Privacy policy

Preamble

This privacy policy explains the types of personal data (also referred to as “data”) we process, for what purposes and to what extent. It applies to all processing of personal data we carry out, both in providing our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (collectively referred to as our “online offering”).

The terms used are gender-neutral.

Last updated: 19 October 2026

Contents

• Preamble
• Controller
• Overview of processing
• Relevant legal bases
• Security measures
• International data transfers
• General information on data retention and deletion
• Rights of data subjects
• Providing the online offering and web hosting
• Use of cookies
• Blogs and publication media
• Contact and enquiry management
• Advertising communications by email, post, fax or telephone
• Social media presences
• Changes and updates
• Definitions

Controller

Hendrik Heinle
c/o Autorenglück #14288
Albert-Einstein-Str. 47
02977 Hoyerswerda
Deutschland

Email address: info@mohahu.de
Telephone: 021612701352

Overview of processing

The following overview summarises the types of data processed, the purposes of processing and the people concerned.

Types of data processed

• Master data.
• Employee data.
• Contact data.
• Content data.
• Usage data.
• Metadata, communication and procedural data.
• Log data.

Categories of data subjects

• Service recipients and clients.
• Employees.
• Communication partners.
• Users.
• Third parties.
• Whistleblowers.

Purposes of processing

• Communication.
• Security measures.
• Direct marketing.
• Organisational and administrative procedures.
• Feedback.
• Marketing.
• Providing our online offering and making it user-friendly.
• Information technology infrastructure.
• Whistleblower protection.
• Public relations.
• Sales promotion.

Relevant legal bases

Relevant legal bases under the GDPR: The following provides an overview of the GDPR legal bases on which we process personal data. Please note that, in addition to the GDPR, national data protection rules may apply in your or our country of residence or establishment. Where more specific legal bases apply in individual cases, we explain them in this privacy policy.

• Consent (Article 6(1)(a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or to take steps at their request before entering into a contract.
• Legal obligation (Article 6(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Article 6(1)(f) GDPR) – Processing is necessary for the legitimate interests pursued by the controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring protection of personal data.

National data protection rules in Germany: In addition to the GDPR, national data protection rules apply in Germany, particularly the Federal Data Protection Act (BDSG). The BDSG contains specific rules on access, erasure, objection, processing of special categories of personal data, processing for other purposes, transfers, and automated individual decision-making, including profiling. State data protection laws may also apply.

Application of the GDPR and the Swiss FADP: This privacy notice provides information under both the Swiss Federal Act on Data Protection (FADP) and the GDPR. For broader geographical applicability and clarity, GDPR terminology is used. In particular, the terminology for processing, personal data, legitimate interests and special categories of data follows the GDPR rather than the corresponding Swiss statutory terms. Where the Swiss FADP applies, the legal meaning of these terms continues to be determined by that Act.

Data protection rules in the country of establishment: National data protection rules in the controller’s country of establishment apply alongside the GDPR.

Security measures

In accordance with statutory requirements, and taking into account the state of the art, implementation costs and the nature, scope, context and purposes of processing, as well as the varying likelihood and severity of risks to individuals’ rights and freedoms, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, access permissions, input, disclosure, availability and separation. We have also established procedures for exercising data subject rights, deleting data and responding to threats to data security. We take the protection of personal data into account when developing or selecting hardware, software and procedures, in accordance with data protection by design and by default.

Securing online connections using TLS/SSL encryption (HTTPS): To protect information transmitted through our online services against unauthorised access, we use TLS/SSL encryption. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the foundations of secure online data transmission. They encrypt information exchanged between the website or app and the user’s browser or device, or between two servers, protecting it against unauthorised access. TLS, the more advanced and secure successor to SSL, ensures that data transmissions meet the highest security standards. A website secured by an SSL/TLS certificate displays HTTPS in its URL, indicating that data is transmitted securely and in encrypted form.

