Who is responsible
The “Taleward” bot on Discord is operated by:
Taleward.org
Benjamin Welk
Goldacker 7
58675 Hemer
Germany
Email: info@taleward.org
This is the same person as in the legal notice at https://taleward.taleward.org/impressum. No data protection officer has been appointed because the legal requirements for one are not met.
What this is about
The bot records game nights in Discord voice channels, one audio track per person, and delivers the tracks to your group’s Taleward server. There they become a chapter. Which server that is, your game master decides when connecting the campaign. What happens with the tracks on that server is covered by that server’s privacy policy, not by this one. That also applies if your group uses the server we operate, taleward.taleward.org; its policy is at https://taleward.taleward.org/datenschutz.
On our own Discord server the bot also offers small helpers (frequently asked questions, software status, a feedback form, a button for the “Tester” role).
What the bot processes and why
1. Recording in the voice channel. When the game master starts a recording, the bot processes:
- the Discord ID and display name of every person in the channel, to check who has consented and to show the list “Recording: …” in the channel;
- the voice of those people only who have consented themselves, as a separate audio track per person;
- the times of start, pause, resume and end, and the ID of the voice channel, to control the recording.
The voice of a person who has not consented is not accepted by the bot; their data packets are discarded before they are decrypted. If you do nothing, you are not recorded.
To know who has consented, the bot asks your group’s Taleward server at the start and then every 30 seconds: it sends the Discord IDs of everyone in the channel, including those who have not consented, and receives per ID only whether that person is ready, needs to link or needs to consent. No names are sent, and the server returns no names.
The legal basis is the consent of each recorded person (Art. 6(1)(a) GDPR), given in the Taleward app or via the bot’s consent link. Those who consent as members of the campaign consent to all recordings of that campaign until withdrawal, as at the table; those who consent as guests via the link, to this one session only. Processing the IDs and display names of everyone in the channel and the query to the Taleward server are based on our legitimate interest in limiting the recording to consenting people and making that visible to all (Art. 6(1)(f) GDPR).
2. Connecting and consenting. When a campaign is connected, the bot sends the game master’s Discord ID and the ID and name of the Discord server to the group’s Taleward server. When someone consents, it sends that person’s Discord ID and display name as a suggested guest name. The links the bot issues for this are visible only to the person concerned, single-use and valid for 15 minutes. Legal basis: carrying out what you want to do with the bot (Art. 6(1)(b) GDPR).
3. Bookmarking a moment. Anyone being recorded can mark a moment for themselves during the session with /taleward mark, like “Bookmark” in the app. Your Discord ID, the time and, if you enter one, your note travel, like every Discord command, through Discord to the bot and from the bot to your group’s Taleward server, which stores the bookmark for you only, as described in the app. The bot itself keeps none of it, not even the note; only you see the reply. Legal basis: your wish to bookmark the moment (Art. 6(1)(b) GDPR).
4. Uploading. After the end, the tracks go to the group’s Taleward server. IDs of recorded people are transmitted only in the form the server assigned when they consented.
5. Helpers on our Discord server. The feedback form (/feedback) stores your text together with your Discord username and Discord ID in a private channel visible only to the operator; you may add a way to contact you. The “Become a tester” button assigns or removes a role on the server. The commands for frequently asked questions and software status process nothing about you. Legal basis: your wish to tell us something or to get the role (Art. 6(1)(b) GDPR).
How long the bot stores data
- Audio tracks: only until your group’s Taleward server has confirmed receipt, then deleted immediately. If uploading fails, the bot keeps trying for up to 24 hours after the recording started and then deletes the tracks.
- While the tracks are with the bot, they are encrypted. Only your group’s Taleward server can open them; neither the bot itself nor we as the bot’s operator can listen to them here. What happens on your group’s server is governed by that server’s privacy policy.
- If the game master aborts the recording (/taleward discard), the bot deletes the tracks immediately; nothing is uploaded, the Taleward server only learns that the session was discarded.
- If you withdraw your consent during the recording (in the app), the bot closes your track within about 30 seconds and deletes it; the Taleward server also discards whatever of your track has already arrived; your name disappears from the list in the channel.
- IDs, names and times of a recording are held only in memory while the recording runs and until the tracks are uploaded. The track files and their companion file contain no names and no Discord IDs, only the ID the Taleward server assigned when the person consented; the file name (track number) goes along when uploading.
- Feedback stays in the private channel until it has been handled, at most 12 months.
- The bot keeps no logs containing names, IDs or content.
If the hosting provider creates backups of the server the bot runs on, tracks that are with the bot at that moment may be contained in them for up to 7 days, likewise only in encrypted form; backups are accessible only to the operator and are overwritten afterwards.
Who receives the data
- Discord (Discord Netherlands B.V. for users in the EU): voice, names, IDs and commands pass through Discord’s services before the bot sees them; Discord’s own privacy policy applies. Discord encrypts voice connections between participants and the bot.
- Your group’s Taleward server: receives the tracks, the Discord IDs of everyone in the channel for the consent query (section 1), the details named in section 2 and bookmarks (section 3). Your game master can tell you who operates it; the app shows it under “Manage campaign → Your data”.
- The bot’s hosting provider: netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, data centre in Nuremberg, Germany; under a data processing agreement (Art. 28 GDPR). The provider receives no data for its own use.
- Nobody else. We do not pass anything on and do not sell anything.
We do not transfer data to countries outside the EU. Whether Discord processes data outside the EU is governed by Discord’s own policies.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You can withdraw consent at any time with effect for the future, most easily in the Taleward app under “Manage campaign → Your data”; during a running recording the withdrawal takes effect within about 30 seconds. For anything else, write to info@taleward.org. You can complain to a data protection supervisory authority; the one responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
What we do not do
No advertising, no tracking, no sharing with third parties, no analysis of text messages (the bot does not read messages in your channels), no voice profiles on the bot.
Changes
If something about the bot changes, we update this text and note the date below. The current version is at https://taleward.taleward.org/discord-bot/datenschutz.
Last updated: 2026-11-09