economic Area the same rights.

2. Data we collect

This table lists the categories of personal data our services hold about account holders. Data handled by the bots, the apps and the community services is described in more detail in §4–§6.

Data	Where it comes from	What it is used for
Account identity: internal account ID, Discord user ID, Google account ID, sign-in service ID, email address, display name, avatar image	Your Discord or Google account, through our sign-in service (Authentik), when you sign in. Accounts created through Quinn or Dox start with only your Discord ID and your global Discord display name (or username).	Signing you in, recognising you across our services, and showing your name and picture to others (§3).
Group membership (roles such as “Dox’s Chosen”)	Our sign-in service, which reflects your roles in our Discord server	Deciding which features you can use.
Profile settings: timezone; whether your name and avatar update automatically	Set by you	Showing times in your timezone; keeping your name and picture the way you chose.
Linked game accounts (optional): Minecraft username and UUID; Steam ID and Steam display name	Added by you in the Portal, the app, or with Dox’s `/platforms` command	Our Minecraft whitelist and bridge, and showing which game accounts belong to which member. Checked with Mojang or Steam when you add them.
Notification settings: the methods we can reach you by (your sign-in email, Discord DMs, an optional phone number for SMS, which is stored encrypted, and the app on your phone) and which events you want on each	Your email is added as a method automatically the first time you sign in; the rest are set up by you	Sending the notices you have switched on. Nothing is sent by email, SMS or push unless you switch an event on for it, except as noted in §4 and §5 (activity DMs, and session reminders the first time the app registers your phone).
Push devices: push token, device manufacturer and model (e.g. “Google Pixel 8”), a random install ID, last seen time	The Android app	Delivering app notifications to the right phones. See §5.
Dice and initiative: rolls (expression, any description you add, result, campaign, time, and whether you rolled in Discord, the Portal, the app or the extension), saved rolls and roll variables, initiative characters, how long your combat turns take	Created by you in the Portal, the app, the extension, or with Quinn	Rolling dice, your roll history and statistics, and running combat.
Campaigns: campaigns you create (name, links, schedule), campaigns you belong to and whether you are GM, linked Discord server and channel IDs, sessions and session notes, your availability for each session (and any reason you give), your DM notification choice	Created by you and other campaign members	Organising tabletop campaigns and scheduling sessions.
Campaign journals: journal steps you write (with your name as author), and entries and quests you add, which are shared with the campaign and not linked to you	Written by you and other campaign members	A shared record of each campaign.
Watchlists: lists you own or belong to and your role, items you add (and any notes), episodes you mark as watched	Created by you	Personal and shared lists of films, series and games.
Activities: activities you create (game, time, notes, player limits, invitees) and your responses (attending, declined, reserve list, invited)	Created with Dox in Discord or in the Portal	Organising group games. See §4.
Images you upload: custom avatar, campaign and server images	Uploaded by you	Showing them in the Portal and app. They are stored in our object storage at a public web address that contains your internal account ID, so anyone who has the link can view them.
Credentials: API keys (stored only as a hash, with their label and when they were last used); sign-in tokens for the app and extension	Created by you / issued when you sign in	Letting your own scripts, the app and the extension act for you. See §12.
Sessions and presence: for each browser signed in to the Portal, when the session started and was last used, its IP address and browser type; whether you are online right now, and whether that is in the Portal or the app (the app reports this only while it is open on your screen)	Recorded automatically while you use the Portal or have the app open	Keeping you signed in, letting you see and end your sessions (Profile → Security), and the “who’s online” bar.
Agreement and age records: when you accepted the Terms and which version, and, where you were asked (Portal and app), that you confirmed you are 18 or over	Recorded when you accept	Showing which version of the Terms you agreed to.
Age-verification record (Dox’s Chosen members only): that an administrator checked you are 18 or over before giving you the Dox’s Chosen role, how (personal knowledge, a photo ID check, or another way), a one-line note, when and by whom; your Discord display name and avatar address; when you were given the role and when it was removed. No date of birth or ID details are kept	Recorded by an administrator, mostly with Dox’s `/chosen` command; role changes are kept in step with our Discord server by Dox	Showing that explicit image board content is only available to adults whose age was checked (see §6).
Data export history: when you asked for a download and whether it is ready	Recorded when you ask	Providing your data downloads.
Logs: an audit log of sign-ins, account changes and actions taken through our services and bots (including the IP address of the request); server and application logs	Recorded automatically	Security, troubleshooting and preventing abuse. See §8 for how long each is kept.

We don’t ask for, and ask you not to post, special category data such as health information. If you give a reason for missing a session, keep it general. Only the GM and you can see it, and you can change or remove it at any time.

