Skip to content

PRIVACY.md

Latest commit

 

History

History
87 lines (52 loc) · 5.22 KB

PRIVACY.md

File metadata and controls

87 lines (52 loc) · 5.22 KB

Privacy Policy

Effective date: 2026-05-08

This Privacy Policy describes what data the Squad Up plugin and its hosted services collect, store, and process when you use the plugin. Squad Up is a personal/hobby project; the services described here are operated by binaryj (the author).

If you have questions about this policy, open an issue at https://github.com/binaryj/squad-up/issues.

What Squad Up is

Squad Up is a Decky Loader plugin that runs on your Steam Deck. It lets you browse your Discord servers, see who is in voice channels, and join, move, or disconnect from voice channels from the Quick Access Menu. The plugin connects to two services operated by the author:

  • Squad Up Worker — a Cloudflare Worker that handles the Discord OAuth handshake and proxies bot-token-authenticated REST calls to Discord.
  • Squad Up bot — a Node.js service that maintains a Discord gateway connection and tracks voice presence in real time.

Together with the plugin, these are referred to as "Squad Up" in this policy.

Data Squad Up handles

OAuth tokens (access + refresh)

When you authenticate with Discord through Squad Up, the Worker briefly holds your Discord OAuth access token and refresh token under a one-time, six-digit code valid for 5 minutes. As soon as the plugin claims that code, the entry is deleted from the Worker's KV store. After that, your tokens are stored only locally in the plugin's settings file on your Steam Deck (/home/deck/homebrew/settings/squad-up/settings.json). They are never transmitted anywhere except to Discord (when refreshing them via the Worker, which is a thin proxy that does not retain the tokens).

Your Discord user ID

Once authenticated, your Discord user ID is fetched from Discord and cached in your plugin's local settings file. It is sent to the Worker only as part of move/disconnect API calls, where it is used immediately and not retained.

Voice state

The Squad Up bot subscribes to Discord's gateway voiceStateUpdate events for any server it is invited to. It maintains a short-lived in-memory map of which user is in which voice channel of which server. This map:

  • Is rebuilt from scratch when the bot service restarts.
  • Is never written to disk.
  • Is never logged.
  • Is served only via authenticated requests from the plugin.

What Squad Up does NOT collect

Squad Up does not request, receive, or process:

  • Message content of any kind.
  • Direct messages.
  • Message history.
  • Email addresses, phone numbers, or other Discord profile fields beyond your user ID and global username.
  • Analytics or telemetry of any kind. There is no usage tracking, no error reporting beacon, no first-party metrics pipeline.

The Squad Up bot uses only the Guilds and GuildVoiceStates Discord gateway intents, both of which are non-privileged and do not include message content access.

Logs and request handling

The Worker logs HTTP request paths and (for development diagnostics) some session IDs and short-code lookups. These logs:

  • Live only in Cloudflare's standard request log retention (rolling, short-lived).
  • Are not exported to any third-party analytics service.
  • Are not shared with anyone.

The bot logs only operational events (gateway connect/disconnect, errors). It does not log user IDs, channel IDs, or message content.

Sharing

Squad Up does not share, sell, rent, or otherwise transfer any user data to third parties. The only external party Squad Up communicates with is Discord itself, on your behalf, to perform the actions you initiate via the plugin (browsing servers, listing channels, moving you between voice channels, etc.). Discord's handling of your data is governed by Discord's Privacy Policy.

Data retention and deletion

  • OAuth tokens (Worker side): deleted within 5 minutes of being issued, or sooner once the plugin claims them.
  • OAuth tokens (your Deck): stored locally in your plugin settings; deleted when you tap Sign Out in the plugin or uninstall the plugin.
  • User ID (your Deck): same as above — local-only, removed on sign-out or uninstall.
  • Voice state (bot side): in-memory only, dropped on bot restart and continuously updated as users join/leave voice.
  • Worker logs: subject to Cloudflare's standard retention.

You can delete all data Squad Up holds about you by:

  1. Tapping Sign Out in the plugin (clears local tokens and cached user ID).
  2. Removing the Squad Up bot from any Discord servers it is in (stops voice-state collection for those servers).
  3. Optionally, uninstalling the plugin entirely.

Children

Squad Up is not directed at children under 13 (or the equivalent age in your jurisdiction). Discord's own Terms of Service govern minimum-age use of Discord; Squad Up does not impose a separate age requirement beyond Discord's.

Changes to this policy

This policy may be updated as Squad Up evolves. Material changes will be reflected in the Effective date at the top of this file and announced in the project's release notes on GitHub.

Contact

For questions, complaints, or data deletion requests beyond what's documented above, open an issue at https://github.com/binaryj/squad-up/issues.