Privacy Policy

1. What we collect

OctoBot is deliberately minimal. When you connect your account, we store only what's needed to deliver notifications to you:

• Your Discord user ID — so we know which Discord account to DM.
• Your GitHub login and access token — the token is encrypted at rest with AES-256-GCM and used only to read your GitHub notifications on your behalf.
• A notification watermark and per-thread dedup ledger — small markers that record how far we've read, so you aren't notified about the same activity twice.
• Your preferences — the notification subject types and reasons you subscribe to, and whether the daily digest is on.
• A transient OAuth state — a single-use value that secures the connection flow and expires within minutes.

We do not store the contents of your GitHub notifications or your repositories. Notification details are fetched from GitHub, formatted, sent to you as a DM, and not retained.

2. How we use it

We use the data above solely to:

• authenticate your connection to GitHub;
• poll GitHub for new activity, filter it against your preferences, and send you Discord DMs;
• send the optional daily digest, if you enable it;
• avoid notifying you about the same event more than once.

We do not use your data for advertising, profiling, or any purpose unrelated to running OctoBot.

3. What we never do

• We never sell or rent your data.
• We never write to your GitHub repositories or mark your notifications as read — access is read-only.
• We never log your tokens, secrets, or notification contents. Our logs contain only IDs, statuses, and errors.

4. Sub-processors

OctoBot relies on a few third parties to function. Your data passes through them only as needed to deliver the service:

• GitHub — the source of your notifications, accessed with the token you authorize.
• Discord — the channel through which we deliver your DMs.
• Our hosting provider — where the service runs and its encrypted database is stored.

Each of these processes data under its own privacy policy. We do not share your data with any other third party.

5. Retention and deletion

We keep your data only while your account is connected. Running /unlink immediately disconnects your account and erases the record we hold about you— your encrypted token, watermark, dedup ledger, and preferences. You can also revoke OctoBot's access from your GitHub account settings at any time, which renders the stored token unusable.

6. Security

Access tokens are encrypted at rest with AES-256-GCM, and the encryption key lives only in the service environment — never in the database and never in logs. Connections are made over HTTPS, and the OAuth flow is protected against cross-site request forgery with a single-use, time-limited state. No system is perfectly secure, but we design OctoBot to hold as little as possible and to protect what it must hold.

7. International data transfers

OctoBot may process and store your data on servers located outside Brazil. Where that happens, we rely on your consent and on appropriate safeguards for the transfer, as permitted by the LGPD, and we only use providers that protect your data to a comparable standard.

8. Children

OctoBot is not directed to children. You must meet the minimum age required to use Discord and GitHub in your country to use the service, and we do not knowingly collect data from anyone below that age.

9. Legal basis and your rights under the LGPD

We process your personal data under Brazil's LGPD. Our legal bases are your consent — which you give by connecting your account — and our legitimate interest in operating the service you asked for. You can withdraw consent at any time by disconnecting.

Under the LGPD, you have the right to:

• confirm that we process your data, and access it;
• correct incomplete, inaccurate, or outdated data;
• request anonymization, blocking, or deletion of data that is unnecessary or processed outside the law;
• request portability of your data to another provider;
• be told which entities we share your data with;
• be informed of the consequences of refusing consent;
• withdraw your consent and have data processed on that basis deleted.

You can delete your data yourself at any time with /unlink. For any other request, or to reach our data protection officer (encarregado), email gabrielccarvalhopro@gmail.com. You may also lodge a complaint with Brazil's National Data Protection Authority (ANPD).

10. Changes to this policy

We may update this policy from time to time. When we do, we'll revise the "last updated" date above and, for material changes, make a reasonable effort to notify connected users.

11. Contact

For any privacy question or request, email gabrielccarvalhopro@gmail.com.