Quinn and Dox never create a Dox Box account for you, or save your rolls, campaigns, activities or game accounts, until you have accepted the Terms. Separately, Dox keeps the short-term member cache described in §4 for everyone in our Discord server, and our servers keep short-lived technical logs (§8). If you start signing in to the Portal, app or extension but never accept the Terms, the unfinished Dox Box account is deleted automatically about 30 days later. That does not delete the sign-in service account created when you signed in; ask us and we will.

Do you have to give us this data?

No law requires you to give us personal data. To have an account we need your Discord or Google sign-in details and your acceptance of the Terms; without them we cannot provide the Portal, the app, the extension or Quinn’s saved features. Optional items (phone number, game accounts, notification methods, timezone) are up to you; if you leave one out, only the feature that uses it won’t work.

If you don’t have an account

We may hold a little data about people who haven’t signed up. Everyone in our Discord server is in Dox’s short-term member cache (display name and avatar address, from Discord). Messages posted in our Minecraft bridge channel are relayed to the game (§4). Players on our game servers appear in game server logs (§6), and in the game server lists while they are playing (§3). Members may also mention you in a campaign journal or notes, or you may appear in an image on the image board. We rely on legitimate interests for this (§7), and you have the same rights as anyone else (§9), including the right to object and to ask us to remove it.

3. Who can see your data

Other members see your display name and avatar wherever you appear: campaign rosters, journal authorship, watchlist members, activity sign-ups, initiative and the online bar. They do not see your email address or phone number. To show the right person, the information their browser or app receives about you can include your internal account ID and, in campaigns, initiative and activities, your Discord user ID.
Campaign members see the campaign’s content: roll results and roll statistics for that campaign (except rolls you mark Hidden, which only you can see), who is available for each session, journal steps and the campaign’s linked channels. In initiative, they see the order and every character’s name, but a character’s initiative roll and dexterity only if it is theirs or they are a GM. They can also see whether you have Quinn DMs switched on for it. Reasons you give for missing a session, and session notes, are visible only to the GM (and your reasons to you).
Watchlists are visible according to the setting their owner chooses: Public (all members who can use watchlists), Members Only (the default: only people the owner has added to the list), or Private (the owner only). Administrators can see all lists (below).
Game server lists show the in-game names of people playing on our servers at that moment, as our game server panel reports them, whether or not they have a Dox Box account: the game server pages in the Portal and the app, and a game server forum in our Discord server, where Dox keeps a post for each server, opening with its details, and edits it as people join and leave. All three are for Dox’s Chosen and Battle Pass members. We don’t store the names; each update replaces the last. Discord holds those posts as they stand.
People in Discord channels see what the bots post there: roll results (including campaign rolls you make in the Portal or the app, unless you mark them Hidden), initiative updates, activity sign-up lists and Minecraft bridge messages, under your name in that server and your Discord avatar (or, for unlinked Minecraft players, their Minecraft username and skin). Those posts are held by Discord and stay in the channel unless someone with permission deletes them. Deleting your Dox Box account does not remove them.
Administrators: a small number of trusted members run the services. They can see account details (email address, Discord ID, timezone, group membership, linked accounts including Steam and Minecraft IDs, API key details, when you accepted the Terms, and age-verification records), audit logs including IP addresses for up to 30 days, all campaigns and their members, and all watchlists including private ones. They can add themselves to a campaign, and when helping with a data request they can download a copy of your data export. They can also edit or remove accounts, groups, linked game accounts, campaigns and watchlists. They use this access only to run, support and moderate the services.
Server logs can be read only by people with administrative access to our servers.
Anyone with the link can view images you upload (see §2).

4. The Discord bots

Discord sends bots every message in the channels they can see; that is how Discord bots work. Both bots ignore everything outside the specific places described below. Apart from the dice rolls Quinn records, neither saves message content. Like all Discord bots, they briefly hold recent messages and member details in memory while they are running.

Quinn

Quinn is a tabletop RPG bot that can be added to any Discord server and used in DMs. It offers dice rolling, saved rolls and roll variables, initiative tracking with a live display, and campaign management. This section applies to everyone who uses Quinn, in any server.

