Privacy Policy

Your privacy is important to us. This Privacy Policy explains how CUB SOFTWARE ("we," "us," or "our") collects, uses, discloses, and safeguards your information when you use our services.

1. Introduction

Who we are. The Services are run by CUBSOFTWARE, based in New Zealand. For data protection law, we are the "controller" (in New Zealand, the "agency") responsible for your personal information. Contact us at privacy@cubsoftware.site.

CUB SOFTWARE is committed to protecting your privacy and handling your data with transparency. This Privacy Policy applies to all services provided by CUB SOFTWARE, including our website (cubsoftware.site) and its subdomains (such as dashboard, obs, rewards, servers, radio, twitch and status), our URL shortener (cubsw.link), our Discord bots, the CUB Studio desktop application, and all online tools and applications (collectively, the "Services"). QuestCord (questcord.fun) also has its own privacy policy, which covers the game and its website in more detail.

This policy explains what we collect, why, the legal basis for it (section 4a), how long we keep it and your rights. Where we rely on your consent (for example optional cookies or a voice recording), you can withdraw it at any time.

2. Services Covered

This Privacy Policy applies to all CUB SOFTWARE services including:

• CUB Protector, CleanMe, QuestCord — Discord bots
• CubReactive, CubPresence, Multi-Twitch, Stream Overlays, CubDeck — Streamer tools
• StreamerBot Commands, Permission Calculator, Embed Builder, Webhook Sender, Timestamp Generator — Discord/streamer utilities
• Social Media Saver, File Converter, Image Editor, PDF Tools, Video Compressor, Audio Trimmer — Media tools
• Resume Builder, Invoice Generator, Markdown Editor, Notepad, Sticky Board, Text Tools, Countdown Maker — Productivity tools
• QR Code Generator, Color Picker, Unit Converter, Currency Converter, Calculator Suite, Password Generator, Timer Tools, World Clock, Wheel Spinner, Random Picker — Generators & converters
• Link Shortener (cubsw.link) — URL shortening service
• CubVault — Client-side encrypted password manager
• JSON Formatter, Timestamp Converter, Encoding Tools, Diff Checker, Regex Tester, Code Minifier — Developer tools
• CleanMe Website — Server template sharing platform
• CUB Radio (radio.cubsoftware.site) — 24/7 community radio with song requests from Discord and the web
• CUB Jukebox & CUB Greenscreen (twitch.cubsoftware.site) — Twitch channel-point tools for streamers
• CUB Rewards (rewards.cubsoftware.site) — Giveaways and campaigns
• Server Pages (servers.cubsoftware.site) — Optional public pages for Discord servers using CUB Protector
• CUB Studio — Desktop streaming application, its website (obs.cubsoftware.site), theme and plugin marketplace, cloud settings backup and Discord bridge
• CUB AI — voice and chat assistant inside CUB Protector, on servers that have it switched on
• CUB Games — Browser games with public leaderboards and a Twitch group mode
• Public Profiles — Optional profile pages you build and publish
• Developer API — Free public API endpoints
• Status Page (status.cubsoftware.site) — Service status and uptime history
• Affiliate Program, Vanity Profiles — Platform services
• Admin, monitoring and mail tools — Used by authorised CUB SOFTWARE staff only

3. Information We Collect

3.1 Information You Provide Directly

• URLs and Content: URLs you submit for downloading, shortening, or processing
• User-Generated Content: Resumes, invoices, sticky notes, server templates, profiles, images you upload, themes and plugins you publish, and other content you create
• Account Information: When authenticating via Discord OAuth, we receive your Discord user ID, username, avatar, and guild (server) list
• Song Requests: The link you submit to CUB Radio or CUB Jukebox, and the name shown with it
• Giveaway Entries: The actions you complete when entering a CUB Rewards campaign
• AI Conversations: What you say or type to CUB AI
• Communications: Email address and message content when you contact us
• Reports and Appeals: Information you provide in a report, or in an appeal against an IP ban (the address, an optional name and contact detail, and your explanation)

3.2 Information Collected Automatically

• IP Address: Your IP address is collected for security, abuse prevention, rate limiting, and analytics purposes
• Browser Information: Browser type, version, and user agent string
• Device Information: Operating system and device type
• Usage Data: Pages visited, features used, download counts, click statistics on shortened links
• Timestamps: Date and time of your activities
• Referrer Information: The website that referred you to our Services

3.3 Information from Third Parties

• Discord: User ID, username, avatar URL, and guild list (when you authenticate via Discord OAuth)
• Twitch: User ID, login name, display name, and profile image URL (when you authenticate via Twitch OAuth)
• Google / YouTube: Read-only YouTube access, only if you connect Google so CUB Rewards can check a YouTube giveaway action (for example a subscription)
• Steam: Your Steam ID, only if you connect Steam for a CUB Rewards action. CUB PROTECTOR's /steam commands read public Steam profiles that someone pastes in, through Steam's own Web API, and keep nothing they read beyond a few minutes' cache
• Buy Me a Coffee: The public names of supporters, shown on our homepage
• Social Media Platforms: Publicly available media metadata when you use our download tools

4. How We Use Your Information

We use collected information for the following purposes:

