Privacy Policy

Information used by the website

• Discord account information: when you sign in, the website requests your Discord identity and stores your Discord user ID, display name or username, and account creation time. The sign-in request uses the identify permission, not access to your messages or server memberships.
• Purchase information: when billing is enabled, the website links your account to a Stripe customer ID and stores checkout identifiers, price identifiers, purchase status, access end dates, purchase timestamps, payment identifiers, refund and dispute status, and billing-event identifiers.
• Session information: the website stores hashed session tokens and expiration times to keep you signed in, and temporary one-use values to verify Discord sign-in.
• Connection information: Cloudflare receives information needed to deliver and protect the website, such as your IP address, requested URL, and browser request headers. The website also stores temporary request counters under hashed IP-address and account identifiers to limit abusive traffic; these counters do not store raw IP addresses.

Why this information is used

Account information connects you to your own membership. Session data supports sign-in and protects account access. Billing records confirm payments, apply purchased access, and help prevent duplicate or fraudulent requests. Hosting information supports delivery, reliability, and security.

Discord membership roles

The Kymera bot uses your Discord account ID to check your membership and roles in our server and keep the Kymera Jr role in sync with your paid access. This can add or remove that role after a purchase, expiry, refund, or dispute. Existing temporary free access is preserved until its stated cutoff. We store role-update events, retry status, and any preserved temporary-access cutoff so interrupted updates can be retried. These records do not currently have an automatic deletion schedule. The bot does not automatically join you to the server.

Desktop device access checks

At the first successful client launch, Kymera links your Discord account to a hardware fingerprint derived from system and motherboard firmware identifiers. The client hashes these identifiers with your account ID before sending the fingerprint over an encrypted connection; raw hardware serials are not sent to the access server. The server stores a hash of that fingerprint, the binding time, and administrator reset records to limit account sharing and verify later launches.

Only an authorized administrator can reset the binding. A reset invalidates existing loaders and sessions, and a fresh download is required. Device binding and reset records do not currently have an automatic deletion schedule. Contact the privacy contact below for account-information requests.

Service providers

Discord handles identity verification. When billing is enabled, Kymera sends your Discord account ID and display name to Stripe to associate your customer record with your account. Stripe handles checkout and billing details; this website does not collect or store full card numbers or card security codes.

Cloudflare hosts the website, account database, and server functions. These providers may process information outside your country under their own privacy policies. Information may also need to be disclosed when required by applicable law.

Cookies

The website uses essential cookies when you sign in: a temporary Discord sign-in cookie lasting up to 10 minutes and a session cookie lasting up to 7 days. Signing out invalidates your website session and clears its cookie. Blocking these cookies prevents account sign-in from working.

The website does not include advertising trackers or third-party analytics scripts. Cloudflare may use cookies or other request information for security and service delivery. External providers manage cookies on their own pages.

Storage and retention

Session records expire after 7 days and expired records are removed during subsequent sign-in activity. Temporary sign-in records expire after 10 minutes. Rate-limit counters expire within 10 minutes and are cleared in batches during subsequent traffic. Account and purchase records do not currently have an automatic deletion schedule. Billing-event identifiers are retained to avoid processing the same notification twice.

Requests to delete personal information must be reviewed for account security and any applicable legal or billing record obligations. Signing out does not delete your account, refund a purchase, or remove records held independently by Discord, Stripe, or Cloudflare.

Your choices and requests

You can choose not to sign in, sign out of the User Panel, and view purchased access and billing information in the User Panel. To request access, correction, or deletion of your account information, use the privacy contact listed below. We may need to verify that you control the account before acting on a request. Rights may vary with applicable law.

Updates

Changes to this policy will be posted here with an updated date. Material changes to how information is used should be explained before the new use begins, with consent requested where required.