Getting started. The first time you use a Quinn command or button, it shows you a message only you can see, with links to the Terms and this policy. If your first use is an inline dice roll in a server, Quinn instead replies in the channel with the same buttons, and deletes that reply after a minute. Quinn saves nothing about you until you click Accept, which creates a Dox Box account linked to your Discord ID and global display name (or username). Before that, Quinn only checks with our API whether you have accepted, and keeps a short note in memory (up to 10 minutes) so it does not repeat the prompt. If you decline, Quinn saves nothing beyond short-lived technical logs. When the Terms change, Quinn asks you again the next time you use it, and will not act for you until you accept.
What it stores in our API: your account, display name and avatar; campaigns you create (name and links); your dice rolls, including any description you add; saved rolls and variables; initiative characters and combat turn timings; campaign memberships and GM status; DM notification choices; which Discord server and channel IDs are linked to which campaigns; your acceptance record; and an audit record of each action Quinn takes for you (§8).
Profile sync. When you change your global Discord display name or avatar (and share a server with Quinn), or run /sync-avatar, Quinn updates them here too, unless you have turned automatic name or avatar off in your profile. Server nicknames are never saved to your profile, though Quinn shows your nickname in that server on the messages it posts there.
Inline dice. In channels linked to a campaign, and in DMs once you have chosen a campaign, Quinn looks for messages that consist only of dice notation (for example 2d6 or !roll 1d20+5), optionally followed by # and a description. It sends the dice expression and description to our API. In servers it deletes your message and reposts the result under your name in that server and your avatar, through a Discord webhook; in DMs it replies there. Other messages are ignored. If you haven’t accepted the Terms yet, Quinn doesn’t process the roll and replies with the Accept prompt instead.
Other people. A GM can only add you to a campaign once you have accepted the current Terms yourself.
Campaign shortcut. Quinn remembers your current campaign (chosen in DMs, or the last campaign channel you used it in) for 30 days after it last changed, so commands in DMs know which campaign you mean.
Across servers. A campaign can be linked to channels in more than one server. Initiative updates, including your name, avatar and character (but not initiative rolls or dexterity), are posted to every linked channel that has notifications on, in any server. A dice roll you make in Discord appears only in the channel where you roll it. A campaign roll you make in the Portal or the app is posted by Quinn to every linked channel that has notifications on, under your name in that server and your avatar, unless you tick Hidden before rolling.
DMs. If you switch on DM notifications for a campaign, Quinn DMs you when combat starts, keeps a live combat tracker in your DMs that updates each turn, and tells you when combat ends.
Quinn sends personal data only to Discord and our own servers.
Younger Quinn users. Quinn can be used by people aged 13 to 17. We don’t ask your exact age, so we give every Quinn user the protections the ICO’s Children’s code expects: Quinn collects only what it needs to roll dice and run campaigns, its DMs stay off until you switch them on, it never uses your location, it shows no ads and does no profiling, and it sends nothing outside Discord and our own servers. Your rolls and characters can appear in every channel your campaign is linked to, so use a character name rather than your real name if you prefer. If anything here worries you, talk to a parent, carer or another adult you trust, or email us.
Deleting your Quinn data. Email privacy@doxbox.org with your Discord user ID, or use the deletion options in §9 if you can sign in to the Portal. Removing Quinn from a server, or leaving a server, does not delete your account.

Dox

Dox works only in the Dox Box Discord server. If it is added anywhere else, it ignores that server and we remove it. Activities and linked game accounts need a Dox Box account, and Dox asks you to accept the Terms first in the same way as Quinn. Card lookups, temporary voice channels, the Minecraft bridge and the member cache work without an account.

Activities. Members with the Dox’s Chosen role can post an activity (game, time, notes, optional invitees, and player limits and reminders from a preset). When you click Sign Up or Not Interested, your choice is recorded against your account. The announcement lists players (including invitees, marked “invited”) and any reserve list by Dox Box display name. Invitees must already have accepted the Terms, and get a DM. If reminders are on, people signed up get a DM about an hour before the gather or start time, and a reserve gets a DM if they move up into a place. Activity DMs are on until you turn them off under Profile → Notifications.
Game accounts. /platforms links, unlinks or lists your Steam or Minecraft account. Linking Minecraft needs the Dox’s Chosen or Battle Pass role and adds you to our Minecraft whitelist.
Notifications. Dox delivers the Discord DMs our API sends: session notices and reminders you switch on, activity invites, reminders and reserve promotions, account notices you switch on (such as a data export being ready or an API key expiring), and test messages you request. It keeps no copy.
Temporary voice channels. Joining a trigger channel creates a voice channel, usually named with your display name in the server. It is deleted when it empties. While it exists we keep only its channel ID and a room number. No audio is recorded.
Card lookup. /card looks up Magic: The Gathering cards on Scryfall. Only the card name you enter is sent (and, shortly after Dox restarts, what you type for suggestions). Nothing identifying you is sent, and the result is posted in the channel.
Dox’s Chosen. Administrators give the Dox’s Chosen role with Dox’s /chosen command, recording how they checked the member is 18 or over (§2). Dox also tells our API who holds the role, so the list stays in step with Discord; anyone given the role another way shows as having no verification recorded until an administrator adds one.
Roles. Dox checks your Discord roles when you create an activity or link a Minecraft account. Roles are not stored.
Server details. To offer activity channels, Dox sends our API the names and IDs of the server’s text channels and the server owner’s Discord ID.
Member cache. To show players’ names and pictures in Minecraft bridge posts, Dox caches every server member’s display name in the server and avatar address, whether or not they have a Dox Box account. Entries are refreshed whenever Dox starts or your server profile changes, are removed when you leave, and expire 7 days after they were last refreshed.

