Privacy

Your account and the service

When you sign in with Discord, Bruma uses your ID, name and avatar, the servers you can access and their permissions to display the dashboard and authorise its controls. The service retains the authorisation and session data needed to maintain that access.

Music playback requires information about the server and voice channel, the current queue and song metadata: title, artist, duration, link, image and who requested it. Server settings, playlists and favourites that you explicitly save are retained to provide those features.

Data you choose to save

Audio presets, listening sessions and folders you choose to save are linked to your account so you can retrieve them later. They may include names, filter and volume settings, song metadata and the queue you choose to save; audio files are not stored. These saved items are independent of automatic statistics recording and can be deleted through their controls.

Automatic activity recording

When automatic recording is enabled, Bruma may save statistics and history linked to your account and the servers where it is used:

• Message and reaction counts, time spent in voice, channels used and activity dates.
• Command usage and bot actions, with user and server IDs, name, avatar, action details and time.
• Songs played, listening time, and song and artist metadata for listening history and music statistics.
• Dashboard access counts and dates. The sign-in session is managed separately from these statistics.

These records support the dashboard's statistics and activity feed, subject to access permissions. To handle music requests and commands, Bruma processes data sent through slash commands, buttons and forms, and the content of messages that directly mention it. It works without privileged Message Content, Server Members or Presence intents; message counters use events and identifiers without reading conversation text.

Exclude your account from automatic recording

Sign in, open your profile and turn off “Automatically save statistics and history”. The dashboard only confirms the state after receiving the server's response. If an error appears or the change is still pending, check the setting again.

You can also manage this in Discord: use /privacy seguimiento accion:desactivar to opt out, /privacy seguimiento accion:activar to resume recording activity, or /privacy seguimiento accion:estado to check your preference. If you omit accion, the current state is returned. This command uses your Discord interaction to identify your account and does not need the Message Content intent. /privacy policy shows the service's policy.

Turning this off stops Bruma from adding new statistics, listening history and automatic activity entries linked to your account, including your new contributions to derived aggregates. The preference applies to your account across all Bruma servers, is stored by the service and survives restarts. You can turn it back on.

Opting out does not delete previously saved data. It also does not disable music, controls, playlists or favourites that you explicitly save. Data required for the session, permissions, voice connection, queue and playback recovery continues to be used to provide the service.

Discord still sends events to the bot and its library may temporarily keep data in memory. This setting stops the automatic records described above; it does not change the application's data permissions or automatically clear those Discord caches.

Sessions, storage and retention

The dashboard uses session cookies and browser storage to maintain access and playback state. Technical logs help diagnose errors, protect the service and monitor its load; turning off personal statistics does not prevent these necessary operations.

Your chosen language is kept as a functional browser preference and, when allowed, in a cookie for one year. It is not used for advertising or activity profiling.

The database does not have a general automatic deletion deadline for all records. Data and previous history may remain until deleted through the available controls or in response to a support request.

Daily application logs, resource samples and automatic VPS backups are retained for 14 days. Docker's technical output rotates by size, with up to three 10 MiB files per container; that size limit does not mean a 14-day retention period.

Current automatic backups are created only on the VPS; they are not automatically downloaded to the operator's computer. Private historical backups previously created on that computer are retained without automatic deletion after 14 days. Deleting a record from the active database does not immediately remove it from an earlier backup; deletion requests must also account for those backups.

The service database and the bot's Spotify authorisation are stored encrypted. Private backups are also encrypted, using a separate key. Keys are kept separately from backups; operational access is limited to the project owner.

External visitor measurement through Clarity or Google Analytics is not enabled in the published configuration. The profile's recording preference concerns Bruma's internal records.

Google ads are not currently displayed and their advertising code is not loaded. The website contains public Search Console and AdSense verification tags and an ads.txt file identifying the site and its publisher. These tags do not mean Google has approved the site. If advertising is enabled in future, this policy will be updated and the relevant consent options prepared before that code loads.

Collections and session codes

When you choose a design, we save its identifier and the account or server it applies to. Gifts retain recipient, product, source, date, expiry and revocation to verify access and resolve issues. Returning to the classic appearance removes the selection; it does not erase the gift record or change a subscription.

Sharing a session is optional. A code lets another signed-in account view its tracks and settings while it remains valid. It includes no audio or requester identities. We store a code hash, its creator and a session reference, not the readable code. Revoke it in Studio; deleting your personal library also removes its codes. Do not share a code if you do not want others to view that session.

External AI is disabled in this release. If enabled later, the chat will request consent for the named provider before sending messages and recent context. Quota counters contain no chat text and old entries are cleaned when new requests are reserved. Help and documentation search do not require AI or send queries to a provider.

External services and integrations

Discord and music sources process data under their own policies. The website may load images, icons or fonts from external services, which receive the connection information needed to handle those requests.

Spotify links provide song metadata; audio is found through available sources. Personal Spotify account linking, Last.fm and AI features remain disabled in this version.

The voluntary support link opens PayPal in another tab. PayPal handles the amount, confirmation and payment details. Bruma does not request or store bank or card details. For subscriptions, PayPal receives the plan and a random purchase reference linked to your account within Bruma. We retain your Discord ID, plan, server assignments, subscription, payment and notification IDs, amounts, currency, status and dates to verify charges, renewals, cancellations and refunds. We do not store complete notification payloads, card details, addresses or the payer's name returned by PayPal. These billing records are managed separately from listening history and the automatic statistics setting.

Accessing or deleting earlier data

You can sign out and revoke Bruma's authorisation from Discord's authorised applications. To request access to, correction or deletion of previous data, and ask how this applies to backups, contact Jaramiyo through the support page. Include your Discord account and what you need; do not publish passwords, tokens or payment details.