Privacy policy
This policy describes what happens to your data when you use Topbot.gg. It is deliberately specific, including about what we do not do. The German version is the legally binding one.
Last updated: August 24, 2026
Controller
Justin Gül, Maxhofstraße 1, 82343 Pöcking, Germany
Email: support@norecoil.de
Signing in with Discord
Signing in happens through Discord (OAuth2). We request the `identify` and `email` scopes and store your Discord ID, username, avatar, email address, and the account creation date derived from your Discord ID.
The creation date serves abuse prevention: very young accounts are the usual tool for vote manipulation. The legal basis is Art. 6(1)(b) GDPR for the account and (f) for abuse prevention.
We do **not** request your server list (`guilds`).
IP addresses
When you vote or perform any write operation, we process your IP address, but never in clear text. It is hashed with a secret key and truncated; the address cannot be derived from the result.
The sole purpose is detecting duplicate voting and enforcing rate limits, under Art. 6(1)(f) GDPR.
Retention: 90 days. After that the hashes are removed; the vote itself remains counted.
Analytics
We use Vercel Web Analytics, a service of our host Vercel Inc. It records page views, referrer, approximate location at country level, device type and browser.
It works without cookies and stores no identifier in your browser. To tell visits apart, Vercel derives a hash from IP address and browser signature that rotates daily and is not retained, so individuals cannot be recognised beyond a single day.
That is why there is no consent banner: without storing or reading information on your device, § 25 TDDDG does not apply. The legal basis is our legitimate interest in audience measurement under Article 6(1)(f) GDPR.
The data is processed by Vercel Inc. in the United States; the data processing agreement forms part of the terms we accepted as a customer. The transfer to the US is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR), which form part of that agreement; Vercel Inc. is additionally certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
Processors and hosting
Website hosting: Vercel Inc., USA, served from the Frankfurt region.
Database: Neon Inc., USA (operated in the Frankfurt region).
Queues and cache: Upstash, Inc., USA (operated in the Frankfurt region).
Object storage for images: Cloudflare, Inc., USA.
Search and analytics run on our own hardware in Germany, with no third party involved.
Email: Resend, Inc., USA.
Error reporting: Functional Software, Inc. (Sentry), USA. IP addresses are not collected.
Discord: sign-in and direct messages run through Discord Inc.
Your rights
Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20) and objection (21 GDPR).
Access and portability are available immediately in your settings as a full JSON export.
The same applies to erasure: one button, no request needed.
Right to complain to a supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.
What deleting your account does
Profile data, email address and Discord identifier are removed.
Reviews remain in anonymised form, because they are part of a bot’s rating and others rely on them.
Votes are removed and counters adjusted.
Bots you own transfer to co-owners; without co-owners they are removed.
Sessions become invalid immediately.