Privacy policy
This policy describes what happens to your data when you use Topbot.gg. It is deliberately specific, including about what we do not do. The German version is the legally binding one.
Last updated: August 11, 2026
Controller
Justin Gül, Maxhofstraße 1, 82343 Pöcking, Germany
Email: support@norecoil.de
Signing in with Discord
Signing in happens through Discord (OAuth2). We request the `identify` and `email` scopes and store your Discord ID, username, avatar, email address, and the account creation date derived from your Discord ID.
The creation date serves abuse prevention: very young accounts are the usual tool for vote manipulation. The legal basis is Art. 6(1)(b) GDPR for the account and (f) for abuse prevention.
We do **not** request your server list (`guilds`).
IP addresses
When you vote or perform any write operation, we process your IP address — but never in clear text. It is hashed with a secret key and truncated; the address cannot be derived from the result.
The sole purpose is detecting duplicate voting and enforcing rate limits, under Art. 6(1)(f) GDPR.
Retention: 90 days. After that the hashes are removed; the vote itself remains counted.
Analytics
We use Umami, self-hosted on our own hardware in Germany rather than with a provider. It works without cookies and stores no identifier in your browser, so individuals cannot be recognised.
That is why there is no consent banner: without access to information on your device, § 25 TDDDG does not apply.
Processors and hosting
Website hosting: Vercel Inc., USA, served from the Frankfurt region.
Database: Neon Inc., USA — operated in the Frankfurt region.
Queues and cache: Upstash, Inc., USA — operated in the Frankfurt region.
Object storage for images: Cloudflare, Inc., USA.
Search and analytics run on our own hardware in Germany, with no third party involved.
Email: Resend, Inc., USA.
Error reporting: Functional Software, Inc. (Sentry), USA. IP addresses are not collected.
Discord: sign-in and direct messages run through Discord Inc.
Your rights
Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20) and objection (21 GDPR).
Access and portability are available immediately in your settings as a full JSON export.
The same applies to erasure — one button, no request needed.
Right to complain to a supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.
What deleting your account does
Profile data, email address and Discord identifier are removed.
Reviews remain in anonymised form, because they are part of a bot’s rating and others rely on them.
Votes are removed and counters adjusted.
Bots you own transfer to co-owners; without co-owners they are removed.
Sessions become invalid immediately.