Privacy policy
Quob stores what it needs to run your bots and nothing else. There is no analytics, advertising or third-party tracking.
What is stored
- Your username, a bcrypt password hash, and account timestamps.
- Your Discord bot token, encrypted at rest, plus its last four characters so you can recognise it.
- The name and last four characters of each project's bot token.
- The blocks in each project, its name, and the project's last run state.
Bots and logs
Bots connect to Discord directly from this server using your token. Console output is kept in memory only while the bot runs, capped at a few hundred lines, and is discarded when the process ends. No bot logs are written to disk.
Cookies
One cookie keeps you signed in: a random session token, marked HTTP-only and SameSite. Quob stores only a hash of it, and it expires after 30 days or when you log out. No other cookies are set.
Third parties
Discord receives your bot token when the bot connects to the gateway. Discord's own privacy policy applies to that traffic. No other service receives your data.
Where data lives
Account and project data live as JSON files in this instance's data directory, on the machine that hosts Quob. Passwords are hashed with bcrypt and bot tokens are encrypted before they are written.
Retention and deletion
Deleting a project removes its blocks and saved token from disk. Your account file remains until you ask the operator of this instance to remove it. Session records expire automatically.
Security
Sessions are HTTP-only cookies over HTTPS, API writes require a same-origin request, and bot processes only receive their own token. No system can promise perfect security, so use a dedicated bot token and reset it if you suspect it leaked.
Children
Quob is not intended for anyone below Discord's minimum age.
Changes
This policy may be updated with the service. The date at the top shows the last revision.