International data transfers

Processing in third countries: Where we transfer data to a third country (outside the European Union (EU) or European Economic Area (EEA)), or where this happens through the use of third-party services or disclosure or transfer to other people, bodies or companies (as indicated by the provider’s postal address or an express reference in this policy), we always do so in accordance with statutory requirements.

For transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), recognised as a secure legal framework by the European Commission’s adequacy decision of 10 July 2023. We have additionally concluded standard contractual clauses with the respective providers that meet European Commission requirements and establish contractual obligations to protect your data.

This dual safeguard provides comprehensive protection: the DPF is the primary layer, while standard contractual clauses provide additional security. If the DPF changes, standard contractual clauses serve as a reliable fallback. This ensures that your data remains appropriately protected even if political or legal circumstances change.

For individual service providers, we indicate whether they are DPF-certified and whether standard contractual clauses are in place. Further information and a list of certified companies are available from the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English).

For transfers to other third countries, corresponding safeguards apply, particularly standard contractual clauses, explicit consent or legally required transfers. Information about third-country transfers and applicable adequacy decisions is available from the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

General information on data retention and deletion

We delete personal data in accordance with statutory requirements as soon as the underlying consent is withdrawn or no other legal basis for processing remains. This includes cases where the original purpose no longer applies or the data is no longer needed. Exceptions apply where legal obligations or special interests require longer retention or archiving.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for pursuing legal claims or protecting the rights of other individuals or legal entities, must be archived accordingly.

Our privacy notices contain additional information on retention and deletion for specific processing activities.

Where several retention periods or deletion deadlines apply to the same data, the longest period always applies. Data retained for legal or other reasons after its original purpose has ended is processed solely for the purposes that justify its retention.

Periods beginning at year-end: If a period does not expressly start on a specified date and lasts at least one year, it automatically starts at the end of the calendar year in which the triggering event occurred. For ongoing contractual relationships involving data storage, the triggering event is the effective termination or other ending of the legal relationship.

Rights of data subjects

Data subject rights under the GDPR: You have various rights under the GDPR, particularly those set out in Articles 15 to 21:

• Right to object: You may object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. Where personal data is processed for direct marketing, you may object at any time to processing for that purpose, including profiling related to such direct marketing.
• Right to withdraw consent: You may withdraw consent at any time.
• Right of access: You may request confirmation of whether your data is processed and access to that data, further information and a copy in accordance with statutory requirements.
• Right to rectification: You may request completion of incomplete data or correction of inaccurate data in accordance with statutory requirements.
• Right to erasure and restriction of processing: Subject to statutory requirements, you may request immediate deletion of your data or, alternatively, restriction of processing.
• Right to data portability: Subject to statutory requirements, you may receive data you have provided to us in a structured, commonly used, machine-readable format or request its transfer to another controller.
• Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you may lodge a complaint with a data protection supervisory authority if you believe that processing of your personal data infringes the GDPR. You may complain in particular in the Member State of your habitual residence, place of work or the alleged infringement.

Providing the online offering and web hosting

We process users’ data to provide our online services. This includes processing users’ IP addresses, which are necessary to transmit the content and functions of our online services to their browsers or devices.

• Types of data processed: Usage data (such as page views, visit duration, click paths, intensity and frequency of use, device types, operating systems and interactions with content and functions); metadata, communication and procedural data (such as IP addresses, times, identification numbers and people involved). Log data (such as logs of sign-ins, data retrieval and access times).
• Data subjects: Users (such as website visitors and users of online services).
• Purposes of processing and legitimate interests: Providing our online offering and making it user-friendly; information technology infrastructure (operating and providing information systems and technical devices, such as computers and servers). Security measures.
• Retention and deletion: Deletion as described in “General information on data retention and deletion”.
• Legal bases: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

