Privacy Policy

• We collect what Kovu needs to run its features in your server, and nothing else.
• We don’t sell data, show ads or share data with advertisers.
• Usage statistics (Google Analytics) never see your Discord ID, server names or messages. In the EU, EEA, UK and Switzerland they only run if you turn them on; elsewhere they’re on until you turn them off. They never run while your browser sends Global Privacy Control.
• Song requests from Twitch, Kick and Discord are kept 30 days. Other Twitch and Kick chat messages aren’t stored, apart from a possible command whose processing keeps failing (see Song requests).
• Kovu is free right now, so we collect no payment data. Before paid tiers start, we’ll update this policy (see Payments).
• If you connect an AI app to Kovu, it receives your servers’ setup (settings, channels and roles), never message content or DMs.
• Server templates belong to the person who saves them, not to a server. If you share one by link, anyone signed in who opens the link can read all of it and copy it (see Server templates).
• You can ask us to delete your data at any time.

Signing in with Discord shares, with your permission:

• Your Discord profile (ID, username, display name, avatar) to show who you are and to record who changed a setting.
• Your email address, stored with your account and used only to contact you about your account or security. We don’t send marketing email.
• Your server list (the guilds scope), to show the servers you can manage. It is cached for about a minute and not stored long-term.
• Your Discord language, to show kovu.gg in one of its 9 languages until you pick one yourself.

We also store your Discord sign-in tokens (encrypted) so the dashboard can refresh your server list, and your dashboard preferences (hidden and pinned modules, Simple or Advanced mode, the classic or new dashboard, and the last 12 dashboard pages you opened, for “Where you left off”).

They also include your server order and folders on the dashboard (the order of your servers, and each folder’s name, color and servers), which only you see.

To provide its features, Kovu processes:

• Server configuration: settings, custom commands, tags, automod rules and similar content your staff create.
• Moderation records: cases, warnings and notes, including the member’s ID, the moderator and the reason. If a server imports its moderation history from Dyno, Kovu keeps the cases Dyno posted in that server’s mod log channel as that server’s moderation records: the member’s and moderator’s Discord IDs and usernames, the reason the moderator wrote, the action and its length, and when it happened.
• Modmail: conversations between a member and a server’s staff, and their transcripts. Every DM Kovu sends for a server’s staff says who sent it (the staff member, or the name the server chose for anonymous replies) and how to stop it. Any member can stop a server’s modmail messages with /modmail stop, the command named in the DM, or with the button on the first message of a conversation staff opened; /modmail allow lets them through again. Kovu then keeps the member’s Discord ID, the server and when they stopped its messages. A member who stopped them can still open a conversation with that server’s staff themselves.
• Messages, only to run the features you turn on: commands, automod, autoresponders, levels and the action log. To show the original text in delete and edit logs, Kovu keeps the most recent messages per channel in memory for a short time. In servers whose staff log deleted or edited messages, it also keeps recent messages (their text, attachment links, author and the author’s roles) for up to 7 days, including ones it reads again from Discord after a restart. It never keeps new messages from channels, roles or bots the server’s logs ignore, or any from DMs, and what it holds from a channel or category is deleted when that channel or category is ignored. A message is deleted from it as soon as Kovu sees it deleted in Discord, and everything is deleted when the server turns those logs off or Kovu leaves the server. Otherwise, message content is not stored except where a feature exists to save it: tickets, modmail, forms, and the automod log, which keeps the start of each message automod acted on.
• Member activity such as XP, economy balances, reminders, birthdays, giveaway entries, achievement badges and the counts behind them (messages, voice time, invites, daily streaks), when those modules are on.
• Invites, when the Invite Tracker is on: which invite or vanity link each member joined with, who created it, and whether the account was new or had joined before.
• Verification, when a server uses web verification: a keyed hash of a random ID stored in a cookie on the verification page (never your IP address), so staff can spot one browser verifying several accounts.
• Server activity statistics: counts of messages, active members, joins, leaves and voice time per hour and day. The stored totals are numbers, not messages.
• A copy of the server’s setup: its channels (with their permission settings), roles and server settings, kept up to date from Discord so Kovu doesn’t have to ask Discord every time. It is deleted when Kovu leaves the server.
• Levels imports, when staff import levels from MEE6: the members on the server’s public MEE6 leaderboard (ID, name, avatar, XP and level), kept for the import’s undo window.

