Privacy Policy

The controller of personal data processed in KiwiHub, meaning the dashboard at kiwi-hub.pl and the Discord bot “KiwiBot”, is the owner of KiwiHub (the “Controller”, “we”).

For anything related to personal data, write to contact@kiwi-hub.pl. We reply within 30 days at the latest.

This policy describes how we process data of:

• people who log in to the KiwiHub dashboard with a Discord account,
• people who use the invite-only tools (Twitch, Kick, Steam, Valorant, Games) in the dashboard,
• members of Discord servers where administrators have added the KiwiBot bot,
• people who contact us through the contact form or by email.

The bot is added to a server by its administrator, who decides which modules to turn on. The administrator of each server is responsible for which features run on that server and for informing its members about them. We provide the tool and keep the data it processes secure.

We have no access to your Discord password or to the email address on your Discord account (we do not request the “email” scope).

If you use the tools unlocked with an invite code, we additionally process:

• the name of the Twitch, Kick or Steam account you added (for Steam also the login name, SteamID, nickname and avatar),
• your Twitch account password, stored only in encrypted form (AES-256-GCM); no staff member can see it in the dashboard,
• session data: Twitch cookies and login token (saved after you authorize at twitch.tv/activate) and the Kick session token you paste in, stored encrypted; for Steam, the login token Steam issues after you log in. Your Steam password is used only for that single login (in encrypted form) and is not stored,
• tool activity logs and statistics: channel points, rewards, running time, reward requests, and for Steam the list of games in your library with playtime and hours collected,
• for Kick chat activity: the history of messages the tool sent from your account (kept for 14 days). The public chat of selected channels is analysed live in server memory and is not stored,
• for Valorant: your Riot account ID (PUUID), name with tag and region, and Riot session cookies stored in encrypted form. You log in yourself in a browser window opened on our server; we do not see or store your Riot password. We also store your skin wishlist,
• for the Games tab: the games you watch and their price history, the wishlist imported from Steam and the list of free games you claimed. If you turn on automatic claiming (GOG, Prime Gaming), the store session is kept in an isolated browser profile on our server; you log in there yourself and we do not see your password. Steam keys you paste for activation are passed to the Steam engine only while they are being activated.

This data is used only to run the features you started yourself. You can delete it at any time by removing the added account from the dashboard or by deleting your whole KiwiHub account (Settings → Privacy and data). Deleting your account stops all tools and erases saved sessions, including those stored outside the database. Daily statistics are kept for as long as your dashboard account exists.

The bot receives from Discord the data it needs to work on a server: IDs and names of users, roles and channels, information about members joining and leaving, voice activity, reactions and the content of messages in channels it can see. Most of this data is processed on the fly and never stored. We only store permanently what the modules turned on by the server administrator require:

• Server logs. If an administrator turns on logs, the bot posts event details (e.g. the content of a deleted or edited message) to the channel the administrator chose. We do not store them in our database.
• Artificial intelligence. The chatbot runs on a language model hosted on our own server. Messages are not sent to outside companies. Conversation history is read from the channel only while the reply is being prepared and is not stored by us. The AI tools an administrator can turn on work the same way: translation (the selected message), summaries (recent channel messages, read while the summary is prepared) and AI moderation (a message plus a few earlier ones for context). Content is not stored; with AI moderation, a message flagged as suspicious is posted as an alert to the server's moderator channel. We only store the daily number of uses per server to enforce the limit.
• Verification and raid protection. Verification state (e.g. a captcha code) is kept temporarily, for a few minutes at most.
• Bot abuse protection. We count how many commands are used on each server (without recording who used them) and keep these counters for 9 days. The per-person command limit lives only in server memory for a few dozen seconds.

Server data is kept for as long as the bot is on the server. When the bot is removed from a server, all of that server's data is deleted automatically after 30 days (this window lets you restore settings if the bot was removed by mistake). The server owner can delete it immediately in the dashboard: Server settings → Danger zone.