Minecraft bridge

The bridge links one channel in our Discord server with chat on our Minecraft server.

Anything posted in that channel is relayed to Minecraft chat as plain text, whether or not the person has a Dox Box account, under their name in our Discord server, or their Minecraft username if they have linked one. Their Discord ID and avatar are not sent to the game server.
Public Minecraft chat, and join, leave and death messages, are posted to the channel: under the linked member’s name in the server and Discord avatar where the Minecraft account is linked, otherwise under the Minecraft username with a head image made from the player’s skin, which we look up from Mojang.
Our services pass bridged messages through without saving them to a database or to our application logs. They stay in Discord’s channel history. Messages from Minecraft also appear in the game server’s logs (§6); messages sent from Discord do not.

5. The Android app and the browser extension

Dox Box Android app

The app (org.doxbox.companion) uses the same account and API as the Portal. It contains no advertising, analytics or crash-reporting SDK, and it does not read your advertising ID or Android ID. (Versions released before October 2026 sent the Android ID as a device identifier; it is replaced the next time the updated app registers for notifications, and any left over are removed from our records.)

On your phone	Where	Why
Sign-in tokens (access, refresh and ID tokens)	Encrypted storage, with the key kept in the phone’s keystore	Keeping you signed in without storing your password. Removed when you sign out.
Navigation order; push registration ID; a random install ID	App preferences	Remembering your layout, and recognising this phone for notifications. The registration ID is removed when you sign out; the install ID stays until you clear the app’s data.
Firebase’s own installation ID and push token	Firebase library storage	Push notification delivery (see below).
Images you have viewed	The app’s cache	Faster loading. Android can clear it at any time.
Data exports you download	Your Downloads folder (on Android 8 and 9, a location you choose)	Your copy. These stay after the app is uninstalled.

Network. The app talks to api.doxbox.org (including a live connection for initiative) and auth.doxbox.org, over HTTPS only. Sign-in and sign-out open auth.doxbox.org in a Custom Tab (your own browser, which the app cannot read). Pictures load directly from where they are hosted: posters from TMDB and IGDB, avatars and uploads from our object storage, some avatars from Discord or Google, and game server images chosen by administrators. Those hosts can see your phone’s IP address.
Updates. The app sends its build number with each request to our API, so that a version too old to work with Dox Box any more can be asked to update. If you installed it from Google Play, it also asks the Play Store app on your phone whether an update is available, and may offer to install it; that check is between your phone and Google, and nothing about it reaches us.
Push notifications. The app’s Firebase library stays switched off until you have signed in and accepted the Terms. After that, while notifications are allowed for the app, it registers with Google’s Firebase Cloud Messaging. We store the push token, your phone’s manufacturer and model and a random install ID so we can reach it, and we switch on push for session reminders, which you can change under Profile → Notifications. Notification content, such as a session name and time, passes through Google on its way to your phone. Signing out removes the phone. You can also remove it under Profile → Security in the Portal (Security & access in the app), but it is registered again the next time the app opens while you are signed in with notifications allowed; to stop that, turn the app’s notifications off in Android settings. Phones not seen for 90 days are removed automatically.
Permissions. Internet, network state and notifications. The Firebase library adds the standard push permissions (receiving push messages, and briefly keeping the phone awake to handle one), and Android adds an internal permission that keeps the app’s own messages private.
Your rights in the app. Data download and account deletion are under Privacy & data (reached from More → Profile & settings), and also on the screen that asks you to accept updated Terms. Uninstalling the app removes its data from the phone, apart from exports you saved, but does not delete your account.

Quinn browser extension

The extension (for Chrome and Firefox) helps run initiative while you play on Shmeppy.

