XBGuide Privacy Policy

Data the Discord bot stores

XBGuide stores the minimum needed to work:

• Account link (only if you link one): your Discord user ID, your Xbox gamertag, and your Xbox user ID (XUID). With /link set, a short code and its expiry are stored while you verify, then cleared. With Link with Discord on xbguide.com/link, XBGuide asks Discord for your user ID, name and connected accounts, reads the Xbox connection once, and revokes the Discord sign-in straight away: no Discord token is kept, and no other connection is stored. A short-lived cookie on /link checks that the sign-in finishes in the browser that started it.
• Preferences: your saved card theme and custom accent color, and your timezone if you set one for game nights.
• Game nights: when someone plans one with /gamenight, the server, channel and post it lives in, the host's Discord user ID, the game, time, note and player slots, and each person's answer (going, maybe, can't) with their Discord user ID. At the start, XBGuide checks the Xbox online status of linked players who said they are going, and at the end the achievements they unlocked for that game during the night, for the recap.
• Feedback: messages you voluntarily submit with /feedback, along with your Discord user ID and the server ID, so we can follow up.
• Usage counts: anonymous per-command totals. A number per command, with no user information attached.
• Votes: if you vote for XBGuide on top.gg, your Discord user ID and the time of the vote. This is used only to give you reduced command cooldowns and the supporter card themes for 12 hours, and to count votes in total.
• Supporter status: if the bot owner grants you supporter perks, your Discord user ID, the date it was granted, an optional expiry and a short note.
• Card templates: if you are a supporter and save templates in the card builder, your Discord user ID, each template's name and settings, its share code, whether it was submitted for review, and whether you asked to be credited. Official templates are shown in the public gallery at xbguide.com/templates. Your linked gamertag appears next to one only if you choose Credit me in the gallery; you can turn that off in the builder at any time, /link remove removes it, and a gamertag you asked XBGuide to hide is never shown.
• Gamerscore history: one gamerscore number per day for a gamertag, recorded when that gamertag is looked up through the bot or the website. It powers the "+G since" line on gamer cards. Nothing else about the lookup is kept.

API keys

If you are issued a key for the public API, we store a one-way hash of it, the first few characters so it can be identified, the label it was issued under, how many calls it has made, and when it was last used. The key itself is never stored, so it cannot be recovered or leaked from our database - if you lose it, it has to be replaced.

Data servers store

If a server manager uses /settings, XBGuide stores that server's ID and the channel IDs chosen to receive Xbox outage alerts, Game Pass updates, deal alerts or XBGuide update announcements, plus the deal threshold. No message content is stored. /settings alerts-off, /settings gamepass-off, /settings deals-off and /settings updates-off remove these.

Data the website stores

• The site keeps no accounts and no analytics. The only things written to disk are the daily gamerscore number described above, the templates supporters save in the card builder, invite click counts, and the saved Xbox lookups and images described below.
• Invite click counts: when someone follows an "Add XBGuide" link, the site adds 1 to a daily count for where the link was (for example a card posted in Discord, or a bot listing site). Only the count is kept: no IP address, no user and nothing about who clicked.
• Player outage reports: when you report a problem on xbguide.com/status or with /report, the site adds 1 to a count for that kind of problem in that 10-minute window. Nothing about who reported is kept: to stop repeat reports, your Discord ID or IP address is held in memory for 30 minutes and never written down.
• Partner link clicks: the site shows an ad for a partner Discord server, labelled "Partner". Its Join link adds 1 to a daily count for that partner before sending you on. Only the count is kept, the same as invite clicks. The card's picture, banner and member counts are fetched by XBGuide from Discord's public invite details, so your browser does not contact Discord until you press Join. The partner's own server is run by them, not XBGuide.
• IP addresses are held briefly in memory to enforce rate limits and are never saved to disk or shared.
• Cookies, only in three places. If you enter the access code at /dev, a cookie is set so you stay signed in for 30 days. It contains an expiry timestamp and a signature, nothing else. If you are a supporter and open the card builder from Discord with /builder, a cookie is set so you stay signed in for 7 days. It contains your Discord user ID, an expiry timestamp and a signature. If you use Link with Discord, a cookie holding a random value lasts up to 10 minutes and is deleted when the sign-in finishes. Each cookie is scoped to its own area (/dev, /builder or /link), so none is sent when you browse the rest of the site. Ordinary visitors never receive a cookie.
• Looked-up Xbox data (profiles, games, achievements) is served from a saved copy for a few minutes to reduce load on the Xbox API. It is kept for up to 8 days so cards keep working while Xbox Live is busy or down, and a card built from an older copy says so. This is public Xbox Live data, the same information visible on a public Xbox profile.
• Game box art and gamerpics are saved as small image files so cards draw quickly. They are the public images Xbox serves to anyone, and the oldest are deleted once the folder reaches its size limit.
• Player pages and the public API (/player/..., /badge/..., /api/player/...) serve only public Xbox Live data for the gamertag requested.

