Privacy policy
Last updated October 12, 2026
Information we handle
The exact information depends on the features you use. The service and its backend may handle these categories:
- Discord account details such as your Discord user ID, username, display name, and avatar, plus OAuth session information used to sign you in.
- If you enable account hosting, the connected Discord account’s username and ID and its account token. The token is encrypted by the application before it is stored in the database.
- Feature settings you save, such as presence and device preferences, automations, notification choices, and any webhook URL you configure.
- If you connect Last.fm, your Last.fm username, authorization state, and presence preset. The authorization token is exchanged with Last.fm and is not saved as the Last.fm credential in the application database.
- The date and version of the Terms of Service and Privacy Policy you accepted, so we can keep a record of that choice.
- Usage and activity records, including command names, whether a command succeeded, timing, event counts, and some event metadata such as Discord server or channel IDs. Activity records are not designed to store message bodies; features you enable may process Discord content to carry out their function.
- For some unauthenticated rate-limited requests, the backend uses the request’s IP address in temporary in-memory rate-limit counters. Standard network and security data may also be processed by infrastructure providers.
How we use it
We use this information to sign you in, host and operate the account and features you request, save your settings, show your activity and command analytics, deliver notifications you configure, keep the service secure, troubleshoot failures, and respond to support requests.
When information is shared
We do not sell account data. Information is shared only as needed to provide or protect the service: with Discord when a feature communicates with Discord, with Last.fm when you connect or use that integration, with hosting and database providers that run the service, and with a webhook destination you choose for notifications. We may also disclose information when required by law or needed to address abuse, security, or a threat to people or the service.
Discord, Last.fm, and infrastructure providers handle information under their own terms and privacy practices. A webhook URL sends the selected notification details to the endpoint you configured; only use a destination you trust.
Storage and security
Account and feature records are stored in the service database. The Discord token used by the hosting feature is encrypted by the application with AES-256-GCM before it is written to the database. Discord OAuth access and refresh tokens used by the sign-in library are stored in the database without separate field-level application encryption. Other settings and activity records are stored as application data; we do not claim that every field has separate application-level encryption. No online service can guarantee perfect security.
A hosted-account token is still a powerful credential while Yen is using it to keep the connection online. Encryption at rest does not remove the access needed by the running service. Keep your dashboard sign-in secure, never send tokens to support, and disconnect hosting if you no longer want Yen to use that account.
Retention and your controls
Sign-in sessions expire after seven days. Removing or unhosting the connected account deletes its saved hosted-account token and stops hosting. Logging out ends the sign-in session, but does not by itself delete all saved settings or activity records.
The dashboard’s data-wipe control deletes command and activity history, quest records, and several settings, but it is not a complete account-deletion tool and does not clear every integration or account record. To request deletion of other records, contact support. We will handle requests as required by applicable law; limited information may remain where needed for security, legal obligations, or backup rotation.
Children and privacy requests
yen is not directed to children under 13, and we do not knowingly seek to collect personal information from a child under 13. If you believe a child has provided personal information, contact support so we can review it.
Privacy rights depend on where you live. Contact support to ask about the information associated with your account or request correction or deletion. We will respond as required by the laws that apply to you.
Changes to this policy
We may update this page when our data practices or legal requirements change. The updated date at the top identifies the latest revision.
Questions?
Reach us through the support link on the site. Please don’t send passwords, Discord tokens, or other secrets in a support message.
Contact support