• Service Delivery: To provide, operate, and maintain our Services
• Improvement: To understand how users interact with our Services and improve functionality
• Security: To detect, prevent, and address technical issues, fraud, abuse, and security threats
• Abuse Prevention: To enforce rate limits, prevent spam, and ban malicious users
• Communication: To respond to your inquiries and support requests
• Legal Compliance: To comply with applicable laws, regulations, and legal processes
• Statistics: To generate aggregate, anonymized statistics about Service usage

4a. Legal Bases for Using Your Information

Under the EU and UK GDPR (and similar laws), we use your information only on these bases:

• To provide what you asked for (contract): running the bots, tools, accounts and features you choose to use
• Legitimate interests: keeping the Services secure, stopping spam and abuse, fixing faults and understanding usage in aggregate. We weigh these against your rights and never use them for advertising
• Consent: optional cookies, connecting Google, Steam or Twitch, voice recordings (everyone in the channel must agree first) and anything else we ask you to agree to. You can withdraw it at any time
• Legal obligation: when the law requires us to keep or disclose information

New Zealand's Privacy Act 2020 doesn't use legal bases. We follow its information privacy principles: we collect only what we need, tell you what we collect, keep it secure and no longer than needed, and let you see and correct it.

5. Link Shortener (cubsw.link)

When you use our Link Shortener service:

• We store the original URL you submit and the generated short code
• We log your IP address to prevent abuse and enforce rate limits
• We track click statistics (number of clicks) on shortened links
• IP addresses associated with link creation are retained for security purposes for 12 months after the link was last created, changed or deleted; after that they are removed the next time any short link is made or changed
• This data may be shared with law enforcement if required by law or if we suspect illegal activity
• Links created using our service may be reviewed and removed if they violate our Terms of Use

Important: If you create links to malicious, illegal, or harmful content, your IP address and link data may be reported to appropriate authorities.

6. Authentication (Discord & Twitch OAuth)

CUB SOFTWARE uses a unified login system supporting both Discord and Twitch OAuth. When you log in:

• We store a session cookie to keep you signed in while you use the site. With Essential cookies switched off you can still sign in; we just don't set the 30-day “remember me” cookie (see section 10)
• We store your provider (Discord or Twitch), user ID, display name, and avatar URL in your session
• You may link a second account (e.g. link Twitch to your Discord login); both accounts' identifiers are then associated in your session
• Signing in with Twitch asks Twitch for permission to use chat, read your follows and subscriptions (used only to check your own giveaway entries) and manage your own channel-point rewards (used only by CUB Jukebox and CUB Greenscreen). It does not ask for your email address
• Most access tokens are kept only in your session. Where a feature has to keep working after you close the page, we store the token encrypted: CUB Jukebox and CUB Greenscreen keep your Twitch token so your channel-point rewards keep working during a stream, and CUB Rewards keeps a Google token if you connect Google. If you sign in with Discord, we also keep your Discord sign-in tokens, encrypted, so the dashboard can see servers you join later; signing out deletes them. Stream overlays keep your Twitch token, encrypted, for their Twitch features. You can remove a Google or Steam connection from your account page at any time
• CUB Studio signs in to Twitch through our sign-in service. The service exchanges the login code for a token and hands it to the app on your device; we do not keep that token
• We never access your direct messages or private account information beyond what is described above
• You can sign out at any time, which clears your session data from our servers
• /privacy → Delete everything (in Discord) signs you out everywhere as soon as you confirm: this website, the dashboard and the CUB PROTECTOR app, on every device, including a Twitch sign-in linked to that Discord account. It also revokes our access to your Discord account, so we no longer appear in your Discord Authorised Apps

6a. Discord Bots (QuestCord, CleanMe & CUB Protector)

6a.1 QuestCord

When you use QuestCord, we collect and store:

• Discord user ID and username for player identification
• Server ID for server-specific features
• Game statistics: quests completed, currency earned, inventory, levels, achievements

We don't access or store your Discord server messages: QuestCord doesn't ask Discord for them, so it never receives them. If you send QuestCord a direct message, it replies once with where to get help, and its activity log keeps that message for 7 days (section 6a.3). We keep no data beyond what the game needs.

6a.2 CleanMe

When you use CleanMe, we collect and store:

• Server ID for identifying saved configurations
• Server structure data: role names, colours and icons, channel names and settings, category names, permission settings, the permissions of @everyone, server settings (verification level, content filter, default notifications, AFK channel and system messages channel), AutoMod rules, the welcome screen and onboarding questions — when you use /save, and in the automatic saves described below
• The server's custom emojis and stickers: their names and settings, and a copy of each image so they can be restored after being deleted. Each image is stored once and kept only while a save that uses it exists; images no save uses are deleted within a day
• Earlier versions of a server's save: each /save keeps the previous one so it can be restored with /history, up to 10 versions per server unless our staff allow more
• User ID of the person who saved the configuration
• Safety backups: when someone confirms /clean, /cleanroles, /cleanchannels or /copy, CleanMe first saves the server's structure so the change can be undone. Up to 3 are kept per server, each for 30 days, then they are deleted automatically
• Weekly automatic saves, only if a server turns them on with /settings: one save a week, each replacing the last. Turning the setting off deletes it
• A server's CleanMe settings: who may use CleanMe (the user IDs and role IDs the server owner chooses with /access), and whether owner alerts, weekly saves and member-role backup are on
• Member-role backup, only if the server owner turns it on in /settings (and only once Discord has approved CleanMe's access to member lists): the user IDs of the members who have each saved role, stored beside that save, so undoing a wipe can give members their roles back. Turning it off deletes these lists for that server; each list is also deleted when its save is removed

Undoing a nuke: CleanMe keeps a list of the channels, categories, roles, emojis and stickers deleted in a server during the last 15 minutes, in memory only. If CUB PROTECTOR's anti-nuke catches someone in a server that also has CleanMe, it tells CleanMe the server ID and what it stopped; CleanMe then saves the server plus those deleted items as a safety backup (kept 30 days, as above) and sends the server owner a button to put them back. Otherwise the list is never written down and is discarded after 15 minutes.