On Shmeppy pages only, it reads the page address so it can match it, on your device, to one of your campaign map links while automatic campaign switching is on (the default; you can turn it off in the extension’s popup). The address is not sent anywhere. Apart from detecting the game page and adding our display to it, it does not read content from Shmeppy, or anything from other tabs.
Sign-in uses our sign-in service’s login page (OAuth with PKCE), so the extension never sees your password.
It talks only to our API (including a live connection for initiative) and our sign-in service. We send nothing to Shmeppy, though the initiative list the extension draws on the page (character names and rolls) is visible to that page.
It stores on your device: your refresh token (sealed with a key the extension cannot export), your Discord ID and display name, the names, IDs and map links of your campaigns and whether you run them, your selected campaign, the latest initiative state, display preferences, and a note if the Terms still need accepting. The short-lived access token is kept in memory only. Nothing is synced to a browser account.
Clear All Data in the extension revokes its sign-in with our sign-in service and removes your tokens and account data from it (your display preferences stay). Uninstalling removes everything. Signing it out under Profile → Security → Where You’re Signed In stops it renewing its access, and it loses access within about 10 minutes.
The extension’s use of information it receives follows the Chrome Web Store User Data Policy, including its Limited Use requirements. We use it only to provide the extension’s single purpose, running initiative alongside Shmeppy; we don’t sell it or use it for advertising, and we don’t transfer it to anyone except as needed for that purpose, to comply with the law, or to protect against fraud or abuse.

6. Game servers and other community services

Game servers and panel (gameservers.doxbox.org). Members sign in to the CubeCoders AMP panel through our sign-in service, which gives AMP your user ID, display name, email and groups. Your AMP account is deleted when you delete your Dox Box account. Our Minecraft whitelist is built from linked Minecraft accounts, and the game server holds the usernames and UUIDs on it. When you play on our game servers, they log your player name, game account ID, IP address, chat, and joins, leaves and other in-game events. These logs are kept for up to 30 days. The games themselves check your game account with their own services (such as Mojang or Steam) when you join, under those companies’ policies.
Image board (booru.doxbox.org). Anyone can browse posts rated safe or suggestive. Explicit posts are shown on the board only to signed-in members of Dox’s Chosen, a role given only after an administrator has checked the member is 18 or over (§2). Image files themselves are served at long, unguessable addresses that open for anyone who has the link; members may share links to explicit images only in age-restricted places for adults. Administrators upload and tag images; members can score and favourite. The board has no comments. Members sign in with their Dox Box account through our sign-in service; only Dox’s Chosen and administrators can, and a board sign-in lasts at most 7 days. Your board account is created the first time you sign in and holds a username taken from your sign-in account, your rank, the sign-in tokens of browsers where you are signed in, and your scores and favourites (and, for administrators, uploads). It holds no email address, password or picture. Before creating it, the board checks with our API that you have accepted the current Terms. Your board account is deleted when you delete your Dox Box account, and included in your data download.
Tabletop server (tabletop.doxbox.org). Our FoundryVTT server holds player accounts set up by the GM, and the chat, journals and characters in each game world. These are kept until the world is deleted or you ask us to remove them.
Website (doxbox.org). The website sets no tracking cookies and loads nothing from other sites. Our Garry’s Mod server’s message-of-the-day page shows your in-game name, Steam ID, the map and the server name, which the game server adds to the page address; our website receives them with the page request but does not log or store them. The loading screen shows only the server name, map, game mode and player slots. The Discord page shows some members’ Discord usernames and avatars; if you are shown there and would rather not be, tell us and we will remove you.
Status page (status.doxbox.org). This shows whether our services are up, and holds no personal data.
Donations. Donations are voluntary and unlock nothing. If you donate, the payment is handled by the platform you use under its own privacy policy; we see only what it shows us (usually your name, the amount and any message) and use it only to keep track of donations and say thank you.

