Privacy Policy

LFG Bot is a Discord bot that recommends games for your group based on what everyone owns and what you're in the mood for. To do that it has to hold some data about you. This policy explains exactly what it collects, why, who it's shared with, how long it's kept, and the control you have over it — including how to have it deleted.

LFG Bot is operated by Vee Squared Ventures, a business based in Portland, Oregon, USA ("we", "us"), which is the data controller for the information described here. LFG Bot is not affiliated with Discord, Valve, or Steam. By adding the bot to a server or linking your Steam account, you agree to this policy and to the Terms of Service.

1. What we collect

We collect only what the bot needs to function:

• Your Steam ID and a cached copy of your Steam library. Pulled after you connect your account — by signing in through Steam with /lfg-bot link, or via /lfg-bot friend — so the bot can recommend games your group owns. Linking goes through Steam's own sign-in, so only an account you control can be connected. We read your owned-games list — not your Steam password, payment details, or private messages.
• Your Discord identity. Your Discord user ID and display name, and the servers you share with the bot.
• Your activity in the bot. Your votes, RSVPs and roster membership, feedback ratings, MVP votes, per-session mood picks, your chats with the bot (in @mention and game-night sessions), and any lore or "canon" quotes that name you.
• Onboarding & funnel analytics. A small stream of events recording how people move through setup (e.g. linked, activated). Your Discord user ID is pseudonymized before it's written — replaced by a salted one-way hash — so the stream is usable only in aggregate to understand where onboarding gets stuck, and isn't directly tied to your identity. See Retention for how long it lives.
• Aggregate cost-accounting. Per-session, per-server records of AI-model usage cost, kept for billing and abuse prevention. These carry no user identifier — there is no per-user row.

We do not collect your Steam password, your Discord password, your email address, your IP address for tracking, or any payment information. The bot is free.

2. Why we collect it (lawful basis)

Under the GDPR we rely on two lawful bases:

• Performance of the service / legitimate interest. The bot cannot recommend games your group owns without reading libraries and identifying who's in a session. This processing is what you asked the bot to do.
• Consent. Linking your Steam account is a voluntary action you take, authenticated through Steam's own sign-in. Your library only feeds a given server after you activate it there — a separate one-tap consent step per server. You can withdraw at any time (see Your rights).

3. Who we share it with (subprocessors)

We do not sell your data and we do not share it with advertisers. To run the service we use the following subprocessors, each acting on our behalf:

Some of these providers are based in the United States, so your data may be processed there. We rely on the providers' own data-transfer safeguards.

4. How long we keep it

• Most data is kept while you use the bot — your link, library, and session history persist until you delete them (see Your rights) or until the bot is removed from the server.
• Lore / "canon" is kept as a long-term memory feature. The group lore the bot builds up has no fixed expiry — it's part of how the bot remembers a server over time. Erasure removes the lore where you're the speaker or the subject (see what erasure removes); short of that, lore is retained by design.
• Game-night chat transcripts are kept for about 30 days. When the bot runs a /start game-night session it stores a copy of that session's chat with the bot (and the prompt snapshots built from it) in our systems. We delete that copy roughly 30 days after the session's last message. The results of the session — poll outcomes, star ratings, the MVP winner, who attended, and what each person voted for — are kept so your session history still renders.
• Messages you post in your Discord server stay on Discord. The 30-day window above covers our own stored copy. The messages, threads, and channels in your Discord server live on Discord under Discord's terms and your server's control — we don't delete your server's Discord message history.
• Onboarding & funnel analytics auto-expire. These events live in an append-only stream (Cloudflare Analytics Engine) that cannot be edited after the fact. Each event is automatically purged after the provider's retention window — three months. For this one stream we rely on that time-bounded expiry rather than on-demand deletion.

5. Your rights & how to exercise them

You can see, export, or delete your data yourself, right from Discord — run /lfg-bot privacy and pick Export my data or Delete everything. Email is always available as a fallback.

• Unlink (do it yourself, any time). /lfg-bot unlink removes your Steam link and cached library immediately. Note this stops the bot reading your library but does not remove your past activity — for that, use erasure below.
• Erasure (right to be forgotten). Run /lfg-bot privacy → Delete everything to delete everything the bot holds about you, across every server. Erasure is irreversible. You can also request it by emailing privacy@lfg-bot.com. See what erasure removes below.
• Access & export. Run /lfg-bot privacy → Export my data to get a machine-readable copy of the data we hold about you, delivered in Discord. Or request it by emailing the same address.
• Withdraw consent. Unlinking, or removing the bot from a server, withdraws your consent going forward.

/lfg-bot privacy is the self-service route — export and delete your data without contacting anyone. Email is the fallback if you'd rather, or if a self-service request reports it couldn't finish.

6. What erasure deletes — and what it doesn't

We keep this precise on purpose: we don't claim to delete things we can't.

What erasure DELETES

Across every server the bot shares with you:

• Your Steam link and cached Steam library.
• The Steam friendship with the bot, if you connected via /lfg-bot friend — the bot account removes you from its friends list, so your Steam ID is no longer reachable through it.
• Your per-server membership and activation record, and any UI-hint counters.
• Lore / "canon" quotes where you are the speaker or the subject — deleted outright, not anonymized-and-kept. Because a quote can contain your name or handle, the whole entry is removed (so the group loses those particular quotes when you erase).
• Your votes, RSVP / roster membership, feedback ratings, MVP votes, and per-session mood picks across every game-night session.
• Your @mention conversations with the bot (the whole log).
• Your MVP leaderboard records.

What erasure does NOT delete (and why)

Where a retained record still carries an identifier pointing at you, we say so — we don't call it anonymous when it isn't:

• Aggregate AI cost-accounting rows carry no user identifier, so there is no per-user row to delete.
• Onboarding / funnel analytics events no longer store your Discord user ID — it's replaced by a salted one-way hash before writing, so there's no per-user identifier left to delete. They also live in an append-only stream that can't be edited after the fact and auto-expire regardless (see Retention).
• Operational logs. We keep short-lived diagnostic logs to run and debug the service. Person-level identifiers in them are pseudonymized — replaced by the same salted hash — and the logs age out on a short operational schedule rather than being deleted on request.
• A few integrity audit records (e.g. who removed a different user's lore entry) are kept, but with your identifier replaced by an anonymous marker — they no longer point at you.
• Shared session transcripts. Game-night sessions keep a turn-by-turn transcript of the group's chat with the bot. Turns that mention you by handle are redacted, but because turns aren't attributed to an author, a message you wrote that doesn't name you can't always be singled out from the group's conversation. The lore the bot extracted from those conversations is deleted outright (above).

7. Departed servers

When the bot is removed from a server, that server's data is cleaned up. A few per-session records may persist briefly until they age out automatically. A specific person's erasure request always reaches every session immediately.

8. Children

LFG Bot is not directed at children. You must meet Discord's minimum age (13, or older where local law requires) to use it.

9. Changes to this policy

We may update this policy as the bot evolves. Material changes will be reflected by the effective date at the top. Continued use after a change means you accept the updated policy.

10. Contact

Questions, or want to exercise any of the rights above? Email us at privacy@lfg-bot.com.