Managing backups on the website: the CleanMe dashboard on this website shows the saves of servers you can use CleanMe in. The website passes your Discord user ID to CleanMe, which checks your access by the same rules as its commands; nothing new is stored.

We do NOT store your Discord messages, message history, or any content beyond server structure, and we store member lists only for the optional member-role backup above.

Saves are private unless you choose otherwise: a private save can be copied only by people allowed to use CleanMe in the server it came from, or by anyone with its restore code. A public save (chosen with /save visibility:public or the button in /list) can be viewed with /lookup and copied by anyone who uses CleanMe. Saves made before 22 September 2026 are public, as they were when made, and can be made private from /list. Publishing a save to the CleanMe Website makes it public and shows its structure there.

When someone other than the server owner starts a clean or a copy, CleanMe sends the owner a direct message naming that person (their username and user ID) and what they started, so the owner can stop it. The owner can turn these messages off with /settings.

When you run /save, CleanMe also gives you a copy of the save as a file to keep. If you restore from that file with /copy, we read it to rebuild your server and hold it only until the restore finishes. The same goes for a Discord server template given to /copy: we fetch it from Discord and hold it only until the restore finishes.

Each save, safety backup and weekly save has a private 16-character restore code. The save itself stays on our server, and anyone who has the code can restore that save with /copy, so keep the code as private as the backup file. A code stops working when its save is removed.

Saves are not deleted when CleanMe leaves or is removed from a server, so the server can be restored after the bot is added back. /delete removes a server's current save. To have earlier versions or safety backups removed sooner, ask in our support server or email the address at the end of this policy.

6a.3 CUB Protector

When you use CUB Protector, we collect and store:

• Server ID and all configuration settings applied through the dashboard or bot commands
• Moderation action logs (bans, kicks, timeouts, mutes, warnings) including the affected user ID, the moderator's user ID, the reason written by the moderator, and timestamps, kept as the server's moderation history
• XP and levelling data: user IDs, XP totals, levels and role reward assignments per server
• Economy, achievement, birthday, AFK and profile data where those modules are enabled: user IDs and the values you or the module generate
• Levels (XP and level per server) are also copied into a database on the same server, on an encrypted disk, and kept in line with the main copy within a minute, deletions included.
• Casino totals where a server uses the casino games: how much you bet and won, your biggest win, and today's and this week's totals, used for the server's daily loss limit and the /casino top leaderboard. Included in /privacy export and delete.
• Activity statistics: per-server daily counts of messages, joins, leaves and voice sessions. These are counts only and contain no message content
• Invite tracking: which invite code a member joined with and who created it
• Ticket, giveaway, event, tournament, poll and starboard records: channel and message IDs, participant user IDs, and the configuration set by server staff
• Dynamic voice channel configuration and active channel records
• Logging configuration: which events are logged and to which channels
• Custom Bot configuration: your Discord bot token (stored encrypted at rest), bot name, and process status. Your token is never exposed publicly and is used solely to run your custom bot instance
• Voice recordings (off unless a server turns it on): nothing is recorded until every person in the voice channel has pressed Agree, and only the people who agreed are recorded. The finished file is encrypted, can only be downloaded with the private links given to the people who took part, and is deleted 5 minutes after it is made
• Text to speech (/tts and spoken custom commands): the text to be spoken is sent to Microsoft's text-to-speech service to make the audio, or made on our own server with Piper when Microsoft's service is unavailable. The audio is not kept
• Lookups (/roblox, /minecraft, /chess, /steam, /fortnite, /xbox, /speedrun and similar): the name or ID someone types is sent to that game's or service's public API to fetch its public profile. Results are cached for a few minutes, not stored
• Member notices and /privacy: notices a server leaves for a member are kept for up to 60 days (50 per member per server), and each member reads them and chooses DM or inbox in /privacy. There, any member can also delete their own levels, coins, catches and other progress in a server, and hide their name from its leaderboards
• Nuke Restore: the last 3 snapshots of a server's channel and role structure (names and settings, no messages), so a nuked server can be rebuilt

Bring your own AI (optional)

CUB PROTECTOR's built-in moderation (CUB Brain) uses rules, not AI, and sends nothing anywhere. A server owner can choose to add their own key for an AI provider (Google Gemini, Groq, OpenRouter, Cloudflare Workers AI, OpenAI or Anthropic). If they do, only these are sent to the provider they chose, under that provider's terms:

• Moderation second opinion: only messages CUB Brain already flagged as borderline. The message text (up to 1,500 characters, with mentions replaced by plain words), the categories it matched and its score. Never who wrote it, their ID or roles, or any other message
• Setup builder: the words someone types into /setup build (up to 1,000 characters). Never the server's channels, roles or members
• Image checks (OpenAI keys only, if switched on): the Discord links of up to 4 images in a message, sent to OpenAI's moderation check. Never the message text or who posted it

The key is encrypted, never shown again in full, and deleted when the server owner removes it or the bot leaves the server.

