Privacy Policy

Introduction

This Privacy Policy describes how discord-webhook.com ("the Service"), operated by RootCore ("we", "us", "our"), handles information when you use our Discord webhook message builder. The Service offers both unauthenticated and authenticated features, each with different data practices. We're committed to being transparent about what we collect and why.

What the Service Does

Discord Webhook is a free, browser-based tool that lets you compose and send messages to Discord channels via webhook URLs or bot tokens. Beyond basic message sending, the Service supports scheduled messages, interactive components (buttons and select menus with configurable actions), message editing via bot, and publicly shared message templates. Some features work without any account; others require Discord login.

Information We Collect

Unauthenticated Usage

When you use the Service without logging in, we collect no personal data. Specifically:

• Webhook URLs you enter are processed in your browser and sent directly to Discord's API. They never touch our servers.
• No names, email addresses, or passwords are collected.
• No analytics services (such as Google Analytics) or tracking pixels are used.
• No advertising networks or third-party trackers are present on the site.

Authenticated Usage (Discord Login)

You can optionally log in via Discord OAuth2 to access advanced features. When you do, we store:

• Your Discord user ID and username.
• Your Discord avatar URL.
• Your OAuth2 access token, encrypted at rest in our database.
• We do NOT store your Discord password. We do NOT request or access your email address.

Custom Bot Tokens

Logged-in users can optionally add their own Discord bot tokens to unlock advanced features. When you do:

• Your bot token is encrypted using AES-256 before being stored in our database.
• The token is used solely to send messages and fetch guild/channel data on your behalf.
• The token is permanently deleted from our database the moment you remove the bot from your account.

Webhook URLs

How we handle webhook URLs depends on how you're using the Service:

• For direct sending: the request is made entirely from your browser to Discord's API. The URL is not stored on our servers, not logged, and not shared with any third party.
• For scheduled messages: the webhook URL and message payload are temporarily stored on our server until the scheduled delivery time, then deleted after the message is sent.

Scheduled Messages

When you schedule a message, we store the webhook URL and message payload until the delivery time. Here's what happens after:

• Successfully sent messages are marked as sent. You can delete them from your dashboard at any time.
• Failed messages retain basic error information to help you debug delivery issues.
• You can delete any scheduled message at any time before or after delivery.

Interactive Components

When you create messages with buttons or select menus that have configured actions (role assignment, ephemeral messages, application forms), we store the action configuration in our database. A few things to know:

• Actions are linked to message and component IDs, not to individual user profiles.
• Expired or orphaned action configurations are periodically cleaned up from our database.

Message Content Access

Our bot may fetch messages from Discord channels when a server administrator explicitly requests it through the dashboard (for example, to edit an existing message). Message content retrieved this way is displayed in your browser for editing purposes and is NOT stored in our database.

Templates

The Service offers a feature to save and load message templates. These templates are stored on our server and are publicly accessible — no authentication is required to save or load them. Do not include sensitive or private information in templates you save, as they may be viewed by anyone.

Local Storage

The Service may use your browser's local storage to save user preferences (such as interface settings) locally on your device. This data never leaves your browser and is not transmitted to our servers.

Data Security

We take reasonable steps to protect the data we store:

• All connections to the Service are secured via HTTPS.
• Sensitive data (OAuth tokens, bot tokens) is encrypted at rest using AES-256.
• Sessions have expiration times and are cleaned up automatically on an hourly basis.
• We use Cloudflare for additional DDoS protection and web application firewall (WAF) coverage.

Data Retention & Deletion

Here's how long we keep different types of data:

• Account data (Discord ID, username, avatar): retained while your account exists.
• OAuth tokens: automatically refreshed as needed, deleted when your account is deleted.
• Bot tokens: deleted immediately when you remove the bot from your account.
• Scheduled messages: deleted after delivery or on your request.
• Interaction action configs: periodically cleaned up when expired.
• Sessions: expired sessions are removed automatically every hour.
• To request deletion of your data, contact us via our Discord server or rootcore.tech. All data is permanently removed within 48 hours of your request.

Cloudflare

We use Cloudflare for content delivery (CDN) and security. Cloudflare may set cookies and process certain technical data (such as IP addresses) as part of its standard operation to protect the site from abuse and deliver content efficiently. For details, please refer to Cloudflare's Privacy Policy.

Children's Privacy

The Service is not directed at children under 13. For authenticated features, we store limited Discord profile data as described above. Use of Discord is subject to Discord's own age requirements.

Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated "Last updated" date. We encourage you to review this page periodically.

Contact

If you have any questions about this Privacy Policy, you can reach us through our Discord server or via the website at rootcore.tech.