• Providing the online offering on rented storage: We use storage, computing capacity and software rented or otherwise obtained from a server provider (also called a “web host”) to provide our online offering; Legal bases: Legitimate interests (Article 6(1)(f) GDPR).
• Collection of access data and log files: Access to our online offering is recorded in server log files. These may contain the address and name of requested websites and files, the date and time of access, data volumes transmitted, successful retrieval messages, browser type and version, operating system, referrer URL (the previously visited page), and generally IP addresses and the requesting provider. Log files may be used for security, for example to prevent server overload from abusive attacks such as DDoS attacks, and to ensure server capacity and stability; Legal bases: Legitimate interests (Article 6(1)(f) GDPR). Deletion: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data needed as evidence is exempt from deletion until the incident has been conclusively resolved.

Use of cookies

“Cookies” refers to functions that store information on users’ devices and read it from them. Cookies may serve different purposes, including the functionality, security and convenience of online offerings and the analysis of visitor traffic. We use cookies in accordance with statutory requirements and obtain prior consent where required. Where consent is unnecessary, we rely on our legitimate interests. This applies where storing and reading information is essential to provide expressly requested content and functions, including saving settings and ensuring the functionality and security of our online offering. Consent can be withdrawn at any time. We clearly explain its scope and which cookies are used.

Information about data protection legal bases: Whether we process personal data using cookies depends on consent. Where consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, as explained above and in the context of the respective services and procedures.

Storage duration: The following types of cookies are distinguished by their storage duration:

• Temporary cookies (also called session cookies): Temporary cookies are deleted at the latest after a user has left an online offering and closed their device application, such as their browser or mobile app.
• Permanent cookies: Permanent cookies remain stored after the device application is closed. They may, for example, store sign-in status and display preferred content directly when the user returns. Data collected using cookies may also be used for audience measurement. Unless we explicitly specify the type and duration of cookies, for example when obtaining consent, users should assume that they are permanent and may be stored for up to two years.

General information on withdrawal and objection (opt-out): Users may withdraw consent at any time and may object to processing in accordance with statutory requirements, including through their browser’s privacy settings.

• Types of data processed: Metadata, communication and procedural data (such as IP addresses, times, identification numbers and people involved).
• Data subjects: Users (such as website visitors and users of online services).
• Legal bases: Legitimate interests (Article 6(1)(f) GDPR). Consent (Article 6(1)(a) GDPR).

Further information on processing activities, procedures and services:

• Processing cookie data on the basis of consent: We use a consent management solution to obtain users’ consent to cookies or to the procedures and providers listed in that solution. It is used to obtain, record, manage and withdraw consent, particularly for cookies and similar technologies used to store, read and process information on users’ devices. Consent is obtained for cookies and the associated processing, including the specific processing activities and providers listed in the consent management procedure. Users can also manage and withdraw their consent. Consent declarations are stored to avoid repeated requests and to provide evidence of consent as required by law. They are stored on the server and/or in a cookie (an opt-in cookie), or through comparable technologies, to associate consent with a particular user or device. Unless specific information about consent management providers is provided, the following general information applies: consent is stored for up to two years. A pseudonymous user identifier is created and stored with the time of consent, its scope (such as cookie categories and/or providers), and information about the browser, system and device; Legal bases: Consent (Article 6(1)(a) GDPR).

Blogs and publication media

We use blogs or similar means of online communication and publication (“publication media”). Readers’ data is processed only to the extent necessary to display the publication medium, communicate between authors and readers, or ensure security. Otherwise, please refer to the information in this privacy policy about processing the data of visitors to our publication media.