Message content

Most of CUB Protector reads message content and does not keep it. Word filtering, link and invite filtering, phishing detection, mention-flood protection, auto-responders, custom commands, levelling XP, keyword highlights, counting and games all evaluate a message in memory and discard it immediately. None of those features saves the message in its data (our activity logs are the exception, below).

Image Blocklist: when a server's staff block an image, we keep only fingerprints of it (a short code for the whole picture and light/dark patterns around a few hundred points in it), never the image, plus who blocked it and when. The picture can't be rebuilt from them. Images posted in that server are downloaded, compared with those fingerprints in memory, and discarded. The fingerprints stay until staff unblock the image or the server's data is deleted.

Some features store text because keeping it is what the feature is for. In each case the text is kept for the server it was written in:

• Modmail — the messages exchanged in a modmail conversation, so staff can read the thread and so it survives a bot restart
• Ban appeals — the answers a banned user submits in an appeal form
• Suggestions — the text of a suggestion submitted to a suggestion channel
• Moderation reasons — the reason a moderator types when issuing a warning, ban, kick, mute or timeout
• Tickets — answers to a ticket's opening questions and, where the server keeps transcripts, the conversation in the ticket
• Applications and forms — the answers someone submits
• Quotes — a message someone saves with /quote, with its author's name and ID
• Starboard — a copy of a message that members starred, with its author
• Things members write for themselves — AFK messages, /todo lists, Doppelganger away-replies and question-of-the-day entries

Activity logs. Our bots (CUB Protector, CleanMe and QuestCord) write an activity log on our server so we can find and fix faults and abuse. It records what happens in each server the bot is in, including, for CUB Protector, the text of messages the bot can see, who sent them and in which channel. CleanMe and QuestCord aren't sent server messages by Discord at all, so their logs hold only what the bot itself does (and, for QuestCord, any direct message you send it). Only our staff can read it, and it is deleted after 7 days.

Two further features touch message content without storing it on our servers. Event logging can include the content of an edited or deleted message in the log embed it posts; that embed is delivered to a channel in the server itself and is held by Discord, not by us, and a server can switch content off in its logging settings. The snipe command holds the most recently deleted or edited message per channel in memory only, and it is lost whenever the bot restarts.

When CUB Protector is added to or removed from a server, it posts a note in a private staff channel in our own Discord server, so we know who is using it and can help. The note shows the server's name, ID, icon, banner, description and creation date; counts of its members (people, bots, online, and how many joined in the last week), channels, roles, emojis, boosts, AutoMod rules and events, as numbers only; its safety settings, language and Discord features; the permissions the bot was given and where its role sits; and the Discord name, ID and account age of the server's owner and of the person who added the bot (from the server's audit log, if the bot may read it). If the bot was there before, it shows how many features were switched on. When the bot is removed, the note shows the server's name, ID, owner, member, channel and role counts, how many features were switched on and how long the bot was there. Each note deletes itself after 90 days, and /privacy → Delete everything removes the notes that name you straight away.

Retention and deletion

Configuration and the records listed above are kept while CUB Protector is in your server, because they are the server's own settings and history. When the bot is removed, the server's data is kept for 90 days, so adding the bot back restores everything. It is then deleted from our live data automatically, about a week later, after we have checked a preview of the deletion, and from our backups within 35 days after that. The server owner can ask us to delete it sooner at any time.

Modmail conversations can expire automatically. A server administrator can set a retention period — 30 days, 90 days, 6 months or a year — after which closed modmail conversations are permanently deleted. Open conversations are never removed by this, however old they are. The default is to keep them, because deciding how long to hold a server's own support history belongs to that server rather than to us.

A server administrator can delete stored data at any time from the dashboard or with the relevant command — closing a modmail thread, deleting a suggestion, clearing a moderation case, or resetting a module removes the associated records. If you are a member of a server and want data about you removed, contact the server's administrators, or contact us using the details in this policy and we will action it.

6a.4 CubReactive

CubReactive is a voice-reactive streaming overlay tool. When you use CubReactive, we collect and store:

• Discord user ID, username, and avatar URL, obtained via Discord OAuth
• Voice state data transmitted by the CUB Protector bot: speaking status, muted status, and deafened status. This data is processed in real time to drive overlay animations and is not permanently stored
• Overlay configuration settings: avatar images you upload, visual settings (border, glow, animations, position, etc.), and overlay preferences
• A randomly generated overlay key used to authenticate your browser source URL. This key can be regenerated at any time from your dashboard
• Images you upload for your overlay are stored on our servers and associated with your Discord user ID

Access to CubReactive requires membership in the official CUB SOFTWARE Discord server. We verify this at the time of access using the Discord API. We keep the result, including whether you have left that server, in a small record on our server, so we don't have to ask Discord on every visit.