Action logs and moderation notices are posted to the Discord channels your staff choose. Kovu also keeps a short-lived record of the rate limits Discord sets for each bot, with no personal data.

Reports to the Kovu team. When you use /report-kovu or “Report to Kovu” on a message, we store your Discord ID, who or what you reported (a user ID, or a message link and its author’s ID), the category and the reason you wrote. The message’s text isn’t copied into the report.

Server staff can publish pages about their server on kovu.gg:

• Leaderboards and server pages show members’ display names, avatars, levels and XP. Any member can leave every public leaderboard from Privacy and data, or with /leaderboard hide or /rep hide in Discord. Either one also takes them off the XP and rep leaderboards inside their servers (/leaderboard and /rep leaderboard), and /leaderboard show brings them back. A server’s name and icon appear on kovu.gg only after its managers turn on a public leaderboard, server page or badge page, and they can turn each off again; Kovu never publishes a list of the servers it is in.
• Badge pages show a server’s achievements and how many members hold each one, without member names.

When a server turns on Song Requests, a streamer links a Spotify developer app of their own (Kovu receives only its Client ID), their Spotify account, and their Twitch or Kick channel. Viewers can then type a command such as !sr in that chat, or use /sr in Discord, and Kovu adds the song to the streamer’s own Spotify queue. Kovu doesn’t play any audio. For this:

• Chat messages in a linked Twitch or Kick channel reach Kovu. Kovu reads each one only to see whether it is a song request command; other messages are not stored. A line that could be a command (it starts with a symbol like !) can wait in Kovu’s job queue for a short time until it is handled. If handling it keeps failing, the line, with the chatter’s ID and name, is kept with Kovu’s failed jobs (see How long we keep data).
• For each request we store the viewer’s Twitch, Kick or Discord ID and display name, what they asked for and the track Spotify found, and the ID of the moderator who removed it, if one did, for 30 days. Requests Kovu turns down aren’t stored. Discord members can delete their own requests from Privacy and data; Twitch and Kick viewers can email privacy@kovu.gg to have theirs deleted sooner.
• Blocked viewers: when a server blocks someone from requesting songs, their platform ID and name stay in that server’s settings until a manager removes them.
• For the streamer we store the linked accounts’ IDs, usernames and display names, the Spotify app’s Client ID, the Discord ID of the member who linked them, and the Spotify and Kick tokens, encrypted, until the server unlinks them. Kovu never asks for or stores the Spotify app’s client secret. A secret saved before October 3, 2026 is deleted the next time Kovu renews that link’s Spotify access or shows the link on the dashboard, and the streamer is asked to authorize Spotify again. When the streamer lets Kovu read their channel’s VIPs and subscribers (for Supporter Roles, which every Twitch connection now asks for), Kovu also keeps the Twitch tokens, encrypted, until the server unlinks Twitch; otherwise it doesn’t keep the Twitch token after linking. Kovu revokes the Twitch and Kick tokens on unlink. Spotify access can also be removed in the Spotify account’s app settings.
• What’s playing: Kovu reads the streamer’s current Spotify track and queue to show them on the server’s Discord panel and in chat. It keeps the current track, and who requested it, for up to an hour.
• Chat replies name the viewer they answer. In Twitch chat they come from Kovu’s own Twitch bot account; in Kick chat from the bot of Kovu’s Kick app, or from the streamer’s account when Kick refuses that. If Twitch or Kick doesn’t post a reply, Kovu keeps the last reason they gave for 24 hours to show the streamer on the dashboard.
• The chat reminder, if the server turns it on, only posts while the chat is active. For that, Kovu notes the time of a recent chat line in a linked channel for 20 minutes, with nothing about who wrote it.
• Kovu sends Spotify the search text and the track to queue, and posts its replies in the Twitch or Kick chat. Spotify, Twitch and Kick handle this data under their own privacy policies.

