CodeWings privacy policy.

Data we use and why

CodeWings uses Discord user and server identifiers, usernames, avatar references, membership and role information, invite use and booster status to provide verification, progression, invite attribution and service access. We retain the account information needed for those features, including levels, XP, notification preferences and invite totals.

New and edited server messages, links and image attachments are checked for prohibited content, phishing and scam patterns. Image processing uses OCR and image fingerprints. Routine message bodies and downloaded images are not saved as an archive. Flagged-message evidence is kept briefly for moderation, and reports may be sent to staff channels within Discord.

When you use optional features, we also process the data you provide for giveaways, suggestions, access keys, balances and orders, developer applications, tests, submissions, reviews and payouts. We keep the records necessary to run the feature you use and resolve its unfinished work.

Message content is not used to train machine-learning or AI models. OCR uses an existing pretrained recognition model. We do not sell Discord data, use it for advertising, or share it with data brokers.

How long records are kept

Local flagged-message evidence and diagnostic logs: two hours.

Records are encrypted and expired records are removed by maintenance scheduled every minute. Cleanup also runs at startup. A failed maintenance job needs operator attention; it is not treated as successful deletion.

Duplicate-message and image-scanning caches: 30 minutes.

These are temporary memory caches. The XP duplicate check stores a keyed message fingerprint instead of the message body. General Discord message caching is limited to two hours and swept every minute.

Detailed invite-join history: two hours.

The short-lived record associates an inviter and joiner with an invite, channel and server. Aggregate invite totals and the invite records that support them are kept separately.

Known scam-image fingerprints: up to 30 days, capped at 500.

These encrypted records support repeat-scam detection. They contain the fingerprint, detection reason and timestamp, without the original image or an associated user ID.

Free access keys: until their configured expiry.

Expired free keys and their associated device and Fleet records are removed. A key that also has active paid ownership is protected from this cleanup.

Records left behind by removed licenses: two hours without activity.

Unneeded device, command, linking, configuration and Fleet telemetry records are removed once their license is absent and every associated record is older than two hours. Current paid, free and operator access, blacklist evidence and history attached to live licenses are preserved.

Progression, invite totals and active access: while needed for the ongoing feature.

These are not reset every two hours. Active paid or permanent access is preserved. You can request their deletion, including deletion of your full associated account.

Giveaways, balances, orders and developer workflows: while needed to complete or maintain them.

Pending prizes, orders, reviews and submissions are not automatically erased by their creation date. Historical records are reviewed for continued necessity and are covered by the deletion-request process.

Staff reports and messages posted within Discord remain on Discord under the server's moderation practices and Discord's own retention rules. They are separate from the two-hour local evidence store. You may include these reports in a deletion request so staff can review them.

Request access, correction or deletion

Email [email protected] with the subject CodeWings data deletion and your Discord user ID, or contact staff in the Versus Airlines Discord server. State which records or account you want deleted or corrected. Do not send a password, access key or Discord token.

We verify that you control the account before acting. The operator can inspect associated records and execute a verified deletion request. Full account deletion removes progression, invite records, balances, orders, associated license access and developer records. It also removes associated references from other giveaways and staff attribution from shared records.

If a request involves an active hosted giveaway, shared access ownership, an owner account or a security record, including Fleet administration audit history, we first resolve that dependency with the requester and affected staff. We do not report deletion as complete while a required review or cleanup remains unfinished. Records no longer necessary for the stated feature are removed.

Posting new messages or using a feature again can create new records necessary to provide that feature. Notification preferences control announcements; they do not opt you out of server moderation. You can avoid message-content processing by not posting messages or attachments in a server where the bot performs these checks.

Storage, security and sharing

Account records are stored in MongoDB Atlas, which encrypts database storage at rest. Local moderation records, scam fingerprints and diagnostic logs are protected with AES-256-GCM encryption. The storage key is kept in an owner-only file outside the application source tree. Configuration credentials and operational tools are restricted to the operator.

Public pages use HTTPS. Bot-to-backend calls remain on the local server; the managed database connection uses TLS. Authorized server staff can see moderation evidence within Discord. Our VPS and managed database providers process data to host the service. Google handles email sent to the published support address. We may also disclose information when legally required or when you direct us to do so.

We keep these practices and this policy aligned with changes to the service. Contact the address above with privacy questions or requests.