A dashboard user can delete their community data from all servers (levels, economy, achievements, activity, birthdays, reminders, highlights, votes and giveaway entries) together with their account. Data administrators need for server security, namely punishments, tickets, modmail threads, confessions with the author ID, roles to restore, temporary roles and the dashboard change history, stays until the server data is deleted or its retention period ends. If you do not have a dashboard account, write to contact@kiwi-hub.pl and include your Discord ID.

When you contact us, we process the name, email address, Discord name and message you provide in order to reply and, if applicable, grant access to the dashboard. Instead of your IP address we store a one-way hash of it, which helps limit spam but does not reveal the address itself. We keep messages for as long as needed to handle your request and then delete them. You can also ask us to delete them at any time.

We process data under Article 6(1) of the GDPR:

• point (b): performing the service you use (login, dashboard, invite-only tools, bot features),
• point (f): our legitimate interest, namely the security of the service, preventing abuse, handling enquiries and pursuing claims, and for server members also the interest of the server administrator who decided to turn on a given module,
• point (c): legal obligations, where they apply.

We do not sell data or use it for advertising. Data may be shared with:

• the provider of the server (VPS) KiwiHub runs on, as a processor acting on our behalf,
• Discord Inc. (login, bot operation), Twitch Interactive Inc. (invite-only tools, stream notifications), Kick Streaming Pty Ltd and Valve Corporation (Steam) (invite-only tools). These companies act under their own privacy policies,
• Riot Games (Valorant, if you connect your account), GOG and Amazon (automatic free game claiming, if you turn it on),
• services that a module turned on by a server administrator connects to: YouTube and RSS feeds (notifications), Top.gg (voting), HenrikDev API and Riot Games (game stats: only the provided nickname is sent), game servers listed in the Server monitor,
• our email provider, if we reply to your message,
• public authorities, where required by law.

Discord, Twitch, Valve (Steam), Riot Games and Amazon are based in the United States and Kick in Australia, so using their services involves transferring data outside the European Economic Area under the terms described in their policies (including standard contractual clauses).

The dashboard uses one essential session cookie (valid for 7 days after you last used the dashboard, at most 30 days after logging in), a cookie that remembers the language version of the site (kiwi_lang, set when you choose a language or use the dashboard in English, valid for one year) and browser storage (localStorage, sessionStorage) to remember small interface settings. We do not use advertising cookies or third-party analytics tools. The site's fonts are served from our own server.

You can delete cookies in your browser settings. Without the session cookie, logging in to the dashboard will not work.

• The connection to the dashboard is encrypted (HTTPS).
• Passwords, tokens and cookies of added accounts (Twitch, Kick, Steam, Riot) are encrypted. The Steam token is held only by the isolated Steam farm engine, which is not reachable from the internet. Server data is accessible only to people with the appropriate permissions on that server.
• We back up the database every day. Backups are kept for up to 14 days; the copy stored off the server is encrypted.
• Deleted data may remain in backups until they rotate, for up to 14 days.

You have the right to:

• access your data and get a copy of it,
• have your data corrected,
• have your data erased (“right to be forgotten”),
• restrict processing,
• data portability,
• object to processing based on legitimate interest.

You can exercise the most important ones yourself in the dashboard under Settings → Privacy and data: download a copy of your data as a JSON file (access and portability) and delete your account together with your data (erasure). For anything else, write to contact@kiwi-hub.pl. We may ask you to confirm that the Discord account belongs to you. You also have the right to lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the supervisory authority in your country.

Providing data is voluntary, but you cannot use the dashboard without logging in with Discord.

We do not make decisions about you based solely on automated processing that have legal effects. Modules such as AutoMod or raid protection follow rules set by the server administrator, who can change their settings or revoke an issued punishment at any time.

The dashboard and the bot may be used by people who meet Discord's age requirements in their country (at least 13 in Poland). People under 16 should use the dashboard with the consent of a parent or guardian. If you believe we are processing a child's data without such consent, contact us and we will delete it.

We may update this policy, e.g. when we add a new feature. The current version is always available at kiwi-hub.pl/en/privacy, and we will announce significant changes in the dashboard.

This is an English translation provided for convenience. If the English and Polish versions differ, the Polish version prevails.