A member can link their Twitch and Kick accounts on Linked accounts so servers with Supporter Roles give them a role while they are a VIP or subscriber of that server’s streamer. For each link we store the platform account’s ID and name, how it was proven (the verified Twitch account on their Discord profile, or signing in with Twitch or Kick) and when, until the member unlinks it or deletes their data. To read the Twitch account on their Discord profile, Kovu asks Discord for their connected accounts only when they press that button, and keeps only the Twitch entry Discord marks as verified. Discord’s permission to list those accounts stays on the member’s Kovu sign-in afterwards (they can remove it under Discord’s Settings → Authorized Apps), but Kovu reads them only when the member presses that button again. When they sign in with Twitch or Kick, Kovu reads the account’s ID and name and then revokes the access; it keeps no token. One platform account links to one Discord account: linking it from another moves it there, after the member confirms.

For a server with Supporter Roles, Kovu also keeps the platform IDs its streamer’s channel names as VIPs or subscribers (with when a subscription ends), so a member who links later gets their role at once, and which roles it gave to which member. These go when the support ends and the server’s grace period (at most 14 days) has passed, or with the server’s other data when Kovu leaves it. Roles a member already has stay on them as ordinary Discord roles until the server or Kovu takes them off, except that when a member deletes their data, Kovu first takes off the supporter roles it gave them.

If you link Kovu for Linked Roles, we store an encrypted Discord token that only lets Kovu update the numbers Discord shows for that connection, the server you chose, and the last numbers sent. Unlinking or Delete my data removes them and clears the numbers in Discord.

You link on Linked Roles with a separate Discord permission (“update your connection’s numbers”), never as part of signing in. Kovu then sends Discord your level and XP in the server you chose, and your rep and achievements there while that server has Reputation and Achievements on, about a minute after a level-up, rep or a new achievement, and once a day. Discord keeps one set of these numbers per person, and every server that uses Kovu in a role’s Links sees the same set and the name of the server it came from. A server sees how many members publish its numbers, never who. You can switch servers or unlink on Linked accounts, and you can also remove Kovu under Discord’s Settings → Authorized Apps; Kovu then can’t update the numbers any more, and deletes the link 30 days after its next try finds the access gone, unless you link again.

A server with Go-live Role gives members a role while they stream on Twitch or Kick. Only accounts members linked on Linked accounts count (the same links as Supporter Roles); Kovu never guesses who someone is from their name and doesn’t read Discord’s “Streaming” status. Every 2 minutes Kovu asks Twitch and Kick, with Kovu’s own app access, whether those accounts are live. It keeps each live stream’s account ID, title, game, link and start time, never viewer counts, until 30 minutes after the stream ended.

For each server with the module on, Kovu keeps which members linked Twitch or Kick, when their current stream started and ended there, whether it gave them the live role, and the “now live” line it posted. These go when the member leaves the server, unlinks the account or deletes their data, when the server turns the module off, or with the server’s other data when Kovu leaves it. Kovu only takes off live roles it gave, and takes them off when the module is turned off and before a member’s data is deleted.

A server with Events has Kovu announce the scheduled events its team creates in Discord. Kovu never creates or edits those events. For each one it keeps the event’s name, type, channel, start and end, status, whether the server announces it, the card, start post and role Kovu made for it, which reminders it sent, and how many people RSVPed, pressed Interested and came.

When a member presses RSVP, or presses Interested in Discord when the server counts it, Kovu keeps their Discord ID, which of the two it was, whether they asked for reminder DMs and when. To count who came to a voice or stage event, Kovu notes which members are in that event’s channel while the event is upcoming or running (never any other channel, and for at most 3 days without a change), counts who joined while it ran and keeps the number, never the names; the notes and the list of who came go when the event ends. Everything goes 30 days after the event ends or is canceled; a member’s RSVPs go at once when they leave the server before the event or delete their data. By default Kovu deletes the role it created for an event when the event is over, unless the server turns that cleanup off or has since given the role permissions, a color or its own place in the member list, and it never deletes any other role.

