Trust, Privacy & Legal Center

This Privacy Policy details how Kirby & Co. ("we", "us", "our") collects, processes, and protects personal data when you interact with our web services at kirbyco.xyz, the TagBot Discord bot suite, and the Ban Appeals Portal located at kirbyco.xyz/appeal.

We operate in compliance with international privacy legislation, including the United States CCPA/CPRA, COPPA, the United Kingdom Data Protection Act 2018 (UK GDPR), and the European Union General Data Protection Regulation (EU GDPR).

Kirby & Co. acts as the Data Controller. Because our community and bot platform operates within the Discord ecosystem, all statutory data subject inquiries, deletion requests, and privacy questions are processed directly via verified tickets:

A. Information You Voluntarily Provide:

• Discord OAuth2 Identity (Ban Appeals): When you log into /appeal, we request standard read-only scopes (identify, guilds.members.read). We receive your Discord Snowflake ID, username, discriminator, and public avatar hash. We do not receive or store your email address, passwords, or direct messages.
• Ban Appeal Statements: Statements, explanations, and rule acknowledgements you submit in the appeal form.
• Community Art Attribution: Artist handle, Discord User ID, and artwork title displayed in the live showcase for credit.

B. Automated Security & Telemetry Data:

• Salted Cryptographic IP Hashes: Incoming network connections to protected endpoints are salted and converted into one-way cryptographic SHA-256 hashes. Raw IP addresses are never saved in plain text database tables.
• Session Security Cookies: An encrypted, HttpOnly, SameSite=Lax cookie (kirby_appeal_session) is used solely to maintain verified OAuth2 session state with CSRF protection.
• Aggregated Performance Insights: Vercel Speed Insights collects anonymized, aggregated page load metrics without third-party tracking pixels.

Under GDPR and UK DPA 2018, our processing is grounded on:

• Legitimate Interests (Art. 6(1)(f)): Mitigating automated bot attacks, enforcing community bans, and safeguarding platform uptime.
• Consent (Art. 6(1)(a)): Explicit authentication via Discord OAuth2 to access the ban appeal workflow.
• Performance of Terms (Art. 6(1)(b)): Adjudicating submitted ban appeals and maintaining community moderation records.

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to opt-out of the sale or sharing of their personal information.

Kirby & Co. does NOT sell, rent, trade, or monetize personal information. We do not share data with third-party advertising networks, cross-context behavioral ad trackers, or data aggregators.

We rely on industry-standard cloud infrastructure partners:

• Vercel Inc. (USA): Global edge serverless hosting, DDoS protection, and privacy-preserving performance telemetry.
• MongoDB Atlas / MongoDB Inc. (USA): Cloud database with TLS 1.3 in-transit and AES-256 at-rest encryption.
• Discord Inc. (USA): OAuth2 authentication and API member status queries.

You hold comprehensive rights regarding your data:

• Right to Erasure ("Right to Be Forgotten"): Request complete deletion of your appeal records or art metadata.
• Right of Access & Portability: Request a copy of the stored data linked to your Discord User ID.
• Right to Rectification: Request correction of inaccurate moderation or appeal records.
• Non-Discrimination: We never deny service or degrade features for exercising statutory privacy rights.

To exercise your rights, use our Discord Ticket Helper to generate a formatted request, then submit it at discord.gg/9mWA66apdj.

Kirby & Co. and TagBot adhere to the Children’s Online Privacy Protection Act (COPPA) and international digital age requirements. Our services are strictly intended for users aged 13 or older (or 16 where required by local European law).

If we discover that a user under 13 has submitted personal information, we will immediately delete that information from all active databases.