Discorduo by Creole AIPrivacy Policy
1. Who we are
Discorduo (“we”, “us”) is a Chrome browser extension, together with this website and a licensing service, operated by Creole AI (“Company”). The extension lets you export a Discord conversation that you can already open in your own browser and analyze the saved messages locally. For privacy questions or requests, email [email protected].
Discorduo is independent software. It is not affiliated with, endorsed by, sponsored by or connected to Discord Inc. “Discord” is a trademark of its owner and is used only to describe what the extension works with.
Summary
- Your chat messages stay on your device. They are fetched from Discord straight into your browser, stored in your browser’s local database (IndexedDB) and analyzed there. We never receive them.
- Your Discord login token never leaves your browser. It is held in the Discord page’s memory only to request messages from Discord. It is not saved by the extension, not written into exports, and not sent to us or anyone else.
- Our servers only handle account and licensing data: your Google sign-in details (email, name, Google account ID), a random device ID, the plan you bought, and a counter of export tasks (a random task ID and date, no content) used to enforce plan limits.
- We do not sell personal data, show ads, or use any analytics, telemetry or tracking in the extension or on this website.
2. What stays on your device
When you export a conversation, the extension (running on discord.com only) requests the message history of the channel you chose, using your signed-in Discord web session. The following is stored only in your browser, in IndexedDB or chrome.storage.local, and is never uploaded to us:
- Messages and related content from the exported channel: message text, timestamps, author names and IDs, mentions, reactions, reply references, embeds, and attachment links (files themselves are not downloaded; Discord’s links may expire). This content can include other people’s messages and personal data; see section 10.
- Task information: channel identifiers, task progress, counters and settings.
- Licensing state: your random device ID and device secret (see section 3), a sign-in session token for our licensing service, a cached signed plan/entitlement token, and the link to your last order page.
Exports (HTML, CSV, JSON, Markdown) and saved analysis reports are generated in your browser and saved through Chrome’s download feature to a location you choose. Charts and analytics are computed locally. Uninstalling the extension removes its stored data from your browser, and you can delete all saved tasks and messages at any time with the “clear” action in the extension. Files you have downloaded are yours and are not removed by either.
Your Discord token
The extension runs a script inside the Discord web page. To request message history on your behalf, it picks up the authorization value that the Discord web app itself uses (from the app’s own requests to Discord, or from the web app’s own local browser storage) and keeps it in a JavaScript variable in the page’s memory. It is used only for read-only requests to https://discord.com/api for the channel you chose to export, and it is discarded when the page is closed or reloaded or when Discord rejects it. The token is not written to extension storage, IndexedDB, export files or reports, and is not transmitted to us or to any third party. Your messages travel directly between Discord and your browser; Discord’s own privacy policy applies to that exchange.
3. What we collect and store on our servers
The extension contacts our licensing service only for sign-in, plan checks, purchases and task allowances. No message content, channel names, server names, Discord user names, Discord IDs or Discord tokens are included in these requests.
| Data | Why we need it |
|---|---|
Google account data, if you sign in with Google: Google account identifier (“sub”), verified email address and display name. Requested scopes: openid email profile. | To create and recognize your Discorduo account and tie your plan and allowance to it. |
| Device data: a random device ID generated by the extension, and a SHA-256 hash of a random device secret (the extension sends the secret with each request; we store only the hash). | To authenticate requests from your installation and bind sessions and licenses to it. |
| Session data: a hash of your sign-in session token, the device it belongs to, and its expiry (7 days). | To keep you signed in. |
| Task allowance records: a random task ID, your account ID, the billing period, the message cap for your plan and a creation time. Nothing about the channel or its contents. | To enforce plan limits (e.g. tasks per day/month). |
| Order and billing records: order ID, plan, amount and currency, status, Paddle transaction / subscription / customer identifiers, payment and refund event identifiers, subscription status and paid-until dates. We do not receive your card number. | To activate, renew, cancel or revoke your plan, handle refunds, and meet tax and accounting obligations. |
| Temporary sign-in values (OAuth state, nonce and PKCE verifier), kept for about 10 minutes and removed when the sign-in completes or expires. | To complete Google sign-in securely. |
| Technical data: your IP address and request metadata. The service keeps IP addresses in memory briefly to rate-limit registrations; our hosting provider (Cloudflare) may also keep standard request logs for 30 days. | Security, abuse prevention and reliability. |
The signed plan token that the extension caches contains your device ID, account ID, plan, and an expiry time. It lets the extension keep working for a limited time while our service is unreachable.