• Types of data processed: Master data (such as full name, home address, contact information and customer number); contact data (such as postal and email addresses or telephone numbers); content data (such as text or image messages and contributions, with related information such as authorship and creation time); usage data (such as page views, visit duration, click paths, intensity and frequency of use, device types, operating systems and interactions with content and functions). Metadata, communication and procedural data (such as IP addresses, times, identification numbers and people involved).
• Data subjects: Users (such as website visitors and users of online services).
• Purposes of processing and legitimate interests: Feedback (such as collecting feedback through online forms); providing our online offering and making it user-friendly; security measures. Organisational and administrative procedures.
• Retention and deletion: Deletion as described in “General information on data retention and deletion”.
• Legal bases: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

• Comments and contributions: When users leave comments or other contributions, their IP addresses may be stored on the basis of our legitimate interests. This protects us if someone posts unlawful content, such as insults or prohibited political propaganda. We may be held liable for the comment or contribution and therefore have an interest in identifying the author.
  
  We also reserve the right to process users’ details to detect spam on the basis of our legitimate interests.
  
  On the same legal basis, we reserve the right to store users’ IP addresses for the duration of surveys and use cookies to prevent multiple votes.
  
  Personal, contact and website information, as well as content supplied in comments and contributions, is stored permanently until the user objects; Legal bases: Legitimate interests (Article 6(1)(f) GDPR).

Contact and enquiry management

When people contact us, for example by post, contact form, email, telephone or social media, and within existing user and business relationships, we process their details to the extent necessary to answer enquiries and carry out any requested measures.

• Types of data processed: Contact data (such as postal and email addresses or telephone numbers); content data (such as text or image messages and contributions, with related information such as authorship and creation time). Metadata, communication and procedural data (such as IP addresses, times, identification numbers and people involved).
• Data subjects: Communication partners.
• Purposes of processing and legitimate interests: Communication; organisational and administrative procedures; feedback (such as collecting feedback through online forms). Providing our online offering and making it user-friendly.
• Retention and deletion: Deletion as described in “General information on data retention and deletion”.
• Legal bases: Legitimate interests (Article 6(1)(f) GDPR). Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR).

Further information on processing activities, procedures and services:

• Contact form: When you contact us through our contact form, by email or by other means, we process the personal data you provide to answer and handle your enquiry. This generally includes your name, contact information and any further information you provide that is needed to address the matter appropriately. We use this data exclusively for the specified purpose of contact and communication; Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR), legitimate interests (Article 6(1)(f) GDPR).

Advertising communications by email, post, fax or telephone

We process personal data for advertising communications through various channels, such as email, telephone, post or fax, in accordance with statutory requirements.

Recipients may withdraw consent or object to advertising communications at any time, free of charge, using the contact details above.

Following withdrawal or objection, we retain the data needed to demonstrate the previous authorisation to contact the recipient or send communications for up to three years after the end of the year of withdrawal or objection, on the basis of our legitimate interests. Processing is limited to defending possible claims. To ensure that withdrawal or objection is respected permanently, we also retain the information needed to prevent further contact, such as the email address, telephone number or name, depending on the channel.

• Types of data processed: Master data (such as full name, home address, contact information and customer number); contact data (such as postal and email addresses or telephone numbers). Content data (such as text or image messages and contributions, with related information such as authorship and creation time).
• Data subjects: Communication partners.
• Purposes of processing and legitimate interests: Direct marketing (such as by email or post); marketing. Sales promotion.
• Retention and deletion: Deletion as described in “General information on data retention and deletion”.
• Legal bases: Consent (Article 6(1)(a) GDPR). Legitimate interests (Article 6(1)(f) GDPR).

Social media presences

We maintain online presences on social networks and process user data there to communicate with users or provide information about us.

User data may be processed outside the European Union. This may pose risks, for example by making it harder to enforce users’ rights.

Social networks also generally process user data for market research and advertising. They may create usage profiles based on behaviour and inferred interests, which may be used to display advertisements within and outside the networks that are expected to match those interests. Cookies recording users’ behaviour and interests are therefore generally stored on their computers. Usage profiles may also contain data independent of the devices used, particularly where users are members of the platforms and signed in.

For details of the respective processing and opt-out options, please consult the networks’ privacy policies and information.

Requests for information and the exercise of data subject rights are generally most effective when addressed directly to the providers. Only they have access to users’ data and can take appropriate measures and provide information directly. You can nevertheless contact us if you need assistance.