A server with Automations runs rules its staff wrote, on the dashboard or through an AI app they connected: when something happens, such as a member joining or getting a role, Kovu checks the rule’s conditions and acts, for example by giving a role or sending a DM. For each run Kovu keeps which rule ran, the member’s Discord ID, what triggered it, how it ended and a short note on why (such as which step failed). Runs are deleted after 30 days, and a member’s runs go at once when they delete their data. To apply each rule’s limits and to continue a rule that waits, Kovu also keeps counters and timers with the member’s ID for as long as the limit or the wait lasts (at most 7 days). Members can turn off automation DMs from a server with the button under them or with /utility notifications.

A server’s staff can also have a rule send what happened to a web address they choose (a webhook). Each delivery sends that address the server’s ID and name, the rule, the member’s Discord ID, username and display name, and what triggered the rule (for example the role, the channel or a stream’s title). The service at that address is chosen by the server’s staff, not by Kovu, and handles what it receives under its own terms; Kovu can’t take it back. Kovu keeps a record of each delivery (when, to which webhook, and the response code) for 30 days, never what it sent.

You can connect an AI app (such as Claude or ChatGPT) to Kovu’s MCP server, or create a personal API key, to set up servers you manage. When you do:

• We store each API key as a hash, so we can’t show it again, with its name, permissions, the servers it can reach, its expiry and when it was last used. For a connected app we store its registration and hashed access tokens.
• Kovu sends your app only what its tools return: server settings, channels, roles, similar setup and the dashboard change history. Settings can name people staff added to them, such as members a module ignores or viewers blocked from song requests. The API never exposes message content, DMs, moderation actions or bot tokens.
• Changes made through the API are recorded in the server’s dashboard change history, marked with the app or key that made them.
• Your AI app is a service you choose, and its provider processes what Kovu sends it under its own privacy policy. The AI model runs on their side, not Kovu’s.

On the dashboard you can save a server as a template, build one, or copy one someone shared with you, then apply it to servers you manage. A template belongs to you, not to a server, and is kept with your kovu.gg account.

• What a template holds: its name and description, and the roles, channels, server settings and Kovu module settings it was saved or built with, including the text in them, such as channel topics, welcome messages and automod rules. When it saves a template, Kovu takes out Discord IDs of members and other servers, member mentions, links to messages, invite links and webhooks, and lists what it left out. It does this again whenever a template is saved or opened from a share link. Kovu doesn’t store which server a template was saved from, but the template’s own text can still say what someone typed into it: a role or channel name, a topic or a message can contain a person’s name, a server’s name or anything else.
• How long: until you delete the template, or delete your data from Privacy and data, which also turns off your share links. “Download my data” includes your templates.
• Share links: if you turn on a template’s share link, anyone signed in to kovu.gg who opens it can see everything in the template and copy all of it into their own templates. The link doesn’t show who made the template. Turning the link off, or making a new one, stops the old link at once.
• Copies: a copy belongs to the person who made it. It stays with them, unchanged, when you edit or delete your template or turn its link off, until they delete it. They can share their copy by link too.
• Applying a template: the server it is applied to keeps a record of each apply, with the Discord ID of who started it, a copy of the template as applied, what was created or changed, and what Undo needs (see How long we keep data). The changes also appear in the server’s dashboard change history. If you delete your data, the records of applies you started keep the template’s name and what was created or changed, without your Discord ID or the template itself.
• The Kovu team can open a template by its ID or share link, for example to review a report, and can disable a template’s share link. The link then stops working, the owner can’t turn sharing on again for it or a copy of it they make, and they see the reason on the dashboard. Copies other people already made aren’t changed. A blocked account’s share links stop working while the block lasts.

