Privacy Policy
Last Updated: February 14, 2026
Introduction
Lemon Tools ("we," "us," "our," or "Company") is committed to protecting your privacy and ensuring you have a positive experience on our platform. This Privacy Policy explains our practices regarding the collection, use, disclosure, and safeguarding of your information when you use our Discord bot and web dashboard.
What Data We Collect
Discord User Information
- User ID: Your unique Discord user identifier
- Username: Your Discord display name
- Avatar URL: Your Discord profile picture
- Email: Only if you opt-in for affiliate features or newsletters
- OAuth Token: Temporarily stored for authentication purposes
Server Management Data
- Guild Configuration: Settings you configure in your server
- Moderation Logs: Warnings, mutes, bans, and other moderation actions
- Custom Commands: Commands you create
- Verification Logs: Verification status and methods (without long-term IP storage)
- Tickets & Giveaways: Associated metadata
Analytics Data
- Command Usage: Which commands are used and their frequency
- Feature Engagement: Which features you use most
- Timestamps: When actions occur
What Data We DON'T Store
✅ We explicitly DO NOT store:
- Message Content: We never store the text of Discord messages
- Long-term IP Addresses: See IP Address Policy below
- Payment Information: All payments processed through Discord/Stripe, never stored by us
- Personal Identifying Information: Phone numbers, real names, or personal addresses
- Audio/Video Data: We don't monitor voice channels or collect media
- Deleted Data: Once deleted from Discord or our dashboard, it's purged from our systems
- DM Content: We never read or store private messages
- Password Hashes: We don't store any passwords (Discord OAuth handles authentication)
Data Retention Policy
Automatic Deletion
- Verification Codes: Deleted after 15 minutes of creation or upon use
- IP Address Logs (Premium): Deleted automatically after 30 days
- Temporary OAuth Tokens: Refreshed regularly and old tokens discarded
- Session Data: Cleared after 30 days of inactivity
User-Controlled Deletion
- You can request deletion of all your data at any time
- You can remove your server's data from our system
- Leaving a server removes your verification status from that server
📌 Important: We never perform indefinite data retention. Your data is actively purged according to this policy.
IP Address Policy - CRITICAL
⚠️ IP Addresses - Our Commitment:
When IPs Are Temporarily Stored
- Web Verification (Premium Only): Your IP is logged for raid detection when you verify through the web portal
- Purpose: Detect and prevent automated raid attempts (5+ verifications from same IP in 30 seconds)
- Duration: Stored for exactly 30 days
- Automatic Deletion: Deleted automatically by MongoDB TTL index
When IPs Are NOT Stored
- API requests are logged without IP information
- Dashboard access is not tracked by IP (only timestamp and user ID)
- Free tier verification (DM/command methods) never uses IP addresses
- Non-premium servers' verification never stores IPs
IP Address Visibility
- Never shown to users: Verification logs displayed to mods never include IP data
- Never shown to admins: Server administrators cannot view IP addresses
- Server logs never contain IPs: Your audit logs show "User verified" but not their IP
✅ Privacy Guarantee: Even if you're premium and use web verification, your IP is only used for raid detection and automatically deleted after 30 days. No human will ever see your IP address in the system.
How We Use Your Data
- Service Provision: To operate and improve the Discord bot and dashboard
- Authentication: To verify your identity and manage your account
- Server Management: To apply configurations and moderation rules you set
- Verification: To authenticate users joining your server
- Raid Detection: To prevent automated spam/raid attacks (premium only)
- Analytics: To understand feature usage and improve service
- Communication: To send you important updates about the service (if opted in)
- Legal Compliance: To comply with applicable laws and regulations
Data Security
Encryption & Protection
- All data in transit uses TLS 1.2+ encryption
- Database connections use authenticated, encrypted connections
- Sensitive data is hashed or tokenized
- Regular security audits and penetration testing
Access Control
- Only authorized developers have access to data systems
- Database access is restricted and logged
- Multi-factor authentication required for all admin accounts
🔒 Note: While we implement industry-standard security practices, no system is 100% secure. We recommend setting strong Discord passwords and enabling 2FA on your account.
Your Rights
You Have the Right To:
- Access: Request a copy of all data we store about you
- Deletion: Request complete removal of your data
- Correction: Request corrections to inaccurate information
- Portability: Request your data in a portable format
- Opt-Out: Disable analytics or promotional communications
To exercise any of these rights, contact us at the address below with "DATA REQUEST" in the subject line.
If you have questions about this Privacy Policy, wish to exercise your rights, or have concerns about our data practices, please contact us:
📝 Changes to This Policy: We may update this Privacy Policy periodically. We will notify you of material changes by updating the "Last Updated" date. Your continued use of Lemon Tools constitutes acceptance of any changes.