Legal

Privacy Policy

Effective and last updated: October 12, 2026.

1. Who this policy applies to

This policy covers PalSpire (www.palspire.com) and the PalSpire Discord bot it works with. PalSpire connects Discord communities to their own self-hosted Palworld dedicated servers; it is not affiliated with Discord Inc. or Pocketpair. Questions can be sent to [email protected] [placeholder — confirm this mailbox before publishing]. See the separate Cookie Policy for browser cookies specifically.

2. Data collected when you sign in with Discord

When you choose "Discord login," Discord asks you to approve the identify and guilds scopes. If you approve, PalSpire receives and stores:

Your Discord user ID, username, display ("global") name, and avatar image hash — cached so your dashboard, account page, and the Players tab of any server you've linked to can show your identity without repeated Discord API calls.
The list of Discords (guilds) you belong to and manage, read live from Discord on each dashboard visit to show which servers you can configure — this list itself is not persisted beyond your session.
Your Discord OAuth access and refresh tokens, held only in your server-side session (tied to the palspire_session cookie) so PalSpire can make Discord API calls on your behalf while you're logged in.

3. Data entered by Discord server managers

If you manage a Discord that uses PalSpire, the dashboard lets you enter and store, for your own dedicated server:

A display name/description for the server, and the REST API host, port, username, and password you configured on your own Palworld dedicated server.
Which Discord channels receive which bot notifications, and which Discord roles may use which bot commands.

This information is used only to connect to and operate your server from the dashboard and bot, and is visible only to people with Manage Server permission on that Discord. It is not shared with other PalSpire communities. API credentials are stored so PalSpire's backend and bot can authenticate to your server; treat them with the same care you would any server credential.

4. In-game Palworld data

Once a server is connected, PalSpire's bot polls that server's own Palworld REST API and stores game-world data: online/offline status, world day and performance stats, and — when a server's "World actor snapshots" option is enabled — player characters, Pals, bases, and world positions over time, plus each in-game player's PalSpire-tracked session history. A player ID can optionally be linked to a Discord user ID by a server manager from the Players tab. This is data about a Palworld game world and its characters, supplied by that server's own API; it is shown on that server's public profile, live map, and the manager-only Player Tracking and Raw Data pages.

5. Who this data is shared with

Discord. Login and guild/role/channel lookups are made directly against Discord's own API as part of the OAuth flow — this is necessary for the login and management features to work.
Your own Palworld dedicated server. API calls go directly from PalSpire's backend to the host/port you configured.
No one else. PalSpire does not sell personal information, does not share it with advertisers or data brokers, and does not run analytics or advertising of any kind.

6. Retention

Your session (and its Discord tokens) lasts until you sign out or the palspire_session cookie expires (up to 5 years). Your cached Discord identity (pal_web_user) is kept so previously-linked servers can keep showing your name/avatar, and is updated each time you log in. Server configuration and in-game player/world data are retained for as long as that Discord's managers keep the server connected to PalSpire; removing a server removes PalSpire's ongoing access to it.

7. Children's privacy

PalSpire is not directed at children and relies on Discord's own age requirements for its login. PalSpire does not knowingly collect personal information from children under 13. If you believe a child's data has been provided to PalSpire, contact us and we will remove it.

8. Your choices and rights

You can sign out at any time from the account menu, which ends your session. To request access to, correction of, or deletion of your cached Discord identity or consent record, email the contact above. Because community servers are independently operated by their own Discord managers, requests about a specific server's in-game player data or configuration may need to go to that server's managers as well as PalSpire, depending on what is being requested. Depending on where you live, you may have additional rights under laws such as the GDPR or U.S. state privacy laws; we will respond to verified requests consistent with applicable law.

9. Security

PalSpire takes reasonable steps to protect the data described above, but no online service can guarantee absolute security. Treat your Discord account credentials and any API credentials you enter into the dashboard as sensitive, and tell us if you believe your account has been compromised.

10. Changes to this policy

This is the first published version of PalSpire's Privacy Policy (October 12, 2026). If what PalSpire collects or how it's used changes materially, this page will be updated with a new effective date.