Privacy policy

01In short

• PhiBot keeps what it needs to draw your cards: who you are signed in as, a session token for your Phigros save, and your card settings.
• Some card features send scores to phib19.top to work out tags, ranks and comparisons. Your name and account are not sent.
• Nothing is sold, and there are no ads or tracking cookies.
• You can unbind your save at any time, and ask for everything else to be deleted.

02What PhiBot keeps

• Account. Your Discord user ID, name and avatar, or your TapTap name, avatar and Phigros cloud account ID, depending on how you sign in.
• Save access. The session token for your Phigros cloud save, and a cached copy of the save so cards load quickly.
• Score history. Snapshots of your scores and RKS over time, for the History and Info cards.
• Settings. Your card options, such as layout, background and which extras to show.
• Manual scores, if you type them in.
• Share link, if you make one.
• Card images. Drawn cards are cached so the same card is not drawn twice.
• Logs. Server logs record requests and errors with your user ID, to find and fix problems.
• Page views. Vercel Analytics counts page views without cookies.

Cookies keep you signed in and remember your language and theme; short-lived ones carry a sign-in from one step to the next. Your browser also remembers small choices, such as a dismissed notice.

03How it is used

Only to run PhiBot: to sign you in, read your save, draw your cards, remember your settings, keep the service fast and fix problems. Nothing is used for advertising or profiling.

04Who else sees it

• Phigros cloud (Pigeon Games, TapTap). PhiBot uses your session token to download your save, the same way the game does.
• Discord, for sign-in and for the bot's replies.
• phib19.top, a community Phigros database. For the tag profile, peer comparisons and song rank, PhiBot sends it the scores those features need: song, difficulty and accuracy, without your name or account. Card options let you turn the tag profile and comparisons off.
• Vercel hosts the site and its logs. Cloudflare stores your data (KV) and cached card images (R2).
• Anyone with your share link can see the cards it shows.
• Authorities, only when the law requires it.

05How long it is kept

Your data stays while you use PhiBot. Unbinding deletes the session token and the cached save straight away. Score history, settings, manual scores and your share link stay until you clear them or ask for deletion. Cached card images and logs are removed over time.

06Your choices

• Unbind your save from your cards page, or with the bot.
• Clear manual scores and turn your share link off from your cards page.
• Ask for a copy of your data, a correction, or deletion of everything tied to your account on GitHub. Depending on where you live (under the GDPR, for example), these are also legal rights.

07Security

Tokens and data sit on access-controlled services and travel over HTTPS. No system is perfectly safe; if a breach affects you, the site will say so.

08Children

PhiBot is not meant for children under the minimum age for a Discord or TapTap account where you live.

09Changes

This policy may change. The date at the top shows the latest version. Read it together with the terms of use.

10Contact

Privacy questions and requests: GitHub.