Privacy Policy

Who we are

EmberShape is operated by Bodrogi Bence Barnabás E.V., registered in Hungary. For any question about this policy, or to exercise any of the rights described below, contact us at support@embershape.com. We aim to respond to every request within 30 days.

What we collect

Account and sign-in. When you sign in with Discord, Twitch, or Kick, we receive your platform user ID, username, and avatar URL from that platform, and store them to identify your account. We do not receive or store your password for any platform. Sign-in happens entirely through that platform's own OAuth flow, and we never see your credentials.

Discord server data. When you authorize EmberBot for a Discord server, we store that server's ID and name, and which tool configuration is active there, so EmberBot knows where and how to operate. We don't read the contents of a server's messages beyond what EmberBot's specific moderation or engagement features require to function.

Posting and data-access connections. Separately from signing in, you can grant EmberShape's tools permission to post content or read data on your behalf on TikTok, Instagram, YouTube, or Twitch. Doing so stores an encrypted access token (and, where the platform issues one, a refresh token) for that connection, along with the scopes you granted and the connected account's platform username. These tokens are used only to perform the actions you've enabled, for example publishing a video you've created through EmberShape's tools, and are encrypted at rest. Exactly what we can see or do through a connection depends on the specific permissions you grant when you connect it, and on that platform's own policies.

YouTube API Services. EmberShape's use of YouTube data, when you connect a YouTube channel, is governed by the YouTube API Services Terms of Service and by Google's Privacy Policy. We access only what's needed for the features you use: basic channel and video information to display and manage your own content, and, if you grant it, the ability to publish a video you've chosen to post.

Billing. Subscription payments are processed by Stripe. We store your Stripe customer ID, subscription ID, and subscription status. We never receive or store your card number, expiration date, or CVC; Stripe handles those directly.

Usage. We keep basic timestamps of account activity (when a server was linked, when a platform was connected, when a subscription started) so you can see your own account's activity history from your dashboard.

Support communications. If you email us, we keep that correspondence (and any information you choose to include in it) so we can respond to you and keep a record of the conversation.

Cookies

We use a small number of first-party cookies, all functional: one to keep you signed in, one to protect the sign-in process itself from forgery (deleted immediately after use), and one that temporarily remembers where to send you back to after a sign-in you started elsewhere. None of them are used for advertising, and we don't run any third-party analytics or tracking scripts on EmberShape.

How we use it

To operate your account and the tools you've enabled, to run EmberBot in the Discord servers you've authorized it for, to perform posting or data-access actions you've explicitly granted, to process billing, and to communicate with you about your account. We do not sell your data, and we do not use it for advertising.

Who we share it with

Stripe, for payment processing. The platform each connection is with (Discord, Twitch, Kick, TikTok, Instagram, YouTube), necessarily, to perform the sign-in or action you've requested. Infrastructure providers that host EmberShape's services, bound by their own confidentiality and security obligations. We don't share your data with anyone else, and we've never sold it to anyone.

International data transfers

EmberShape is based in Hungary, within the EU. Some of the infrastructure and platform providers we rely on (including Discord, Twitch, Kick, TikTok, Instagram, YouTube, and Stripe) are based outside the EU, most commonly in the United States. Where we transfer personal data outside the EU, we rely on the transfer mechanism that provider itself offers (such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses) to keep it protected to a comparable standard.

Security

Posting and data-access tokens are encrypted at rest. All traffic to EmberShape is encrypted in transit over HTTPS. We limit access to your data to what each part of our system actually needs to function. No system is perfectly secure, but we treat your platform tokens as the sensitive credentials they are.

Your rights and controls

You can disconnect any signed-in platform or posting connection from your Connections page at any time. Disconnecting a posting connection revokes its access token where the platform supports remote revocation. You can also revoke EmberShape's access directly from the connected platform's own settings (for example, Discord's Authorized Apps, or Google's Security page); either side works.

Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you, to object to or restrict certain processing, and to withdraw consent at any time where processing is based on it. To exercise any of these, email support@embershape.com. If you're in the EU or UK and believe we haven't resolved your request adequately, you also have the right to lodge a complaint with your local data protection authority.

Children's privacy

EmberShape isn't directed at children, and you must meet the minimum age required by the platform you're signing in with (for example, Discord requires users to be at least 13) to use it. We don't knowingly collect personal data from children under that age. If you believe a child has provided us with personal data, contact us at support@embershape.com and we'll remove it.

Retention

We retain account data for as long as your account exists. Posting and data-access tokens are retained only while that connection remains active, and are deleted on disconnect. If you delete your account, we delete or anonymize your personal data within a reasonable time, except where we're required to keep it longer (for example, billing records we're legally required to retain).

Changes to this policy

If we make a material change to this policy, we'll update the date above and, where required, notify you directly.