Data XBGuide does NOT store

• Discord message content or server content
• Xbox or Microsoft credentials of any kind
• Xbox profile data at rest, apart from the daily gamerscore number above. Profile, achievement, presence and store information is fetched live and held only in short-lived in-memory caches.

Service monitoring

XBGuide records the results of its own checks against public Xbox service endpoints: whether a hostname resolved, whether a connection succeeded, response time, and the resolved IP address of the Microsoft service. This is infrastructure data about Microsoft's servers and contains no user information.

Resolved addresses are kept only so that a service moving can be detected. They are never published: the Xbox 360 archive reports that a service changed address and when, not what the address was.

Where data lives and how long it is kept

Stored data lives in a private database on the bot's hosting provider. Automatic backups are taken daily, stay on that same private storage, and the most recent 7 are kept before older ones are deleted. Backups are never copied anywhere else.

How long things are kept:

• Account links and preferences: until you remove them with /link remove.
• Feedback messages: 180 days, then deleted automatically.
• Vote records: 90 days, then deleted automatically.
• Gamerscore history: 400 days, then deleted automatically.
• Supporter grants: until revoked or expired.
• Card templates: until you delete them in the builder or run /link remove. Templates picked as official XBGuide templates stay available to everyone, but are no longer linked to you.
• Service monitoring history: 90 days.
• Invite click counts: 400 days, then deleted automatically.
• Partner link click counts: 400 days, then deleted automatically.
• Game nights and their answers: 30 days after the night ends, then deleted automatically.
• Player outage report counts: 30 days, then deleted automatically.
• Saved Xbox lookups: 8 days, then deleted automatically. Saved images are deleted oldest first once they reach 200 MB.
• Server settings: until the server removes them or the bot leaves.

Data is never sold or shared, and is used only to operate XBGuide.

Third-party services

• OpenXBL (xbl.io): fetches public Xbox Live data. Gamertags you look up are sent to this API.
• Discord: the bot operates on Discord's platform under Discord's own privacy policy.
• Microsoft: the public product catalog is queried for game titles and US pricing. No user information is sent.
• Railway: hosts the bot and website.
• Cloudflare: sits in front of xbguide.com and processes requests to it, including IP addresses, under its own privacy policy.
• top.gg: if you choose to vote for XBGuide there, top.gg tells us your Discord user ID.

Removing your data

• /link remove immediately deletes your account link, your saved card preferences, your gamerscore history and your card templates. Official templates you made stay published but are no longer linked to you.
• /settings ...-off removes a server's alert channel settings.
• To request deletion of feedback messages, vote records, or anything else, use /feedback, or the support server linked in /about.

Removing a player page

xbguide.com can build a page for any gamertag someone looks up, including one belonging to a person who has never used XBGuide. If you would like your gamertag removed, ask through /feedback or the support server linked in /about.

Once removed, the player page, gamer card, signature badge, API lookup and the gamertag/XUID converter all stop returning anything for that gamertag, any cached copy is cleared immediately, and the gamerscore history for that gamertag is deleted. Player pages are also served with a noindex instruction to search engines, so they are kept out of search results.

Children

XBGuide does not knowingly collect data from children under 13. Discord requires users to be at least 13.

Changes

If this policy changes materially, the updated version will be posted here with a new "last updated" date.

XBGuide is a fan-made project and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation or Xbox.