Privacy Policy

What we store

• Your Discord id, username, avatar, and email — from Discord sign-in, to identify you and run the service.
• For every connected Discord account (your own, or extra ones if your role allows it): its token — encrypted, see below — plus its username and avatar so you can tell your accounts apart.
• Quest preferences and run history per connected account — which categories are farmed, and what completed.
• Session metadata — IP address and browser, tied to your login session, for account security and abuse prevention.

How a token is encrypted

The moment a token reaches our server, it is sealed with public-key encryption (X25519 + AES-256-GCM) before it ever touches a database. The web server that receives it only ever holds the public key — it physically cannot decrypt it again.

Only the separate farming worker holds the private key. It decrypts a token in memory, only while a quest run is active for that account, and never writes the plaintext token anywhere. The database itself (Cloudflare D1) also encrypts everything at rest.

The status ad, and restoring it

We set that account's Discord custom status to a short text ad for this site for the duration of a quest run, and remember what the status was immediately before we changed it. Member accounts always carry the ad while farming; VIP accounts can switch it off per account, and admin accounts never carry it.

• When the run finishes (success or failure), the original status is restored automatically.
• If you cancel a run early, the original status is restored immediately.
• If the status is changed mid-run some other way, we periodically re-apply the ad until the run ends — then restore what was last set.
• The saved "original status" snapshot is deleted as soon as it's restored.

Cookies

One first-party, httpOnly session cookie to keep you signed in. No third-party trackers, no analytics cookies, no ad networks.

Who can see this data

Only the Disquest Helper systems that need it: the web app (profile, preferences), the farming worker (a connected account's token, in memory only, while it's running), and the Cloudflare-hosted database that stores it all encrypted at rest. We do not sell or share your data with third parties.

How long we keep it

Data is kept for as long as your account exists, so the service keeps working. Expired or revoked login sessions are cleaned up automatically. Run history and audit logs may be kept briefly after a related action for abuse prevention, but are removed along with everything else when you delete your account.

Deleting your data

Disconnect a single account, or permanently delete your entire account, at any time from Dashboard → Accounts. Full deletion immediately and permanently removes every connected account's token, preferences, and run history — there is no recovery.

Age

This service follows Discord's own minimum age requirement. Don't use it if you don't meet Discord's minimum age to hold an account.

Changes to this policy

If we materially change what we collect or how we use it, you'll be asked to review and accept the updated policy the next time you sign in.

Contact

Questions about this policy: reach out via the contact details listed on disquesthelper.xyz.