Privacy Policy

Data BotFragg processes

BotFragg processes the following information to provide its features:

• Discord identifiers: your Discord user ID, and where relevant guild and channel IDs. These associate a Discord user with their BotFragg records and support command analytics and configured operational logs.
• Riot account information: Riot PUUID, in-game name and tag, region, and the encrypted session credential payload needed to retrieve account data.
• Preferences and account state: selected account, daily shop DM setting, in-game-name visibility setting, shop-sharing setting, and account timestamps.
• Alerts: the skin identifier and creation time for each alert.
• Command analytics: command name, Discord user ID, guild ID and channel ID when available, and the time the command ran. These records are retained for 90 days by default. Command option values are not included.
• Operational records: where configured, BotFragg stores the channel and message IDs of its shard-status message. Optional Discord logs may include guild or shard information described below.

BotFragg processes slash-command interactions and the values you submit to those commands, including in DMs. It does not request Discord's privileged Message Content intent or process ordinary message text.

Riot sign-in and VALORANT data

When you use /login, sign-in takes place on Riot's website. BotFragg does not ask you to type your Riot password into Discord. You return a Riot redirect URL through an ephemeral Discord form; BotFragg processes its authorization code, exchanges it with Riot, and stores the resulting session credentials encrypted with the operator's Fernet TOKEN_ENCRYPTION_KEY.

BotFragg sends the necessary Riot session credentials and account identifiers to Riot authentication and VALORANT endpoints to retrieve your store, wallet, mission, battlepass, crosshair, rank, account level, recent match information, and equipped cosmetics. Crosshair profiles are decoded in memory, cached for up to five minutes, and never written to BotFragg's database. Profile data is cached in memory for five minutes and finished match summaries, which include other players' combat statistics, for the lifetime of the process; neither is written to BotFragg's database. It also requests public game catalog and version data from VALORANT-API.com. Those external services handle requests under their own terms and privacy practices.

Discord messages and optional integrations

BotFragg sends command responses and alert DMs through Discord.

/crosshair view replies privately. If you choose Share and confirm, BotFragg posts the selected crosshair's profile name, export code, and rendered image to the current channel with your Discord display name. Anyone who can read that channel can see the post.

/profile replies in the channel where it is used, so anyone who can read that channel can see the rank, level, equipped title, and recent-match summary it shows. The hide-name setting replaces your Riot ID with a generic label.

/loadout also replies in the channel where it is used and shows your equipped skins, their variants, gun buddies, and player card to anyone who can read that channel.

By default, others cannot view your profile. Enabling profile sharing in /settings lets anyone run /profile with your user and see the same card; it is off until you turn it on, and turning it off again takes effect immediately. Profile data is read from the same shared in-memory cache regardless of who asks, so a profile viewed by many people does not cause extra Riot requests.

Operators may enable additional destinations:

• Guild join and leave logs can include the server name and ID, owner ID, creation time, member count, text and voice channel counts, server icon, and BotFragg's current server count.
• Application log channels receive plain-text log lines after BotFragg filters credential fields and common Riot or Discord identifiers.

Discord and any configured monitoring or logging service apply their own policies and retention controls to information they receive.

Storage, retention, and deletion

The operator stores BotFragg records in the configured SQLite or PostgreSQL database. Command analytics are deleted automatically after 90 days by default; the operator can configure ANALYTICS_RETENTION_DAYS to a different window. Account, alert, and preference records are kept until you remove them or the operator's retention policy removes them.

• /logout removes stored Riot credentials for an account. It keeps the linked account record, alerts, and preferences.
• /deletedata confirm:True deletes your linked accounts and encrypted credentials, alerts, preferences, and command analytics from BotFragg's database.

Deleting data from BotFragg does not delete crosshair cards you shared to a channel, messages in configured logging channels, or telemetry already received by Discord. Those copies follow the relevant service's retention and deletion controls. Operator-managed backups may also retain records until those backups expire.

Your choices and privacy requests

Use /settings to control daily shop DMs, in-game-name visibility, and whether other users may view your shop. Use /logout to remove account credentials or /deletedata confirm:True to remove your BotFragg records. For a privacy question or a request about data that the commands do not remove, contact the team through the BotFragg support server.

Security

Riot session credentials are encrypted at rest using the operator's Fernet key. Operators should restrict access to the database, encryption key, backups, log destinations, and monitoring service. BotFragg's logging filters reduce exposure of sensitive values, but users should never submit passwords, verification codes, recovery codes, or session tokens in support posts.

Changes to this policy

This policy may be updated when BotFragg's data handling changes. The current version is maintained in this repository.