6b. Affiliate Program

When you submit an affiliate application or participate in the CUB SOFTWARE Affiliate Program, we collect and store:

• Application data: Your name or business name, contact email, social media / streaming platform links, content type, estimated monthly viewers or followers, your country, how you found us, and your described promotion plan. We do not keep your IP address with it
• Account identifiers: Your Discord user ID (used to link your application to your account)
• Your assigned vanity code and affiliate link
• Click statistics: Total clicks, unique visitor fingerprints (a scrambled code of the visitor's IP address, made with a secret key), referrer URLs, and timestamps
• Commission and payout records

Applications that are not approved are retained for a reasonable period for fraud prevention before being deleted. Visitor fingerprints used for unique-click tracking are scrambled codes of the visitor's IP address, made with a secret key only our server holds, so they can't be turned back into the address without it. Each one is only needed for 24 hours, the unique-visitor window affiliates agreed to, and is removed the next time that link is used after that. This data is used solely to calculate commissions and prevent click fraud.

6c. CUB Radio

When you request a song, from Discord or from radio.cubsoftware.site, we store:

• The link you submitted and the track details we found for it
• Who requested it: your Discord or Twitch user ID, which of the two it is, and your display name
• The play history of the station, including who requested each song

Your display name is shown on the radio page and in Discord, and may be read out on air before your song plays. To produce that announcement, its text (including your display name and the song title) is sent to Microsoft's text-to-speech service. Spotify links are matched to a playable source using public track information from Spotify and YouTube.

6d. CUB Jukebox & CUB Greenscreen

These tools let a Twitch streamer's viewers redeem channel points for a song or a green-screen clip. For the streamer, we store:

• Your Twitch user ID and login, and your Twitch access and refresh tokens, encrypted at rest, so the rewards keep working during a stream
• Your settings, the rewards you create, and a private key for your player page

For viewers who redeem a reward, we process the Twitch username and what was redeemed (for example the song link) so it can play on the stream, and keep the queue and usage statistics for the streamer. Anything a viewer submits is shown on that streamer's broadcast.

6e. CUB Rewards (Giveaways)

Anyone signed in can run a campaign. When you enter one, we store:

• Your Discord or Twitch identity and the actions you completed, and whether each was verified with the platform
• A salted hash of your IP address (never the address itself), salted separately for each campaign. It lets the host see when several entries came from the same address; it is not used to block anyone
• Where an action needs it, a check with Twitch, Discord, YouTube or Steam. These checks only read, and only about your own account

The campaign host can see the entrant list and the draw results, and winners may be announced publicly. Campaigns and their entries are kept after a campaign ends so results can be checked later, and finished campaigns are archived. Connected Google and Steam accounts can be removed from your account page; removing Google also revokes our access with Google.

Global giveaways (CUB PROTECTOR). A server can choose to show CUBSOFTWARE's global giveaways in one of its channels. When you press Enter on one, we store your Discord ID, which server you entered from and when, so each person counts once across every server and a winner can be drawn. The winner's Discord ID is shown on every server's post, and if they press Claim we tell our owner so the prize can be sent. Entries are encrypted on our server and deleted 7 days after the prize is claimed, or 30 days after the giveaway ends, whichever comes first; /privacy finds and deletes yours at any time.

6f. Server Pages

A server owner can publish a page for their Discord server at servers.cubsoftware.site. Nothing is public until the owner switches it on, and the owner chooses each section. A published page can show the server's name, icon, description, rules, self-assignable roles and leaderboards, which can include members' Discord names and levels. Moderation records, notes, tickets and appeals are never shown. Members who do not want to appear should ask the server's owner.

6g. CUB Studio

• The app: CUB Studio checks our servers for updates and downloads release information. Your scenes, settings and stream keys stay on your device unless you use the features below
• Cloud settings backup: If you choose to back up your settings, we store the backup, encrypted at rest, and give you a key. Anyone with that key can restore the backup, so keep it private
• Marketplace: Themes and plugins you publish are stored and shown publicly with your Twitch name as the author
• Discord bridge: If you link CUB Studio to a Discord server, we store a link token for that server so the two can exchange actions and triggers
• Streaming services: Where you use our restreaming or live tools, the stream keys you enter are stored encrypted and used only to deliver your stream
• Beta access: A cookie remembers a beta invite code you entered

6h. CUB AI

Inside CUB Protector. CUB AI is a voice and chat assistant that only some servers have. In a voice channel it only listens to people who press I agree, and you can press Stop listening to me at any time. What you say is turned into text on our own server and the audio is not kept. That text, and anything you type to /cubai ask, is sent to Anthropic, an outside AI provider, to write the reply. The assistant keeps only the last few messages of a conversation in memory, and they are lost when the bot restarts. (A server owner may also choose to connect their own AI provider; section 6a.3 says exactly what that sends.) We never use your conversations or any other data to train AI models. Do not share passwords or other sensitive information with an AI assistant.

Talk to CUB AI in our support server. A voice channel in the CUBSOFTWARE support server has its own CUB AI bot that anyone there can ask about our bots and services. The same rules apply: it only listens to you after you press I agree (remembered until it restarts), you can press Stop listening to me at any time, what you say is turned into text on our own server without keeping the audio, and that text is sent to Anthropic to write the reply. What you say is not written into the channel, it forgets your conversation when you leave the channel, and each person can ask up to 20 questions an hour.

ai.cubsoftware.site is closed. It ran on hardware we operate, and conversations there were not sent to an outside AI provider. Accounts (name, email address, and a password hash or Google sign-in) and chat history from it are still stored on our server. Email privacy@cubsoftware.site to have yours deleted.

