Skip to main content
InvestEmpire

InvestEmpire

Privacy Policy

Last updated:

Ler esta página em português

1. The short version

  • We store the numbers your server's game needs: your Discord ID, your balance, your level and a few counters.
  • The content of your messages is never stored. Not one. The bot looks at a message only to measure how long it is, and throws it away immediately.
  • We do not know your name, your e-mail, your phone number or your address, and we never ask for payment details.
  • Everything sits on one server rented by the developer. Nothing is sold, and nothing goes to an advertising or analytics company.
  • Want your data deleted? Write to — and read Your rights, which is honest about what you can and cannot do on your own today.

2. Who is responsible

InvestEmpire is run by an independent developer (PaidosDev), based in Brazil, reachable at . Under Brazil's LGPD and the GDPR, that developer is the controller of the data described here.

The staff of each Discord server decide to install the bot and configure its rules, and they can see and change the data of their own server through the dashboard. This policy covers the bot and the dashboard — it does not cover Discord itself, nor anything your server does elsewhere.

3. What we store

Everything is tied to a Discord ID (a number) and to a server ID (another number). The dashboard sign-in uses Discord OAuth with the identify and guilds scopes and nothing more: we receive your ID, your display name and avatar to show on screen, and the list of servers you can manage. We never receive a password and we never receive an e-mail address. The name shown at the top of the dashboard comes from Discord at that moment and is not written to our database.

Where the data sits, and what personal information each place holds.
Where What it holds What it is for
Economy profile
one row per member, per server		 server ID, Discord ID, coin balance, XP, level, invite count, number of messages that earned a reward, total time in voice channels (in seconds), and the dates of the last daily claim and the last message reward. to run the game, work out levels and rankings, and enforce the cooldowns between rewards
Transaction history server ID, Discord ID, type (daily, message, voice, invite, purchase, transfer, admin adjustment…), amount, date and a short description — see the note right below this table. audit: every coin that comes in or goes out can be checked by the server's staff
Credited invites who invited whom (two Discord IDs) to pay an invite once and stop the same invite from counting twice
Inventory, mission progress, achievements, giveaway entries and prize tickets IDs only — no free text about you to know what you own, what you completed and which giveaway you entered
Roblox link (optional) Discord ID, Roblox ID and the Roblox username only exists if you choose to link, so the server can deliver a reward inside its game
Link code (temporary) the short code, the server ID, your Discord ID and the time it expires to match the code your admin gave you to your account; the code is single-use and stops working at expiry
Roblox reward queue (optional) server ID, Discord ID, Roblox ID, which reward, how many, whether it was delivered and the timestamps — plus a detail field written by the game, see the note right below the table so the server's game knows what it still has to deliver, and can confirm it did
Language preference Discord ID and either “en” or “pt” so the bot answers you in your language
Bot administrators Discord IDs of the people a server owner made bot admins to decide who may use the admin commands
Dashboard audit trail ID of the administrator who used the dashboard, what they did, and when so a server can see who changed what
Giveaways IDs of the winners to announce and prove the result

Where free text can appear

Almost everything the table above stores is a number: IDs, amounts and dates. There are exactly two fields where text can show up, and neither of them is written by you.

1. The transaction description

Most of the time the description is a fixed label chosen by the bot itself (“Daily reward”, “Message activity reward”, “Voice time reward”) and says nothing about you. In three cases it also carries a Discord username, so the record makes sense to a human reading it:

  • a credited invite records the username of the person who joined;
  • a transfer between members records the username of the other side;
  • an action performed by an administrator records who did it.

That is a Discord display name, which is already public inside that server. It is never a legal name given to us — because we never ask for one.

2. The Roblox delivery detail

If a server uses the Roblox integration, its game reports back to us whether the reward was delivered or failed, and it may attach a short explanation — 200 characters at most. That text is written by that server's game, not by you and not by us, and it exists so an admin can understand a failure (“inventory full”, for instance). We cannot control what someone else's game writes there; the server that installed the integration is responsible for that content.

4. What we never store

The content of your messages is not recorded. The bot reads a message at exactly one point in the code, and only to count how many characters it has (that is how it decides whether the message is long enough to earn a reward). After that the message is discarded. There is no column anywhere in the database that could hold the text of a message: we do not log it, we do not forward it, and we could not recover it.

We also do not store:

  • your legal name, e-mail address, phone number or postal address;
  • payment information of any kind — the service is free and has no way to charge you;
  • what you write in a direct message: the bot discards, immediately, any message that does not come from a server. The only command that works in DMs is /language, and it stores only the language you picked — none of the text;
  • the audio of a voice call: the bot only counts how long you stayed connected. It never joins, listens to or records a call;
  • location, device identifiers, biometrics, or anything about your browsing outside this site.

5. Why we store it

The purpose is always the same, and it is spelled out in the “What it is for” column of the table above: to run the economy of the server that installed the bot, pay out rewards, prevent abuse and double claims, let the server's staff audit and manage their own economy, and answer you in your language. None of it is used for advertising, for commercial profiling, or to train an artificial intelligence model.

