Privacy Policy

1. Scope and operator

This policy applies to the AfterTheRoll website, Discord application, hosted web application, recording and transcription service, campaign tools, and related support communications (collectively, the “Service”). The Service is operated by AFTER THE ROLL L.L.C. (“AfterTheRoll,” “we,” “us,” or “our”), based in Peoria, Arizona, United States.

This policy does not govern Discord, an identity provider chosen for an account, or another third party operating under its own terms. A campaign organizer or server administrator decides when and where to use the Service and may have separate legal responsibilities to participants.

2. Information we process

Account and identity information

• Account identifiers, display name, email address, authentication subject, group or role claims, linked Discord user ID, and authentication and account-security events.
• Discord profile snapshots made available to the application, such as username or display name, along with server, channel, voice-state, command, and interaction identifiers needed to operate the bot.

Session content

• Audio from participants in a Discord voice channel while recording is active. Audio is separated by Discord user ID where the platform makes that possible.
• Transcripts, speaker labels, timestamps, summaries, recaps, campaign lore, review decisions, revision history, prompts, model responses, and associated provenance.
• Campaign names, game-system information, channel mappings, access rules, and content supplied by an organizer or authorized user.

Operations, security, and support information

• Service configuration, job and processing status, storage records, audit events, error and diagnostic logs, request metadata, and security signals.
• An email address, message, attachments, and related records when someone contacts us.
• Ordinary connection data processed by our hosting and edge provider, including IP address, request time, requested URL, browser or device information, and security signals.

We do not use voices to create biometric identifiers, identify people by voiceprint, infer sensitive traits, or make eligibility decisions about a person.

3. How information is collected

We receive information from account holders and organizers, from Discord when the bot is installed or used, from the identity provider used to sign in, automatically from Service operation, and from people who contact us. The bot receives audio because it joins the selected voice channel as a participant; Discord transports the encrypted call to the bot, which decrypts the audio as a call participant so the requested recording can be made.

4. Recording notice and consent

The bot announces recording before capture begins and again before a paused recording resumes. The person starting a recording must also inform every participant, obtain any consent required by law, and stop immediately if a participant does not consent or withdraws consent. The announcement is a safeguard; it does not replace the organizer’s legal obligations.

The Service is for adults. Account holders may not use it to record a person under 18. Anyone who believes they were recorded without valid permission should contact us at the address below and identify the Discord server, approximate date, and any other information reasonably needed to locate the session.

5. How we use information

• Provide, authenticate, secure, maintain, and troubleshoot the Service.
• Record, transcribe, summarize, organize, search, and present campaign content.
• Attribute speakers and enforce server, campaign, and role-based access controls.
• Process account links, commands, support requests, and privacy requests.
• Detect abuse, preserve system integrity, create backups, and recover from failures.
• Comply with law and enforce our Terms of Service.

We do not sell personal information, share it for cross-context behavioral advertising, serve targeted ads, or use session content to train or improve a general-purpose or third-party machine-learning model. We do not profile participants for advertising, employment, credit, housing, insurance, health, or other eligibility decisions.

Where applicable law requires a legal basis, we process information to perform a contract, on consent where required for recording, to comply with legal obligations, and for legitimate interests such as securing and operating the Service where those interests are not overridden by individual rights.

6. Where processing occurs

Audio is sent to AfterTheRoll; transcription and campaign-generation workloads do not run on the end user’s device. We operate the infrastructure used for transcription and generation and do not send session audio, transcripts, or campaign content to an outside transcription or generative-AI vendor. Information is processed and stored in the United States.

7. When information is disclosed

We disclose information only as needed in these circumstances:

• Discord. Discord carries commands, interactions, voice connections, and content the Service is directed to publish back to a server.
• Service providers. Hosting, edge-security, email, identity, and other vendors may process limited information for us under contractual or legal duties. Cloudflare delivers and protects the public website.
• Authorized users. Organizers, server administrators, campaign members, and other users receive content according to configured access rules and organizer instructions.
• Legal and safety needs. We may disclose information when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or secure the Service.
• Business changes. Information may be transferred in a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to this policy and applicable law.

We do not allow a service provider to use session content for its own advertising or model training.

8. Retention and deletion

Retention depends on the record and the organizer’s instructions. The following describes the current production configuration; a shorter period may apply when an authorized user deletes content sooner.

• Raw Opus audio, approved transcripts, summaries, revision history, and campaign lore are retained for the organizer’s continuing campaign use until an authorized deletion or the Service no longer needs them for its disclosed function. Raw audio is not currently deleted by a routine age-based cleanup.
• Reproducible decoded WAV files are eligible for cleanup after 14 days. Reproducible transcription cache files and application logs are eligible after 30 days.
• Requests and responses stored in the internal AI gateway’s spend logs are deleted after 90 days. Operational logs, metrics, and traces are retained for up to 90 days.
• A deleted session enters managed, recoverable trash for 30 days before purge. Verified pre-deletion copies and storage snapshots may remain in restricted backups for up to 12 weeks, after which they expire through the backup lifecycle.
• Account and linked-identity records are kept while an account is active. Account closure revokes sessions and grants, removes linked identities, and pseudonymizes the account record, but does not automatically erase shared campaign history, session content, or minimum security and audit records.
• Support and privacy-request correspondence is retained as reasonably necessary to respond, document compliance, resolve disputes, and enforce legal rights.

When deletion is required, we remove active copies and allow protected backups to age out unless immediate removal is technically feasible or law requires a different approach. If a backup is restored, we will reapply outstanding deletion obligations where reasonably possible.

9. Choices and privacy requests

Depending on location and applicable law, a person may ask to access, correct, export, or delete personal information; restrict or object to processing; withdraw consent; or appeal a denied request. We do not discriminate against a person for making a valid request. Because we do not sell or share personal information for behavioral advertising, there is no sale or advertising share from which to opt out.

Send a request to privacy@aftertheroll.com. Include the relevant Discord user ID and enough session context for us to locate the record, but do not email passwords, tokens, or unnecessary sensitive information. We may verify identity and authority before acting. An authorized agent may submit a request where law permits, subject to verification.

Shared session content can concern several people. A request may require redaction, deletion of an entire session, or coordination with the organizer. We will promptly delete Discord API data at the request of Discord or the applicable user when continued retention is not required by law and is no longer necessary for the Service’s stated function.

10. Website privacy

The public website has no accounts, forms, advertising, client-side analytics, tracking pixels, or marketing cookies. Cloudflare may process ordinary connection and security data to deliver and protect the site. If you email us, we process the message and sender information as described above.

11. Security

We use measures designed to protect information, including encryption in transit, access controls, isolated service networks, least-privilege credentials, authentication, audit trails, restricted backups, retention controls, and monitoring. Discord voice calls use Discord’s end-to-end encrypted voice protocol; the bot becomes an intended participant and decrypts audio to perform the requested recording. No system is completely secure, and we cannot guarantee absolute security.

12. Adults only

The Service is not directed to children and is available only to people 18 or older. It may not be used to record anyone under 18. We do not knowingly collect personal information from a child. If we learn that we hold such information, we will take appropriate steps to delete it and disable the related use.

13. Changes to this policy

We may update this policy as the Service or law changes. We will change the effective date and provide additional notice when required. Materially different uses of Discord data will not begin until the policy and any required Discord review are updated.

14. Contact