6i. Profiles, Games and Community Features

• Public profiles: A profile you build and publish, including its vanity address and any embeds you add, is visible to anyone
• Game leaderboards: The name you enter and your score are shown publicly
• CUB Games group mode: The names in a group are shared with the other members of that group while it is open
• Supporters: If you support us on Buy Me a Coffee, your public supporter name may appear on our homepage
• Community translations: If you help translate, we store your Discord ID and name with the translations you suggest and the votes you cast. Confirmed translators are credited by name on the translation page and in the bot, and get roles in our support server

6j. Security Logging, IP Bans and Appeals

Our servers log requests (address, page, time and browser) to keep the Services running and to stop abuse. Addresses that probe for vulnerabilities are banned automatically, for a limited time or permanently. If you appeal a ban, what you submit is sent to our staff in Discord so they can review it. Report submissions are stored with the sender's IP address so that abuse of the report system can be dealt with.

6k. The Site Helper

The chat helper in the corner of our pages searches answers our team has written and sends nothing to anyone else. Questions you ask it are processed on our own server and appear in our server logs. Questions it could not answer are kept, without your name or address, so we can write answers for them. Your conversation is stored only in your own browser tab and is gone when you close it.

6l. Member Verification (CUB PROTECTOR)

When a server asks you to verify on our website, you sign in with Discord (your ID and username only, never your email). To stop the same person joining again on other accounts, we keep for that server:

• A scrambled code of your IP address, made with a secret key only our server holds. We never keep the address itself, and the code can't be turned back into it without that key
• A device check: your browser reports details such as screen size, time zone, graphics card and how it draws a test image. We turn them into scrambled codes, made with a secret key only our server holds, and keep only the codes, never the details. The same device gives the same codes, shown to you as a 5-word device code. Without our key nobody can work the codes out, or turn one back into your details
• When you verified, your account's age, and the risk level the check gave

VPN check: if the server has turned on VPN blocking, your IP address is looked up with ip-api.com to see whether it belongs to a VPN, proxy or hosting network. ip-api receives only the address, and we keep the answer in memory for a day without storing it. If it is a VPN, you are asked to verify without it, and the server's staff are told that you tried.

Why: to protect servers from raids, ban evasion and alt accounts (our legitimate interest, and the server's). Only that server's staff see the result, as a risk level and a short reason, never the details themselves.

Your choices: in Discord, /privacy turns the device check off (we then neither compare nor keep it, and delete the ones already kept); a server may then ask you to verify another way. /privacy → Delete everything removes all of this.

How long: we delete this record 12 months after you last verified in that server (verifying again starts the 12 months again). If you are banned there, the ban keeps its own scrambled codes for as long as the ban stands, so the ban can't be dodged on another account.

6m. CubDeck

CubDeck stores your decks: their buttons and pages, the address, port and password you give it for connecting to OBS, and, if you connect Twitch for chat buttons, your Twitch chat token. Decks are encrypted at rest, linked to your Discord ID, and kept until you reset them or ask us to delete them (or use /privacy → Delete everything).

7. CleanMe Website (Server Template Sharing)

When using the CleanMe website:

• Discord OAuth authentication provides us with your user ID, username, and avatar
• We store server configurations you submit (server ID, channel/role/category structures)
• Your Discord user ID is associated with servers you submit
• Voting history is tracked to prevent duplicate votes
• Submitted server templates are publicly visible to other users

Listings are removed by our staff on request. To have a server you submitted taken down, ask in our support server or email the address at the end of this policy.

8. CubVault Password Manager

CubVault is designed with privacy as a core principle:

• All passwords and sensitive data are encrypted locally on your device using your master password
• We CANNOT access your master password or decrypt your vault contents
• If you enable optional cloud sync, your data is encrypted BEFORE leaving your device (end-to-end encryption)
• We have no ability to recover your data if you forget your master password
• Your encrypted vault data is stored locally in your browser's localStorage

9. Shareable Content

Some Services allow you to create shareable links:

• Sticky Board: Shared boards are stored on our servers, encrypted at rest, and opened with a random link; view counts are tracked. Older links carried the board inside the link itself. Anyone with the link can view the board.
• Resume Builder: Shared resumes are stored on our servers, encrypted at rest, and opened with a long random link. Anyone with the link can view the resume, including any contact details you put in it.
• Countdown Maker: Shared countdowns are stored on our servers, encrypted at rest, with view counts tracked. Only the browser that created a countdown can change it.
• Content kept in your browser: Notes, saved countdowns, sticky boards you have not shared and similar tool data are kept in your browser's storage and never sent to us.

When you share content via these services, you accept that the content becomes accessible to anyone with the link.

10. Cookies and Tracking Technologies

We use cookies and similar browser storage technologies to maintain your session, remember your preferences, and understand how our Services are used. When you first visit CUB SOFTWARE, a cookie consent banner is shown that lets you choose exactly which categories of cookies you allow.

We use three categories of cookies:

• Essential Cookies (optional): Required for core functionality including session management, login authentication, and security. Two cookies are used: session (current session state) and cub_remember (persistent login token, set on each login, valid for up to 30 days, deleted on logout). If you switch Essential cookies off, you can still use the site and sign in, but we do not set cub_remember and your session ends when you close the browser.
• Functional Cookies (optional): Remember your preferences and settings across sessions to improve your experience. Only set if you have accepted this category.
• Analytics & Tracking Cookies (optional): Help us understand how users interact with our Services. This includes the __cub_vid visitor identifier (valid for one year), which lets us count unique visits to an affiliate link. It is only set if you have accepted this category; without it, a visit is still counted, using a hashed form of your IP address.