Members of the Kovu team use an internal console to handle support requests, abuse, legal requests and outages. Each of them has a role (support, moderator, admin or owner), and the console only lets them see and do what that role needs. Depending on their role, they can look up:

• A server’s settings, modules, dashboard change history, feeds, and the API keys that can reach it, with their names, permissions and usage, never the keys themselves.
• A member’s account data: the servers they own or manage with Kovu, their custom bots, their API keys and connected AI apps with when they were last used, which kinds of data Kovu holds about them, and the countries of their kovu.gg sign-ins in the last 30 days. When you ask us to, they can also run the same data export or deletion you can run from Privacy and data.
• Transcripts and uploaded images, to review them for removal.
• Server templates, by their ID or share link, to review them and disable a share link.
• Reports sent to the Kovu team, with the reporter’s Discord ID.
• Failed background jobs, by kind, module and server, without what they contained. The team can send one back to be processed again or delete it.

The console doesn’t show message content (other than a transcript opened for review), DMs, bot tokens, API key secrets, email addresses or passwords (Kovu has none). Every lookup and action in it is recorded in an audit log with who did it and when. Team members sign in with Discord and a passkey.

When we act on the Terms of Service, by blocking an account or a server, removing content, disabling a template’s share link or placing a legal hold, we keep a record of it with the reason, who on the Kovu team decided and when. The outcome of an appeal, and what was done about an abuse report, are recorded the same way.

When we block an account or a server, we usually tell its owner in a DM from Kovu, with the reason and the address for appeals, appeals@kovu.gg. A blocked account that signs in to kovu.gg or uses the API sees the same.

Legal holds. We may keep data past the periods in How long we keep data when a law, a court order or an ongoing investigation requires it. While a hold covers a server, its data isn’t deleted when Kovu leaves it, and deleting your own data leaves your records in that server in place. When the hold ends, the normal retention periods apply again.

Copies a server posted in its own Discord channels, such as transcripts and log messages, stay until the server deletes those messages.

Backups. Data deleted from Kovu’s databases can stay in backups for a while: Cloudflare keeps 30 days of restore points for them, and we keep a weekly copy of each database for 12 weeks in private Cloudflare storage. Transcripts and uploaded images aren’t in those copies.

Kovu runs on Cloudflare (hosting, databases and storage) and talks to Discord’s API. Both process data on our behalf to run the service. If a server turns on AI moderation, message text (only what automod’s own rules let through, when automod is on) is classified by an AI model that runs on Cloudflare (Workers AI); it isn’t sent to any other AI provider. Our weekly database backups are made by an automated job on GitHub Actions, which copies them to Cloudflare storage.

When a member uses /search, Kovu sends the search text, without who asked, to the service that answers it (Wikipedia, Urban Dictionary, AniList, Open-Meteo, a dictionary service, YouTube or a translation server). When a server uses Song Requests, Spotify, Twitch and Kick receive what that feature needs (see Song requests). When staff import levels from MEE6, Kovu reads the server’s public MEE6 leaderboard. When Google Analytics runs, Google provides it for us (see Usage statistics). If you connect an AI app, its provider receives what you ask Kovu for (see AI apps). If a server’s automations post to webhooks, the services at the addresses its staff chose receive what each delivery carries (see Automations). If you share a template, the people who open its link see what’s in it (see Server templates). We only disclose data beyond that if the law requires it.

Emails to appeals@kovu.gg are received by Cloudflare Email Routing and forwarded to the Kovu team’s mailbox.

Kovu is free right now, so we don’t collect payment data. Two paid tiers are planned for later. Before they start, we’ll update this policy to say what payment data is collected, which payment provider processes it and why, and we’ll note the change in Kovu’s updates channel.

We use strictly necessary cookies to keep you signed in and the site secure, and, only with your consent, preference cookies to remember your theme and language. Google Analytics cookies follow the rules in Usage statistics: in the EU, EEA, UK and Switzerland only with your consent, elsewhere until you turn them off. There are no advertising or cross-site tracking cookies. The Cookie Policy lists each one, and you can change your choices at any time in cookie settings.

kovu.gg uses Google Analytics to learn which pages and dashboard features get used, so we know what to improve. Whether it runs depends on where you are:

• In the EU, EEA, UK and Switzerland, or if we can’t tell your country, nothing loads until you turn on Analytics in cookie settings.
• Everywhere else, it’s on from your first page view. A notice says so, and you can turn it off with one click, or later in cookie settings.
• Anywhere, it never loads while your browser sends a Global Privacy Control signal, or after you turned it off.