7. Why we use your data, and our legal basis

Purpose	Legal basis (UK/EU GDPR Art. 6)
Running your account and the features you use: sign-in, profiles, campaigns, dice, initiative, journals, watchlists, activities, the bots, the apps, game server, image board and tabletop server accounts, data downloads and deletion	Contract (Art. 6(1)(b)): providing the services under our Terms of Service, which you agree to when you accept
Optional notifications: SMS, and the session and account notices you switch on for email, Discord or the app	Consent (Art. 6(1)(a)): you choose each one and can switch it off, or remove your phone number or a phone, at any time
Security, troubleshooting and preventing abuse: audit logs, server and game server logs, sign-in records (including an approximate location worked out on our own servers from sign-in IP addresses, to spot suspicious sign-ins), session records, and administrators moderating and supporting the services	Legitimate interests (Art. 6(1)(f)): protecting the services and our members from hacking, abuse and misuse, and fixing faults. Logs are kept for short, fixed periods (§8) and only administrators can read them.
Group features that involve people without an account or beyond what you set up: the Dox member cache, the Minecraft bridge, game server logs, showing who is playing on our game servers, showing roll statistics to your campaign, activity DMs (until you switch them off), and essential notices about your account (such as an API key about to expire, or a security notice)	Legitimate interests: making the group’s shared features work as members expect, using only names, pictures and information the people concerned can already see in our Discord server or games, and telling you about things that affect your account
Keeping breach records and answering requests about your rights; keeping a minimal record of each account deletion	Legal obligation (Art. 6(1)(c)) for breach records and rights requests; legitimate interests for the deletion record, kept for six years (the usual time limit for legal claims in England) so we can show we carried out your request
Keeping the Dox’s Chosen age-verification record	Legal obligation (Art. 6(1)(c)): the Online Safety Act 2023 requires us to keep explicit image board content away from children and to keep a record of how we do it; and legitimate interests: being able to show, if asked, that each member with access was checked

If you are under 18, or anywhere a contract with you may not be valid, we rely on legitimate interests instead of contract: providing the features you have chosen to use. We have weighed this against your interests, giving extra weight to younger users, and we keep what we collect to a minimum.

We do not use your data for advertising or profiling, and we make no automated decisions that have legal or similarly significant effects on you. Small automatic steps, such as moving the next person off an activity’s reserve list when a place opens up, have no such effect.

8. How long we keep it

Data	Kept for
Your account and everything you created (§2), including records of API keys you have revoked	Until you delete your account (see below)
Unfinished accounts that never accepted the Terms	Deleted automatically about 30 days after they were started
Audit log entries	IP address removed after 30 days; entry deleted after 90 days
Portal sessions (including IP address and browser type)	Until you sign out or end the session, or 30 days after you last used it
Online status	90 seconds after your last activity
App and extension sign-in tokens	Access tokens about 10 minutes; refresh tokens up to 90 days, or until you sign out or sign the client out
API keys	Each key stops working one year after it is created, or when you revoke it
Push devices	Removed 90 days after the phone was last seen, when you sign out, or when you remove it
Data export files	7 days, then deleted
Server and application logs	Up to 30 days in our central log store. Each server also keeps a small rolling copy (at most 30 MB per service) that is overwritten as new logs arrive.
Game server logs (player name, game account ID, IP address, chat and in-game events)	Up to 30 days
Sign-in service records (sign-in events with IP address, browser and approximate location)	Up to 12 months
Quinn’s current-campaign shortcut	30 days after it last changed
Quinn’s live combat display (message IDs, and the Discord IDs of people receiving it by DM)	Until combat ends
Dox’s member cache	Until you leave our Discord server, or 7 days after it was last refreshed
Temporary voice channel IDs	While the channel exists
What the bots hold in memory while running	Until the bot restarts
Image board account; tabletop server player account and world content; game panel account	Image board and game panel accounts: until you delete your Dox Box account, or ask us. Tabletop: until you ask us to remove it, an administrator removes it, or the world is deleted
Age-verification record (Dox’s Chosen)	While you hold the role, then 12 months after it is removed, so we can answer any question about the time you had access. Deleting your Dox Box account removes its link to your account but not the record itself, for the same reason
Server backups and snapshots, where taken	Up to 30 days. Deleted data drops out of them as they expire.
Deletion record (internal ID, Discord ID, time of deletion, requesting IP address)	IP address removed after 30 days; record deleted after 6 years. It exists only to show we carried out your request.
Notes we make if part of a deletion fails and needs finishing by hand (internal and sign-in service IDs)	Until it is fixed, then up to 12 months

What deleting your account removes: your profile, settings, group memberships, linked game accounts, notification methods and preferences, phones registered for push, API keys, Portal sessions and sign-in tokens, dice and initiative data, campaign memberships and your session availability, journal steps you wrote, activities you created (and everyone’s responses to them) and your responses to others, watchlist memberships, uploaded images, your avatar, data exports, and your accounts on our sign-in service, game server panel and image board. Campaigns and watchlists left with no members are deleted.

What stays: campaigns, journal entries and quests that other members still use stay with them; items you added to a shared watchlist, and episodes you marked, stay on that list but are no longer linked to you; audit log entries are unlinked from your account but may still contain your Discord or internal ID until they are deleted on the schedule above; and the records in the table above are kept for the periods shown.