Other cookies: cub_studio_beta is set only if you enter a CUB Studio beta invite code, to remember it. cp_app is set only inside the CUB PROTECTOR app, for one year, so our pages know to show the app's layout; it holds no information about you. Staff-only tools use their own sign-in cookies. The Cloudflare Web Analytics beacon on our pages does not set cookies.

Your consent choice is stored in your browser's localStorage under the key cub_cookie_prefs, and in a cub_consent cookie (valid for one year) so our servers can follow it and so the same choice applies across our subdomains. You can change your preferences at any time using the Cookies link at the bottom of every page.

11. Data Retention

We keep information only as long as we need it for the purpose it was collected for. Data deleted from our live systems is gone from every backup within 35 days.

12. Data Sharing and Disclosure

We do NOT sell your personal information, and we do not "share" it for cross-context behavioural advertising (as California law defines it). We show no ads. We may share information in the following circumstances:

• With Your Consent: When you explicitly agree to share information
• Service Providers: With trusted third parties who assist in operating our Services (listed in section 14)
• People you choose to share with: Server staff can see the data CUB Protector keeps for their server; giveaway hosts see their entrant lists; anything you publish, request on air or share by link is visible to others
• Legal Requirements: When required by law, regulation, legal process, or government request
• Safety: To protect the rights, property, or safety of CUB SOFTWARE, our users, or the public
• Abuse Prevention: IP addresses and associated data may be shared with law enforcement to address illegal activity
• Business Transfers: In connection with a merger, acquisition, or sale of assets

13. Data Security

We implement reasonable security measures to protect your information, including:

• HTTPS encryption for all data transmission
• Website data. Account profiles, custom bot settings, giveaways and connected accounts, Jukebox and Greenscreen tokens, CubDeck decks, streaming settings, stream keys, shared resumes, countdowns and boards, and CUB Studio backups are encrypted at rest in the same way.
• Encryption at rest. Every CUB Protector data file holding settings or anything about people is encrypted on disk with AES-256-GCM (a 256-bit key, a unique initialisation vector per file, and authentication so a modified file fails to open rather than silently returning altered data). This covers server configuration, moderation history, levelling data, and the stored message content described in section 6a.3 — modmail conversations, ban appeals, suggestions and moderator-written reasons.
• Custom bot tokens are encrypted at rest with the same scheme. The encryption key is held in the server environment and is never stored alongside the data it protects.
• Backups. Data is backed up daily. Off-site backups contain only the encrypted files — never the encryption key — and the backup process refuses to run if it finds any file that is not encrypted.
• Secure server infrastructure
• Access controls and authentication
• Regular security reviews

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

If there is a breach. If personal information we hold is accessed or lost in a way likely to cause serious harm, we will tell the people affected and New Zealand's Office of the Privacy Commissioner as soon as practicable, and the relevant EU or UK supervisory authority where their law requires it (within 72 hours of becoming aware). We will say what happened, what information was involved and what you can do.

14. Third-Party Services

Our Services interact with third-party platforms including:

• Cloudflare (network, security and the Cloudflare Web Analytics beacon on our pages)
• Discord (authentication, bot functionality)
• Twitch (authentication, chat, channel points, stream checks)
• Google / YouTube and Steam (only when you connect them for CUB Rewards, or use CUB PROTECTOR's /steam commands)
• Piper (offline text-to-speech on our own server, used when Microsoft's service is unavailable)
• YouTube and Spotify (finding tracks for CUB Radio and CUB Jukebox)
• Microsoft text-to-speech (CUB Radio announcements and CUB PROTECTOR's /tts)
• The AI provider a server owner chooses for CUB PROTECTOR's optional bring-your-own-AI features (Google Gemini, Groq, OpenRouter, Cloudflare Workers AI, OpenAI or Anthropic; see section 6a.3)
• Anthropic (the replies from CUB AI, see section 6h; and an automated tool that helps us find and fix faults in our own code. When one of our bots reports an error, the tool reads the error and our code. We remove Discord IDs, message text, passwords and keys from the error first, but it can open our application logs when it needs to, and those can include message text, see section 6a.3. None of this is used to train AI models)
• Public game and service APIs for CUB PROTECTOR lookups (Roblox, Mojang/Minecraft, Chess.com, Lichess, Steam, Fortnite, Xbox, Speedrun.com and similar), which receive only the name or ID being looked up
• ip-api.com (the verification VPN check, and where an address that was banned or is sending us heavy traffic comes from) and ipinfo.io (which network an address belongs to, in our own system alerts). Each receives only the IP address
• Namecheap Private Email (email you send to our addresses)
• Buy Me a Coffee (supporter names)
• GitHub and Last.fm (developer and overlay features that show their public data). GitHub also holds our backups
• Patreon and Tebex (when you support us there, they tell us what you bought so we can give you its perks)
• top.gg (when you vote for our bots, it tells us who voted)
• Social media platforms (Instagram, TikTok, Twitter/X, Facebook, YouTube)
• Currency exchange rate APIs
• Other external APIs and services

These third parties have their own privacy policies. We encourage you to review their policies. We are not responsible for the privacy practices of third-party services.