The status page, status.kovu.gg, follows the same rules. Outside the EU, EEA, UK and Switzerland it shows a short notice with a one-click way to turn Analytics off. A choice made on either site applies to both. To pick a rule, Cloudflare works out your country from your IP address; we use it only for that and don’t store it. On the status page, Google Analytics receives only a page view (the page’s address without any query, and only the site you came from rather than the full link) and whether you expanded an incident, never a server ID you look up. On kovu.gg, Google Analytics receives:

• The path of each page you open, with server and member IDs replaced (for example /dashboard/:guild/levels) and without search text or other query details.
• Feature events, such as turning a module on or off, saving settings, posting a panel, creating an API key, using the command palette, a step of the first-run setup, or something done with a server template (such as saving, sharing or applying one). Each carries only fixed details: which module, which kind of action or item, which step of the first-run setup, or the theme you picked. Never which server, template, role, channel or item.
• What Google Analytics reads from your browser: a random ID kept in its cookies, your browser, device type, screen size and language, and an approximate location (such as the country) that Google works out from your IP address without storing it.

We never send your Discord ID, email address, server IDs or names, member names or message content. Only analytics storage is used: advertising storage, Google signals and advertising features are off, and Google Analytics keeps the event data for 2 months. Google acts as our processor under its data processing terms. Turning Analytics off stops it straight away and deletes its cookies.

You can sign out and revoke Kovu’s access in Discord (User Settings → Authorized Apps). Server owners can remove Kovu at any time. Signed-in members can export or delete their personal data themselves from Privacy and data. To access, correct or delete your data any other way (for example song requests you made from Twitch or Kick), or a server’s data if you own it, email privacy@kovu.gg. We answer within 30 days.

Kovu is operated by the Kovu team, reachable at privacy@kovu.gg. Under the GDPR and UK GDPR we rely on these legal bases:

• Performing our service (contract): signing you in, running the features a server turns on, and keeping your dashboard settings.
• Legitimate interests: security, preventing abuse, moderation records and logs that server staff rely on, and keeping Kovu reliable. We balance these against your rights, and you can object.
• Consent: optional cookies, including Google Analytics. You can withdraw consent at any time in cookie settings, without affecting what happened before.
• Legal obligations, when the law requires us to keep or disclose data.

You have the right to access, correct, delete, restrict or port your data, to object to processing based on legitimate interests, and to withdraw consent. Signed-in members can export or delete their personal data from Privacy and data. For anything else, email us. You can also complain to your local data protection authority.

Cloudflare, Discord and, if you allow analytics, Google may process data outside your country, including in the United States. Where they do, the transfer is covered by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

This section is our notice under the California Consumer Privacy Act, as amended by the CPRA. In the last 12 months we collected these categories of personal information, for the purposes described above:

• Identifiers: Discord user ID, username, display name, avatar and email address, and for song requests, Twitch, Kick and Spotify account IDs and display names.
• Internet or other electronic network activity: dashboard change history, command logs, messages processed by the features a server turns on, song requests, the countries of your kovu.gg sign-ins, and the pages and features used on kovu.gg (Google Analytics).
• Inferences: none. We don’t build profiles about you.

We collect this from you, from Discord and, when a server uses those features, from Twitch, Kick, Spotify and MEE6’s public leaderboards. We don’t sell or share personal information, use it for cross-context behavioral advertising, or use sensitive personal information for anything beyond providing the service, and we haven’t done so in the last 12 months. Retention periods are in the “How long we keep data” section above.

You have the right to know what we collect and how we use it, to delete it, to correct it, and to opt out of any sale or sharing. We won’t treat you differently for using these rights. To use them, go to Privacy and data or email privacy@kovu.gg; we verify requests against your Discord account, and you can use an authorized agent. We honor Global Privacy Control as an opt-out of sale or sharing, and you can record one yourself in Your Privacy Choices.

Kovu is not for people under Discord’s minimum age in their country.

If we change this policy, we’ll update the date above and note important changes in Kovu’s updates channel.