Legal basis. Under the GDPR: the legitimate interests (art. 6(1)(f)) of the server that installed the bot and of the developer in operating a feature that server's own members asked for; and consent (art. 6(1)(a)) for what is optional — the Roblox link and the language choice, given by you when you use the feature. Under the LGPD: legitimate interests (art. 7, IX) and consent (art. 7, I), in the same cases.

6. Where it lives, for how long, and backups

Everything is kept in a single SQLite database file, on the disk of a virtual private server (VPS) the developer rents from Hostinger. There is no third-party cloud database and no external data platform.

  • That server can only be reached with an SSH key — password login is turned off.
  • The database is backed up once a day. The rotation keeps the 14 most recent copies (about two weeks of history), and one copy is also downloaded to the developer's own computer.
  • Data is kept for as long as the bot is installed in the server and the service exists, because a game economy only works with its history. There is no automatic deletion, and leaving a server does not delete your data by itself.
  • If the service is shut down for good, the database and its backups are deleted.

7. Dashboard records: IP address and cookies

The dashboard runs behind a web server (nginx), which keeps standard access logs. Those logs include the IP address of whoever opened a page, the date and time, the address requested and the browser used. That is what any web server does by default, and it is what lets us see an attack or a failure; those logs are not matched against your game profile.

Three cookies are used, all three strictly necessary:

  • a session cookie (__Host-sessao), created only after you sign in with Discord. It is signed, it expires in 2 hours, and it carries your ID, your display name/avatar and the list of servers you can manage. Your Discord access token is not stored in it;
  • a sign-in security cookie (__Host-oauth_state), which exists only during sign-in: it holds a random value for 10 minutes to prove that you started the sign-in, and not a third-party site trying to get into your account. It is cleared as soon as sign-in finishes and it contains nothing about you;
  • a language cookie (lang), which just remembers “en” or “pt” for a year.

There is no advertising cookie, no analytics script and no tracking pixel on this site.

8. Who else sees it

  • Discord. The bot works inside Discord, so Discord itself necessarily processes what you send there. Discord's own privacy policy covers that.
  • The staff of your server. Administrators of a server can see, through the dashboard and through bot commands, the economy data of the members of their server: ID, balance, level, counters and transaction history. They cannot see any other server's data.
  • Roblox — and only if you link your account yourself. In that case, your Roblox ID is used to deliver the reward in the game the server configured.
  • Hostinger, as the company hosting the server the data sits on.
  • Nobody else. We do not sell data. We do not hand it to advertisers, data brokers, analytics companies or AI training providers. The only other case would be a valid legal order — and we have never received one.

9. Your rights, and how to use them today

Under the LGPD and the GDPR you can ask for confirmation that we hold data about you, for a copy of it, for a correction, for deletion, and for information about who it was shared with. Being honest about how that works today:

  • See your data. Most of it is already visible to you through the bot's own commands (balance, level, inventory, missions). An administrator of your server can see the full profile and history in the dashboard. Ask them, or write to us.
  • Correct it. The data is made of counters generated by your own use; if a number is wrong, a server administrator can adjust it in the dashboard.
  • Reset your data in a server. An administrator can do this in two ways, and they do not erase the same things:
    • from the dashboard — zeroes balance, XP, level, invites, message count and voice time, and deletes that member's inventory, mission progress and achievements in that server;
    • with the /reset-user command in Discord — zeroes only balance, XP and level. Invites, message count, voice time, inventory, missions and achievements stay as they were.
    In neither case is the member's row deleted: it stays in the table (zeroed). And the transaction history is kept in both, because it is the audit trail of the server's economy.
  • Delete everything about you. There is no self-service delete button today. A full deletion has to be requested by e-mail at , from the account concerned or in a way that lets us confirm the connection to it, and it is done by hand. Give us your Discord ID and, if you can, which server(s). We aim to reply within 30 days.
  • Undo the Roblox link. An administrator removes the link in the dashboard; or write to us and we will do it.
  • Complain. In Brazil, to the ANPD; in the EU or the UK, to your country's data protection authority.

If this text ever falls behind because a better way to exercise these rights exists, the page is updated along with the feature.

10. Minimum age

Discord's own age rules apply: you must be at least 13 — or older where your country requires it — to have an account there at all. InvestEmpire is not directed at children below that age and does not knowingly keep their data. If you believe someone below the minimum age is using the bot, write to us and we will delete the record.

11. Security

What is in place: access to the server only with an SSH key (password login disabled); the dashboard requires a Discord sign-in, and on every request it re-checks that you still administer the server you are looking at; a signed session cookie with a short lifetime; the site is served over HTTPS; forms are protected against cross-site request forgery; and every administrative action taken in the dashboard is written to an audit trail.

No system is perfectly secure, and we cannot promise the data will never leak. If it ever does, we will say so here and notify the affected servers.

12. Changes to this policy

The date at the top of this page is the date of the current version. When something changes, we update that date and publish the new text here. A significant change — something new being collected, or a new recipient — is also announced in whatever support channels exist at the time.

13. Contact

Privacy questions, and requests for access, correction or deletion: .

See also the Terms of Service.

Back to top