Privacy policy

Last updated: November 03, 2026

1. Controller

Jon Hübler, Mozartstraße 6, 73117 Wangen, [email protected]

2. What we process and why

• Discord account data (user ID, username) - to provide the bot and the website (Art. 6 (1)(b) GDPR).
• Game data: timezone, advent progress, Candy Canes, items, badges, game scores, snowball stats, tree ornaments.
• Content you create: wishlist, letter to Santa, Secret Santa hints and anonymous messages, gift notes.
• Server data: server ID, name, member count, channel and role names (for the dashboard), settings.
• Purchases: product, amount, status and Stripe reference. Card data is processed only by Stripe. We keep payment records as required by tax law (Art. 6 (1)(c) GDPR), even after you delete your account - but without the link to your Discord ID.

We do not read your Discord messages (the bot has no message-content access), show ads, sell data or use tracking or analytics tools.

3. Login

When you log in with Discord we request the scopes identify and guilds once to read your account and the servers you manage. The access token is revoked immediately afterwards and never stored.

4. Cookies

We only use one technically necessary cookie (cleo_session) to keep you logged in (§ 25 (2) TDDDG). No consent is required and there are no other cookies.

5. Server logs

Our web server does not write access logs. IP addresses are held only in memory for a short time to rate-limit abuse.

6. Recipients

• Discord Inc. (USA) - the bot runs on Discord; their privacy policy applies to Discord itself.
• Stripe Payments Europe Ltd. - payment processing when you buy premium.
• Our hosting provider (data processing agreement, Art. 28 GDPR).

7. Storage duration

Season data is kept as long as you use CleoChristmas. Letters to Santa and Secret Santa messages are deleted after the season. Website sessions expire after 3 days. You can delete everything at any time.

8. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a supervisory authority. Self-service: /privacy export and /privacy delete on Discord, or your privacy page.

9. Children

Discord requires users to be at least 13 (or older depending on your country). Please ask a parent before buying premium.