Privacy Policy

Last updated: September 6, 2026.

1. What this site is

Wody Control Center is a private administration panel for Wody Bot, Wody Counter, and Wody Server. It is not a public service. Only the owner account and team members the owner has explicitly, individually granted view access to from the panel can access it; there is no public sign up in any form. Unauthorized visitors only see the login page and no information is shown to or collected from them.

2. Data controller

The data controller for personal data, within the meaning of Regulation (EU) 2016/679 ("GDPR") and Romanian Law no. 190/2018, is the administrator of Wody Bot. Contact: teamswody@gmail.com.

3. What data is processed

We process personal data in the following situations, all related to access to the panel or to the moderation activity carried out through it:

• When attempting to log in with Discord (anyone who clicks the login button): Discord sends us your Discord account's ID and username, to verify whether you are the owner or an authorized team member. If you are not, the request is rejected; the ID, username, and IP address of the attempt are retained temporarily in a security log (see below), exclusively to detect repeated attempts.
• For an authorized account (owner or team member), after a successful login: the Discord ID is cryptographically signed into a session cookie, used exclusively to maintain access to the panel. It is not stored in a separate database.
• Security and audit log: every login (successful or denied), access grant/revocation, and moderation action is recorded with the Discord ID and username of the person who acted, the IP address (logins only), and the date/time. The purpose is exclusively panel security (detecting abuse, accountability); the log is visible to the owner only.
• Moderation warnings and watchlist: if a team member uses the panel's moderation features to issue a warning or add a server member to a watchlist, we retain the ID, username, avatar, and reason, for the member targeted by that action, not for random visitors, only for Wody Server members actually targeted by a team moderation action.

We do not collect IP addresses for profiling purposes, we do not use analytics cookies, and we do not transmit data to third parties for marketing purposes. The IP addresses mentioned above are used exclusively for login security (detecting repeated unauthorized access attempts), not for behavior tracking.

4. Legal basis for processing

Processing is based on the controller's legitimate interest in restricting access to a private administrative panel and ensuring the security and accountability of the moderation actions carried out through it (art. 6(1)(f) GDPR), and on carrying out an explicit request from the user to authenticate (art. 6(1)(b) GDPR).

5. Who the data is shared with

The data described in point 3 is shared only with Discord Inc., as the provider of the authentication mechanism (OAuth2) and as the platform on which the moderation actions described above take place, and with Vercel Inc., as the hosting and storage provider (Vercel Blob) for this site. Your browser also makes technical connections to cdn.discordapp.com (for the avatars shown in the panel) and, only on the backups page, to esm.sh (the official Vercel Blob library used for uploading archives). These connections do not involve transmitting your personal data described above, only the IP address inherent to any request to a web server. See also the Cookie Policy for full technical details. No other third party has access to the data described above.

6. Retention period

The session cookie expires automatically after 12 hours (owner) or 4 hours (team member), or upon manual logout. The cookie used exclusively during the authentication process expires within a maximum of 10 minutes. The security and audit log keeps the most recent 500 events (the oldest are automatically removed as new ones appear). Warnings and watchlist entries remain stored until the owner explicitly revokes/removes them from the panel. There is no other place of persistent storage for the personal data described in point 3.

7. Your rights under the GDPR

You have the right to request, regarding your own data:

• access to the data processed;
• rectification of inaccurate data;
• erasure of data ("the right to be forgotten");
• restriction of or objection to processing;
• data portability;
• filing a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

If you are a Wody Server member targeted by a warning or a watchlist entry, you can exercise the same rights by contacting us at the address above; the owner can remove that entry from the panel.

8. Security

Access is restricted on the server for each individual request, based on the real Discord ID (obtained directly from Discord, not sent by the browser), not just visually in the interface; revoking a team member's access takes effect from their next request, not upon cookie expiry. The session cookie uses the __Host- prefix (validated by the browser: cannot be set without Secure, without Path=/, and without the absence of a Domain attribute), HttpOnly, SameSite=Strict, and is cryptographically signed (HMAC-SHA256); it cannot be read from JavaScript and cannot be forged without the server's secret key. The authentication process includes an additional check (a separate, single-use cookie) against login forgery from another site, and accounts that repeatedly fail authentication are automatically temporarily blocked.

← Back to the login page