This Privacy Policy explains what data Spud collects, why, and who it's shared with. It applies to your use of Spud in any Discord server it's added to.
| Data | Source |
|---|---|
| Discord user IDs (task owner, project team lead) | Automatically, from your Discord account when you run a command |
| Discord channel ID and server (guild) ID | Automatically, from the channel a project is started in |
| Project title, linked GitHub repository name, default branch | Typed or selected by whoever runs /project start |
| Task descriptions, branch names, task status, timestamps | Typed by whoever runs /claim, generated by Spud for branch names |
| A reference to the handbook message posted in your channel | Generated by Spud after /project configure with a handbook attached |
Data is used solely to operate Spud's features: rendering the claim board, detecting likely duplicate task claims, generating branch names, and comparing pushed branches against a project's default branch to nudge on scope drift. We do not sell your data or use it for advertising.
Spud relies on a small number of third-party services to function. Each processes a limited slice of the data above, only as needed to provide that part of the Service:
| Service | What it receives | Why |
|---|---|---|
| Discord | Everything you send Spud, by nature of running on Discord's platform | Spud is a Discord bot — this is the platform it runs on |
| Google Gemini API | Task descriptions, and changed-file names (not file contents) from a linked repo | Overlap detection, branch naming, and scope-drift judgment |
| GitHub | Repo/branch metadata and changed-file names, via Spud's own read-only GitHub App | Comparing branches to detect scope drift, and detecting merges |
| Turso | All data listed in section 1 | Hosts Spud's database |
| Grafana Cloud | Application logs, which include Discord user IDs and project/task identifiers | Operational monitoring and debugging |
Data for an active project is kept until the project is ended. Ended projects are archived, not deleted — their board and task history remain in the database unless you ask us to delete them (see below). Logs are retained according to our Grafana Cloud plan's standard retention window.
Spud doesn't yet have a self-serve way to delete your data. If you'd like your data (or an entire project's data) deleted, contact us using the details in section 9 and we'll remove it.
Spud is not directed at children. Discord itself requires users to be at least 13 years old (or the minimum age required in your country) — Spud does not knowingly collect data from anyone younger.
Webhook requests are verified with an HMAC signature so only GitHub's actual webhook delivery is accepted. Secrets are never written to logs, and data in transit is encrypted (HTTPS/TLS).
This policy may be updated as Spud's features change; material changes will be reflected by updating the effective date above. For any privacy question or a data deletion request, DM @manazo on Discord — or open an issue on the Spud GitHub repository.