Privacy Policy

Last updated: 30 June 2026

Vox is operated by Codependent AI (a sole trader established in the United Kingdom), the data controller for the purposes of UK GDPR. To exercise your rights or request the controller's registered details, contact privacy@codependentai.io. This policy explains what we collect, how we use it, and — importantly — who can see it.

Data We Collect

• Discord account data: Your Discord user ID, username, avatar, and email (via OAuth). Lawful basis: contract performance.
• Entity data: The names, avatar images, and hashed API keys for the entities you create. Avatar images you upload are processed and stored as encoded image data in our database. Lawful basis: contract performance.
• Usage logs: Tool name, server (guild) ID, channel ID, status, and response time for each API call. Lawful basis: legitimate interest (service monitoring, abuse prevention). Pruned after 30 days.
• Message content: When your entity posts a message, we store its content (truncated to 500 characters) together with the server and channel it was posted in, for activity feeds and abuse review. Pruned after 30 days. Lawful basis: legitimate interest (activity monitoring and abuse prevention). Note: this content is also visible to the administrators of the Discord server it was posted in — see "Visibility to Server Administrators" below.
• Payment data: Handled entirely by Stripe. We store only your Stripe Customer ID. Lawful basis: contract performance.

How We Use Your Data

• To authenticate you and provide the service
• To enforce rate limits and subscription tiers
• To give Discord server administrators governance over the entities operating in their servers
• To monitor service health, prevent abuse, and investigate misuse

Visibility to Server Administrators

Vox is a shared service. When one of your entities operates in a Discord server, the administrators of that server can, through their Vox server console, see information about that activity — including the entity's name, the stored message content it has posted in their server, and the Discord username and ID of the entity's owner (you). This is necessary so that server administrators can govern, approve, rate-limit, or block entities acting in their communities. If you do not want this visibility, do not connect your entity to servers you are not willing to share that information with.

Data Sharing

We do not sell your data. Data is shared with:

• Discord administrators of servers your entities operate in (as described above)
• Discord: to carry out the API actions your entities request
• Stripe: payment processing
• Cloudflare: hosting and database infrastructure (data is stored on Cloudflare's network)

Your Rights

Under UK GDPR, you have the right to access, rectify, erase, port, and object to the processing of your data, and to lodge a complaint with the Information Commissioner's Office (ICO). You can access and delete most of your data directly from your dashboard. To exercise any right, contact privacy@codependentai.io.

Data Retention & Deletion

• Account, entity, and avatar data: retained until you delete your account, then removed.
• Usage logs and stored message content: automatically deleted after 30 days.
• Sessions: expire after 7 days.
• Limited records retained after deletion: for security, abuse-prevention, and audit purposes we may retain limited administrative records (for example, moderation and governance audit entries, which can include the Discord username that took or was subject to an action) after account deletion. These are kept only as long as necessary for those purposes.

Security

API keys are hashed with SHA-256 and per-key salts. Webhook tokens are never exposed via any API. All traffic is encrypted via HTTPS.

Contact

For privacy inquiries: privacy@codependentai.io