PonderPro Privacy Policy

Last updated: 2026-10-09

This Privacy Policy explains what data PonderPro ("the bot," "we," "us") collects when a Discord server ("guild") adds the bot, and how that data is used.

1. What we collect

• Discord identifiers. Server (guild) ID, channel IDs, and user IDs, whichever Discord itself assigns. These are necessary for the bot to function (knowing where to post, who submitted what, who to congratulate on a birthday).
• Content you or your server members provide voluntarily, through the bot's own commands: submitted prompts, quiz questions, and polls, server facts (Pro tier), birthdays (month/day, year optional), and quiz answers/scores and poll votes.
• AI feature inputs. If a server admin uses an AI feature in the dashboard (currently the AI Quiz Generator), we store what they enter: the quiz topic, difficulty, and any source text they paste. Pasted source text is deleted 24 hours after the generation, when its free-reroll window closes. The topic and difficulty stay with the quiz, and the generated questions are saved as ordinary quiz questions the admin can edit or delete. For each AI request we also keep a usage record (the server, billing account, and Discord user ID that made it, which feature, how much AI processing it used, its cost, and whether it succeeded), used to enforce plan allowances and our spending limits. Usage records don't contain the topic, source text, or generated questions.
• Subscription status, if a server subscribes to a paid tier: which plan (Pro or Pro Plus), whether it's active, billing interval, and renewal date. If the plan is Pro Plus, we also store the Discord user ID of the account that purchased it, since one subscription can cover more than one server. Payment itself is handled entirely by Stripe; PonderPro never sees or stores credit card numbers.
• Web dashboard login. Signing in to the PonderPro Dashboard (app.ponderpro.app) with Discord gives us your Discord user ID and, for that request only, uses your Discord OAuth token to check which servers you have Manage Server permission on. We don't store the OAuth token itself; your logged-in session lives in a signed cookie held by your own browser, not in our database.
• Standard hosting logs. Like most web services, our hosting provider (Railway) may log IP addresses and basic request metadata for security and reliability purposes. We don't use this for anything beyond that.
• What we do not collect: PonderPro does not read regular chat messages. It only sees what's sent directly to its own slash commands and button interactions (Discord's "Message Content" permission is intentionally left disabled). (That's the PonderPro bot. Pip, the AI helper in our own support server, is a separate app that does read messages there; see Section 5.)

2. How we use it

• To operate the features you've configured: scheduled posts, quizzes, leaderboards, birthday shout-outs, and tier enforcement (free vs. Pro limits).
• To generate quiz questions when a server admin asks an AI feature to.
• To track referral rewards, if a server used another server's referral code.
• To understand how the bot is used, such as which features servers use and how often, so we can improve it. This is viewed internally only and never shared.
• To provide support if you contact us.

We do not sell data to third parties. We do not use your data for advertising.

3. Who we share it with

• Stripe, for payment processing on Pro subscriptions, governed by Stripe's own privacy policy.
• Railway, our hosting provider, which stores the underlying database on our behalf.
• Anthropic, which provides the AI model (Claude) behind PonderPro's AI features. Only when an admin uses one, we send Anthropic the text they entered (topic, difficulty, number of questions, and any pasted source text) and the text of the quiz's existing questions, so new questions don't repeat them. For these features, no chat messages, member data, or Discord IDs are sent. Pip, in our support server, is the one exception; see Section 5. Under Anthropic's commercial terms it may not train its models on this content, and under its published retention policy it deletes API inputs and outputs within 30 days, except where it must keep them longer to enforce its usage policy or to comply with law.

None is given any more access than is needed to provide their service to us.

4. Data retention and deletion

Data tied to a server is kept for as long as the bot remains in that server. If a server removes the bot, its data is deleted about 30 days later, so re-adding the bot after an accidental removal loses nothing. Three exceptions: billing, referral, and promo-code records, and AI usage records (which contain no content), are kept for accounting and to prevent a one-time promo being reused; quizzes a server published publicly stay available to other servers; and a server still covered by an active Pro subscription or grant keeps its data until that ends. To request deletion of a specific user's data (e.g. a birthday) sooner, contact us at the address below.

5. Our support server and Pip

PonderPro's Discord support server has an AI helper called Pip, a separate Discord app from the PonderPro bot. Unlike PonderPro, Pip reads messages, but only in that one server:

• What Pip reads. Like any bot in a server, Pip receives the messages in the support server's public channels, but it only acts on new messages in #community-support and in the threads it starts there, and on messages in #general that mention Pip or reply to it. It ignores everything else, including staff and other bots, and stores none of it.
• What goes to Anthropic. To answer, Pip sends Anthropic the text of the message and up to five earlier messages in the same conversation, labeled only as the member, another member, staff, or Pip. No usernames or Discord IDs are sent. Anthropic handles this text as described in Section 3.
• What we store. Pip doesn't store members' messages. For each answer it keeps a usage record (the time, the channel and message IDs, what Pip decided, how much AI processing it used, its cost, and whether it succeeded), the text of its own reply, and any thumbs-up or thumbs-down feedback along with the Discord user ID of the person who gave it. When Pip passes a question to our team, it posts a link and a short summary of the request in a private staff channel in the support server.
• How long. Usage records and Pip's replies are deleted after 90 days. Feedback is kept so we can review it and improve Pip's answers. Staff posts stay in Discord like any other message.

Please don't share passwords, payment details, or other private information in public channels. For anything about your account or a charge, open a private ticket in #create-a-ticket.

6. Children's privacy

Discord's own Terms of Service require users to meet Discord's minimum age (13, or higher in some countries). PonderPro does not knowingly collect data from anyone below that age, and relies on Discord's own age requirements rather than independently verifying age itself.

7. Your rights

Depending on where you live, you may have rights to access, correct, or delete your data. Contact us at the address below to exercise these.

8. Changes to this policy

If this policy changes materially, we'll update the "last updated" date above and, where required, notify server admins.

9. Contact

support@ponderpro.app