What we do not collect: chat messages or attachments; Discord tokens, passwords or user data; browsing history or activity on sites other than discord.com; keystrokes or clicks; analytics, advertising or crash-report data. This website does not set cookies or use analytics. Paddle’s hosted checkout page, which is operated separately, may set its own cookies.
4. How we use data and legal bases
We use the data above only to provide, secure and bill for the service. Legal bases (GDPR/UK GDPR): performing our contract with you (account, licensing, plan enforcement); our legitimate interests (security, abuse and fraud prevention, support); legal obligation (tax, accounting); and, where you choose to use it, consent for Google sign-in. We do not sell personal data, do not share it for advertising, and do not use it for profiling, credit decisions or any purpose unrelated to the features above.
5. Payments
Paid plans are sold by Paddle.com Market Limited (“Paddle”) as merchant of record. Checkout takes place on a Paddle-powered web page, not inside the extension. Paddle collects and processes your payment and billing details under Paddle’s privacy notice. We receive order, plan and subscription status (including identifiers) from Paddle so we can activate or revoke your plan.
6. Sharing and service providers
We share data only with: Paddle (payments, as above); Google (sign-in; Google receives the sign-in request, and we receive the identity details in section 3); our hosting provider Cloudflare (runs the licensing service); and authorities or advisers where required by law or to protect our rights. We do not sell or rent personal data. Some providers may process data outside your country; where required we use appropriate safeguards (such as standard contractual clauses) — [TRANSFER MECHANISM DETAILS].
7. Retention
- On your device: until you clear it in the extension or uninstall the extension.
- Account, device, session and allowance records: while your account is active and and until you ask us to delete it, after which it is deleted or anonymized within one month. Sessions expire after 7 days.
- Order and billing records: as long as tax and accounting law requires.
- Technical logs: 30 days.
8. Your rights and choices
Depending on where you live (for example under the GDPR / UK GDPR, or the CCPA/CPRA), you may have the right to access, correct, delete, restrict or port your personal data, to object to processing, to withdraw consent, and not to be discriminated against for exercising rights. To exercise them, or to delete your Discorduo account and the server-side data in section 3, email [email protected] from the email address of your account. We will verify your request and respond within one month (or the period required by law). Records we must keep by law (e.g. invoices) may be retained. You can also sign out, clear local data, revoke Discorduo’s access in your Google account permissions, or uninstall the extension at any time. Because we never hold your messages, there is nothing to retrieve or delete from our servers about them. You may complain to your local data-protection authority.
9. Security
Requests between the extension and our licensing service use HTTPS. Device secrets and session tokens are stored only as hashes, plan tokens are cryptographically signed, Google sign-in uses the authorization-code flow with PKCE and nonce verification, and payment webhooks are signature-checked. No system is perfectly secure; if a breach affecting your personal data occurs we will notify you and regulators as required by law.
10. Other people’s content and Discord’s terms
Exports may contain messages and personal data of other people. You are the one who decides what to export and are responsible for having the right to access and keep it, and for how you store and share exported files. Using unofficial tools with Discord may be restricted by Discord’s own terms and policies; see our Terms.
11. Children
Discorduo is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has provided data to us, contact us and we will delete it.
12. Chrome Web Store and Google user data (Limited Use)
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Discorduo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google account information (email, name, account ID) only to provide and improve the user-facing sign-in and licensing features described in this policy.
- We do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition with notice to you.
- We do not use or transfer it for advertising, including personalized or retargeted ads, and do not sell it.
- We do not allow humans to read it except with your consent, for security or abuse investigation, to comply with law, or when aggregated and anonymized for internal operations.
- We do not use user data or the content of your Discord conversations to determine creditworthiness or for lending purposes, and we do not use it to train AI models.
13. Changes
We will post updates on this page and change the “Last updated” date. If a change materially affects how your data is handled, we will notify you in the extension or by email before it takes effect.
14. Contact
Creole AI, [COMPANY ADDRESS] · [email protected]. [EU/UK REPRESENTATIVE OR DATA PROTECTION OFFICER, IF REQUIRED]