9. Your rights

Delete your account (Dox Box app, Portal and Quinn)

You can delete your Dox Box account and the data linked to it in any of these ways:

On the web: sign in at portal.doxbox.org, then Profile → Privacy & Data → Delete Account.
In the Dox Box Android app: More → Profile & settings → Privacy & data → Delete my account.
By email, if you can’t sign in or have only used Quinn: send your Discord user ID to privacy@doxbox.org. We may ask you to confirm the request from your Discord account.

Deletion from our live systems happens straight away and cannot be undone. Copies in backups expire within 30 days, and the records listed in §8 are kept for the periods shown there. Posts the bots made in Discord stay in Discord. Your image board account is deleted too; tabletop server accounts are separate, so ask us to delete those.

Your other rights

Downloading your data and deleting your account also work before you accept a new version of the Terms: the screen that asks you to accept offers both. The other self-service options below need you to be signed in; if you would rather not accept, email us and we will help.

Right	How
Access and portability: get a copy of your data	Profile → Privacy & Data → Download Your Data, in the Portal or the app. You get a JSON file and a PDF with the data linked to your account, including shared campaign details for campaigns you belong to. Download links last 7 days. You can also ask us by email for anything else we hold about you, such as logs, sign-in records or the deletion record, and for the other information the law gives you: why we use it, who receives it, how long we keep it and where it came from.
Rectification: correct your data	Edit your profile directly. Your name and picture can follow your Discord or Google account automatically, or you can lock them and set your own. For anything else, email us.
Withdraw consent	Switch notifications off, or remove a notification method, under Profile → Notifications (your sign-in email can be switched off for every event but not removed), or remove a phone under Profile → Security. Withdrawing consent doesn’t affect messages we sent before.
Restrict processing, or erasure of particular data	Email privacy@doxbox.org.

✋ Your right to object. Where we rely on legitimate interests (§7), you can object at any time, on grounds relating to your situation, to our using your data. Email privacy@doxbox.org and tell us what you object to. We will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

How quickly we respond. We answer requests without undue delay and within one month. If we need to confirm who you are or what you’re asking for, the month starts once we have your reply. If a request is complex, or you send several, we may extend this by up to two more months and will tell you why within the first month.

ℹ️ Complaints. If you are unhappy with how we have handled your data, complain to us at privacy@doxbox.org (or to any administrator in our Discord server). We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay. You can also complain to the Information Commissioner’s Office (ICO) or, in the EEA, your local data protection authority, at any time.

10. Where your data is held and who receives it

Our servers and object storage are rented from Hetzner Online GmbH in data centres in the European Union. Hetzner acts as our processor: it provides the machines, and we run and manage everything on them ourselves, including the sign-in service, databases and logs. Apart from the people described in §3, we share your data only with the services below, and only as far as each one needs it.

Service	Why	What it receives
Hetzner (Germany)	Server hosting and object storage	Everything we store, held on its infrastructure
Discord (USA)	Sign-in; the bots; DMs and channel posts	What the bots post or send for you (§4). At sign-in we receive your Discord ID, username, email and avatar from Discord.
Google (USA)	Sign-in with Google; Firebase Cloud Messaging for app notifications	At sign-in we receive your Google ID, name, email and picture. For push: your phone’s push token and the notification text. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Twilio (USA)	SMS notifications, if you switch them on	Your phone number and the message text
Resend (USA)	Email notifications and account emails	Your email address and the message text
TMDB and IGDB (Twitch) (USA)	Searching for films, series and games	Your search text, sent from our servers. Posters load straight from their image servers, which see your IP address.
Mojang (Microsoft) (USA)	Checking Minecraft accounts you link; skin heads for bridge posts	Minecraft usernames and UUIDs, sent from our servers
Steam (Valve) (USA)	Checking Steam accounts you link	Your Steam ID or custom URL name, sent from our servers
Scryfall and Cisco Outshift (USA)	Card lookups; random numbers for dice	No personal data

Loaded directly by your browser or app: poster images from TMDB and IGDB, avatars and uploaded images from our Hetzner object storage, and some avatars from Discord’s or Google’s image servers. Each of these sees your IP address when an image loads. Images in campaign journals and game server notes are shown only when they are hosted on a doxbox.org site or in our object storage; others are shown as links.

When we may disclose data otherwise. We may disclose personal data where the law requires it (for example to the police, a court or Ofcom), to report illegal content such as child sexual abuse material to the authorities, to protect someone’s safety, or to establish, exercise or defend legal claims. We share only what is needed and will tell you unless the law or someone’s safety prevents it. If someone else ever takes over running Dox Box, we will tell you before any of your data is passed to them, so you can download or delete it first.

Shmeppy, which the extension works alongside, receives nothing from us. We are not affiliated with any of the companies named here, and their names are their own trademarks.