• Types of data processed: Contact data (such as postal and email addresses or telephone numbers); content data (such as text or image messages and contributions, with related information such as authorship and creation time). Usage data (such as page views, visit duration, click paths, intensity and frequency of use, device types, operating systems and interactions with content and functions).
• Data subjects: Users (such as website visitors and users of online services).
• Purposes of processing and legitimate interests: Communication; feedback (such as collecting feedback through online forms). Public relations.
• Retention and deletion: Deletion as described in “General information on data retention and deletion”.
• Legal bases: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

• Instagram: Social network for sharing photos and videos, commenting on and liking posts, messaging, and following profiles and pages; Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Article 6(1)(f) GDPR); Website: https://www.instagram.com; Privacy policy: https://privacycenter.instagram.com/policy/. Basis for third-country transfers: Data Privacy Framework (DPF).
• Facebook Pages: Profiles within Facebook – The controller is jointly responsible with Meta Platforms Ireland Limited for collecting and transmitting the data of visitors to our Facebook Page (“fan page”). This includes information about user behaviour, such as content viewed or interacted with and actions taken, and device information, such as IP address, operating system, browser type, language settings and cookie data. Further information is available in Facebook’s privacy policy: https://www.facebook.com/privacy/policy/. Facebook also uses this data to provide us with statistical “Page Insights” showing how people interact with our Page and its content. This is based on an agreement with Facebook (“Page Insights information”: https://www.facebook.com/legal/terms/page_controller_addendum), which addresses security measures and the exercise of data subject rights, among other matters. Further information: https://www.facebook.com/legal/terms/information_about_page_insights_data. Users may therefore address access or deletion requests directly to Facebook. Their rights, particularly access, erasure, objection and complaint to a supervisory authority, remain unaffected. Joint responsibility is limited exclusively to the collection of data by Meta Platforms Ireland Limited (EU). Meta Platforms Ireland Limited alone is responsible for subsequent processing, including any transfer to Meta Platforms Inc. in the USA; Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Article 6(1)(f) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/privacy/policy/. Basis for third-country transfers: Data Privacy Framework (DPF), standard contractual clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
• X: Social network; Provider: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal bases: Legitimate interests (Article 6(1)(f) GDPR); Website: https://x.com. Privacy policy: https://x.com/de/privacy.

Changes and updates

Please review this privacy policy regularly. We amend it whenever changes to our processing make this necessary. We will notify you if a change requires an action on your part, such as consent, or another individual notification.

Where this policy lists addresses and contact details for companies and organisations, please note that these may change over time and check them before making contact.

Definitions

This section provides an overview of the terms used in this privacy policy. Where terms are defined by law, those definitions apply. The following explanations are intended primarily to aid understanding.