Google user data. CUB SOFTWARE's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google access only for the feature you connected it for (for example checking a YouTube giveaway action), never for advertising, never to train AI models, and no person reads it unless you ask us to or the law requires it. You can remove the connection from your account page, or at myaccount.google.com/permissions.

Discord and Twitch data is used only to provide the features you use, in line with Discord's Developer Policy and Twitch's Developer Agreement. We do not sell it or use it to train AI models.

15. Your Rights and Choices

Wherever you live, you can ask us to:

• Access: get a copy of everything we hold about you. Our export searches every data file, log and database on our servers, including encrypted ones, not just your profile. Backups are archives we only open to recover from a failure, so they are not searched
• Correct information that is wrong
• Delete your information. The same search finds every copy on our live systems and deletes it. Backups are replaced on a rolling schedule, so your data is gone from them within 35 days; if we ever have to restore one before then, we repeat your deletion before the restored data is used. A few things may be kept where we must (for example a ban, so it keeps working, with your name removed); we will tell you what and why
• Portability: receive your data in a common, machine-readable format
• Restrict or object to how we use your information, including anything based on legitimate interests
• Withdraw consent at any time, for anything that relies on it

Do it yourself, no request needed: in Discord, /privacy lets you get a copy of everything we hold about you (sent to your DMs), delete your progress in one server, delete everything everywhere (IP addresses linked to your account included; the search looks for your Discord ID, your username if it has 5 or more characters, and the IP and email addresses found with your account, not display names or nicknames, which many people share), hide your name from a server's leaderboards, and turn the verification device check off. Delete everything keeps only two things, and says so before you confirm: a server's ban on you, with its reason and date but without your name, so deleting can't be used to get round a ban; and, where you are the staff member on a warning or case about someone else, that record, which stays with the server with your ID taken out, because it is about them. Warnings and cases about you are deleted. It also signs you out of our website and the CUB PROTECTOR app on every device the moment you confirm, and removes the website's access to your Discord account. To keep that sign-out working, and to repeat your deletion if a backup is ever restored, we keep only a scrambled code of your Discord ID, made with a secret key, which can't be turned back into the ID. Before anything is changed, we keep an encrypted copy of each file it edits for 24 hours, only so a faulty edit can be undone; then that copy is deleted too. You can do each once a day. Deleting removes what exists when you run it: if you keep using our bots or website afterwards, new data about you is made again from then on (for example XP when you chat in a server), and you can delete it again. What it can't reach: messages already posted inside a Discord server, by you or by our bots (for example a ticket's answers or a log message), belong to that server and stay unless its staff delete them. A CUB AI account (ai.cubsoftware.site) is separate, made with an email address or Google, and a website account signed in only with Twitch isn't linked to your Discord ID. Records kept under your Twitch account (stream overlays and their events, CUB Studio themes you shared) aren't found from your Discord ID either, even when the two are linked. For those, email privacy@cubsoftware.site or open a ticket in our support server and we delete them for you. Server staff can also delete records from the dashboard. Change cookie choices with the Cookies link at the bottom of every page. Remove Google or Steam connections, or a second sign-in, from your account page.

How to ask: email privacy@cubsoftware.site with "Privacy Request" in the subject, or ask in our support server. We may ask you to confirm it's you (for example by messaging from the Discord account concerned). We answer within 7 days, which is faster than the law requires, and it costs nothing.

Where these rights come from: New Zealand's Privacy Act 2020 (access and correction); the EU and UK GDPR (all of the above); California's CCPA/CPRA (to know, delete and correct, and to opt out of sale, though we sell nothing); Brazil's LGPD; Canada's PIPEDA; and similar laws elsewhere. We never treat you differently for using them.

Complaints: please tell us first and we will try to put it right. You can also complain to New Zealand's Office of the Privacy Commissioner (privacy.org.nz), the data protection authority where you live in the EU, or the UK Information Commissioner's Office (ico.org.uk).

16. Children's Privacy

Our Services are not directed to children under 13 years of age, and Discord, which most of them use, requires its users to be at least 13 (older in some countries). We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will promptly delete that information.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

17. International Data Transfers

Our servers are in New Zealand. The European Commission and the UK both recognise New Zealand as giving an adequate level of data protection, so personal data from the EU and UK can be stored here without extra safeguards. Traffic passes through Cloudflare's global network, and the platforms the Services work with (Discord, Google, Twitch, Microsoft and others in section 14) handle data in other countries, mainly the United States, under their own terms and the transfer safeguards they provide.

17a. Automated Decisions

CUB PROTECTOR can act automatically on rules a server's staff choose: for example deleting a message that breaks the server's word filter, or timing someone out for spam. These are the server's own moderation rules, not decisions about you by us, and they have no legal effect. If you think one was wrong, ask that server's staff; many servers also use our ban appeal forms. We do not profile people or make automated decisions about them for any other purpose.

18. Do Not Track Signals

Some browsers have a "Do Not Track" feature. Our Services do not currently respond to Do Not Track signals. However, you can manage tracking at any time through our built-in cookie preferences panel (the Cookies link at the bottom of every page) or through your browser settings.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. For important changes we will also post a notice in our Discord server's updates channel. We encourage you to review this Privacy Policy periodically.

Your continued use of our Services after any changes indicates your acceptance of the updated Privacy Policy.

20. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@cubsoftware.site
• Discord: CUB