11. International transfers

Our own systems are in the EU, which UK law recognises as giving adequate protection, and Dox Box is run from the UK, which the EU recognises as adequate. Some services in §10 are in the United States:

Our processors (Twilio, Resend and Google Firebase Cloud Messaging) receive data under their data processing terms, which rely on the EU-US Data Privacy Framework and its UK Extension where the company is certified, and otherwise on the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
Discord and Google (for sign-in) are independent companies you already have an account with. We exchange only what is needed for the sign-in and bot features you choose to use, and they handle it under their own privacy policies and transfer arrangements.
TMDB, IGDB, Mojang, Steam and Scryfall receive only search text, game account names and IDs, or your IP address when your browser or app loads an image from them, and handle it under their own privacy policies.

You can check whether a company is certified at dataprivacyframework.gov. To get a copy of the safeguards that protect a transfer, email privacy@doxbox.org.

12. Security

Traffic between you and our websites, API and apps is encrypted (HTTPS). Connections to our game servers use whatever protection each game provides. We keep databases and internal services off the public internet, behind firewalls on a private network.
Phone numbers are encrypted with AES-256-GCM before they are stored, and the key is kept on a different server from the database. API keys are stored only as one-way hashes and shown to you once.
The Portal keeps you signed in with an HTTP-only session cookie and, while you use it, re-checks with our sign-in service every 5 minutes that your sign-in is still valid. The app and extension use short-lived tokens and never hold your password.
Under Profile → Security you can see your recent sign-ins (Portal, app and extension), sign out each browser, app or extension you are signed in on, remove phones, and revoke each API key.
Our application logs are designed not to record message content, email addresses or phone numbers, and we remove any we find. Only administrators can read our logs, including the game server logs described in §6.

If you think your account has been compromised, sign out the affected sessions, clients and keys under Profile → Security and contact us.

13. Cookies and local storage

We don’t use advertising, analytics or tracking cookies, so we don’t show a cookie banner. The cookies and storage below are either strictly necessary to provide something you’ve asked for, such as keeping you signed in, or, for the theme, used only to remember how you want our sites to look. The law allows both without consent (PECR Schedule A1, paragraphs 4 and 6).

Name	Where	Purpose and lifetime
`doxbox-theme`	Cookie for doxbox.org and its subdomains, set only when you choose a theme; the website also keeps a copy in your browser’s local storage	Your colour theme. No personal data. The cookie lasts 1 year from your last choice; the local copy stays until you clear it. If you don’t want it remembered, delete the cookie and site data for doxbox.org in your browser.
`connect.sid`	Cookie for api.doxbox.org only	Your Portal session. HTTP-only and secure. First set when you start signing in, to complete the login securely, and replaced when sign-in completes. Expires 30 days after you last use the Portal, or when you sign out.
Sign-in service cookies	auth.doxbox.org	Keep you signed in to our sign-in service so you don’t have to log in to every Dox Box service separately. Cleared when you sign out or the session ends.
Game panel, image board and tabletop cookies	gameservers., booru. and tabletop.doxbox.org	Keep you logged in to those services and remember settings you choose there. The image board’s sign-in cookie stops working after 7 days, and the board keeps your sign-in ID token in your browser’s storage only so it can sign you out of our sign-in service as well.
App and extension storage	Your device	See §5.

14. Age limits

Dox Box membership, and with it the Portal, the Android app, the extension, Dox, the game servers and the community services, is for adults aged 18 or over. Quinn can be used by anyone aged 13 or over who also meets Discord’s minimum age in their country; see “Younger Quinn users” in §4. If we learn that someone below these ages has an account, we will close it and delete the data, keeping only what we need to stop it being recreated or to meet a legal duty. Please tell us at privacy@doxbox.org if you think this has happened.

15. Data breaches

If a personal data breach happens, we will look into it promptly. Unless it is unlikely to put anyone’s rights at risk, we will report it to the ICO (and, where the law requires, the relevant EEA authority) without undue delay and, where feasible, within 72 hours of becoming aware of it; if it takes longer, we will explain why. If the breach is likely to put you at high risk, we will tell you without undue delay, by email, Discord DM or through our Discord server. We keep a record of every breach, including those we don’t have to report.

16. Changes to this policy

When we make a significant change, we publish a new version number and date, and the Portal, the app, the extension, Quinn and Dox show you what has changed, alongside any change to the Terms, before you continue. Small changes, such as corrections, may be made without a notice, but the date above will change. Downloading your data and deleting your account stay available at all times (§9).

17. Contact

Questions, requests and complaints: privacy@doxbox.org, or any administrator in our Discord server.