• Employees: People in an employment relationship, whether as staff, salaried employees or in similar positions. Employment is a legal relationship between an employer and an employee established by an employment contract or agreement. The employer must pay remuneration and the employee must perform work. Employment includes its establishment, performance and ending, whether through termination, a termination agreement or otherwise. Employee data is any information about such people processed in the context of employment, including personal identification information, identifiers, pay and bank details, working hours, leave entitlements, health data and performance appraisals.
• Master data: Essential information needed to identify and administer contractual partners, user accounts, profiles and similar associations. This may include personal and demographic details such as names, contact information (addresses, telephone numbers and email addresses), dates of birth and identifiers such as user IDs. Master data underpins formal interactions between people and services, institutions or systems by enabling unambiguous identification and communication.
• Content data: Information generated when creating, editing and publishing content of any kind. This may include text, images, videos, audio files and other multimedia content published on different platforms and media. It includes both the content and metadata that provides context, such as tags, descriptions, authorship and publication dates.
• Contact data: Information enabling communication with people or organisations, including telephone numbers, postal and email addresses, and communication methods such as social media handles and instant messaging identifiers.
• Metadata, communication and procedural data: Categories of information about how data is processed, transmitted and managed. Metadata provides context, origin and structure, such as file size, document author, creation date and change history. Communication data records exchanges between users through channels such as email, telephone, social networks and chat, including participants, timestamps and transmission routes. Procedural data describes processes and workflows within organisations or systems, including workflow documentation, transaction logs and audit logs for tracking and reviewing activities.
• Usage data: Information about how users interact with digital products, services and platforms. This encompasses the functions used, time spent on pages and routes through an application, as well as frequency, timestamps, activities, IP addresses, device information and location data. It is valuable for analysing behaviour, improving user experiences, personalising content and optimising products or services. It also helps identify trends, preferences and potential problems within digital offerings.
• Personal data: Any information relating to an identified or identifiable natural person (“data subject”). A person is identifiable if they can be identified directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, online identifier (such as a cookie), or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
• Log data: Information about events or activities recorded in a system or network. This typically includes timestamps, IP addresses, user actions, error messages and other details of system use or operation. It is often used to analyse problems, monitor security or create performance reports.
• Controller: The natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data.
• Processing: Any operation or set of operations performed on personal data, whether or not by automated means. The term covers virtually any handling of data, including collection, analysis, storage, transmission and deletion.

Created using the free Datenschutz-Generator.de by Dr Thomas Schwenke

Workspace API and API keys

When you connect an external service, it can use your API key to access saved data in the assigned workspace within the selected permissions. You choose the service and manage its keys, permissions and validity in your account. Processing by that service is additionally subject to its own privacy information.

For API keys, sOU stores the identifier, a SHA-256 digest of the random secret, account association, workspace, name, permissions, creation time, expiry time and revocation time where applicable. The complete key is shown only when created. Key management and successful API writes are audited with the account, key identifier and action, without the key secret or document contents. Revocation blocks new requests; requests in progress may still complete. Records and audit logs are not automatically deleted on revocation. Further information about storage and your rights is provided in this privacy policy.

For automated HUD uploads, you can bind a separate creator key to exactly one organization. The organization is stored instead of the workspace. Within the chosen permissions, the service can read or create HUD entries and package versions belonging to that organization for as long as you hold explicit Publisher permission. These key secrets are also displayed only once and stored only as a SHA-256 digest. Account state, password security stamp, validity and revocation are checked on every request. The same information on key management, auditing, revocation and storage applies as for workspace keys.

HUD details and media

For publicly listed HUDs with an approved package version, the name, organization, author, descriptions, terms of use, license texts, links, images and demo videos are visible on the HUD marketplace without signing in. Private, unlisted and not yet approved HUDs are not shown there. Workspace names, membership data, requests, direct grants and creator settings remain restricted to the respective authorized signed-in people.

HUD publishers can supply a Markdown description, terms of use and license, author, author URL, legal notice URL, privacy URL, images and a demo video in multiple languages. These details are stored with the HUD and their language, separately from package versions, and shown to people who may view the HUD entry in the directory. Images and videos are stored on sOU; external links are accessed only when opened. Supply only content you are allowed to share. Changes are logged with the account identifier and action, without copying the content. Removed media are no longer displayed; unreferenced files may initially be retained for operational reliability and in backups.

Discord updates

As a HUD publisher, you can optionally enable Discord announcements. For each HUD we store your encrypted webhook address, community selection and settings revision. The webhook address contains a secret and is not displayed after saving. The central sOU webhook is managed exclusively on the server.

For approved versions, the sOU server sends the HUD name, version, supplied patch notes and a help link to Discord. These details are publicly visible in the community channel. Account email addresses, API keys, complete package files and workspace data are not transmitted. Discord also applies its own privacy information. You can disable destinations and remove your custom webhook in the desktop app; this does not delete existing Discord messages. Message content, delivery state, attempts and numeric HTTP status are retained for troubleshooting. Settings changes are audited without the webhook secret.