Privacy Policy

Effective October 1, 2026

This policy describes what information Zerobox LLC ("Zerobox", "we") collects when you use the Zerobox website and Discord service (the "Service"), and how we handle it. We collect the minimum we need to run the Service, and we do not sell your personal information.

1. Information we collect

• Discord account basics. Every Zerobox account is connected to a Discord account. Through Discord's authorization flow we receive your Discord user ID, username, display name, avatar, and the email address on your Discord account (if it has one) along with whether Discord has verified it. We never see your Discord password.
• Email sign-in. If you sign in with an email code, we collect the email address you enter and send a one-time sign-in code to it.
• Google sign-in. If you sign in with Google, Google shares your Google account ID, name, email address and whether Google has verified it, and profile picture. We keep the account ID, name, and email address; we do not keep the profile picture. We never see your Google password.
• Apple sign-in. If you sign in with Apple, Apple shares an account ID it creates for Zerobox, the email address you choose to share (which can be an Apple private relay address if you use Hide My Email) and whether Apple has verified it, and your name if you choose to share it (Apple sends it only the first time you sign in). We also keep a token from Apple so that we can revoke Zerobox's access when you remove Apple or delete your account. We never see your Apple password.
• Sign-in history. Which sign-in methods are connected to your account, when each was added, last used, or removed, and whether a change was made by you or by our support team. To limit abuse, we also keep short-lived counts of sign-in attempts per email address and per IP address.
• Subscription and entitlement data. Your plan, its status, billing period dates, and the history needed to operate your membership.
• Payment information: held by our payment processor, not us. Payments are processed by Stripe; your card or bank details go directly to Stripe, and we receive only what is needed to manage your subscription (for example payment status, method type, and the last four digits of a card).
• Creator Program data. If you apply to the Partner Program, we collect what you submit: your legal name, your content platform links, your audience size, and your application answers. If you become a creator, we also keep your payout status and commission records. The identity and bank details Stripe requires for payouts are collected by Stripe directly through Stripe Connect; we never see or store them.
• Service activity. Operational records of your use of the Service (for example queue and session activity, bot interactions, and timestamps) used to run the Service and prevent abuse.
• Technical data. Standard server logs (IP address, browser user agent, requested pages, timestamps) kept for security and troubleshooting.

2. Cookies and analytics

The website uses a single first-party session cookie to keep you signed in (up to 30 days), plus short-lived cookies used only while a sign-in, sign-up, or account connection is in progress. We do not use advertising cookies.

The email sign-in form uses Cloudflare Turnstile, a bot check that sends technical information about your browser and connection to Cloudflare to confirm that a person, not an automated script, is using the form. How Cloudflare handles that information is described in Cloudflare's Turnstile Privacy Addendum.

We use Plausible Analytics to count page views and understand which pages are used. Plausible does not set cookies, does not collect personal data, and does not track you across other websites; it records aggregate information such as the page visited, referring site, approximate country and device type, and when a link to another site is clicked, the destination site. No data is sold or shared for advertising.

3. How we use information

• To provide and operate the Service: authentication, queueing, entitlements, and bot access.
• To sign you in with the method you choose, including emailing you one-time sign-in codes.
• To send you security notices when a sign-in method is added to or removed from your account, by Discord direct message and, where we have a verified email address for you, by email. Payment receipts still come from Stripe.
• To bill subscriptions and manage renewals, cancellations, and payment issues.
• To provide support and communicate service matters with you, primarily through Discord.
• To run the Creator Program: reviewing applications, attributing referrals to partner codes, and paying commissions.
• To add you to our Discord server when you sign in with Discord or connect it while signing up, using the permission Discord asks you to approve during sign-in; the Service is operated through that server.
• To keep the Service secure and prevent fraud and abuse.
• To comply with legal obligations, including tax and accounting requirements.

4. Who we share information with

We share personal information only with the service providers that make the Service work, and only what each needs:

• Stripe: web payment processing, and partner payouts through Stripe Connect.
• Discord: identity, account security notices sent as direct messages, and the delivery of the Service itself (our bots and server operate on Discord).
• Google and Apple: sign-in, only if you choose to sign in with them.
• Postmark: delivery of sign-in codes and account security emails.
• Amazon Web Services: cloud hosting.
• Cloudflare: networking and security in front of our services, including the Turnstile bot check on the email sign-in form.

If you subscribe using a partner's code or share link, that partner can see anonymized referral statistics only: the date, the plan tier, and their commission. They never see your identity or account details.

We may also disclose information if required by law, or to protect the rights, safety, or property of Zerobox, our members, or others. If Zerobox is involved in a merger, acquisition, or sale of assets, member information may be transferred as part of that transaction.

5. Data retention

We keep account and subscription data for as long as your account is active. Billing records are retained as required by tax and accounting law. Server logs are kept for up to 365 days and then deleted or anonymized. When your account is deleted, we remove or anonymize personal information we no longer need (an active subscription must be cancelled before account deletion).

The sign-in methods connected to your account, and its sign-in history, are kept for as long as the account exists. If you remove a sign-in method, it stops working for your account straight away, but the record of the change, including the email address or account ID involved, stays in your sign-in history. When your account is deleted, its sign-in methods stay tied to the deleted account, so that they cannot be used to create a new account; contact us (section 9) if you need one released. If you start signing up with an email code, Google, or Apple but do not connect Discord, no account is created and the sign-in method is not saved. Our email provider keeps a copy of the emails it delivers for a limited period.

6. Your rights

You can see your sign-in methods, and remove any of them except Discord, from the Sign-in methods section of your account page. To protect your account, we ask you to sign in again first if you have not done so recently. Discord cannot be removed, because every account needs it, but Transfer Account on the same page switches your account to a different Discord account.

You can request access to, correction of, or deletion of your personal information by contacting us (section 9). If you are in the European Union or United Kingdom, you additionally have rights under the GDPR/UK GDPR (including access, rectification, erasure, restriction, portability, and objection) and the right to lodge a complaint with your supervisory authority. If you are a California resident, you have equivalent rights under the CCPA/CPRA; we do not sell or share personal information as those terms are defined there.

7. Security

Traffic to the Service is encrypted in transit. Access to production systems and member data is restricted, and payment credentials are held by our payment processors rather than by us. Sign-in codes can be used once, expire after 10 minutes, and are never stored in readable form. When a sign-in method is added to or removed from your account, we send you a notice, and you can sign out of all devices at once from your account page. No online service can guarantee perfect security, but we work to protect the Service and your data.

8. Children

The Service is not directed at children under 13, and you must meet Discord's minimum age requirements to use it. We do not knowingly collect personal information from children under 13; if you believe a child has provided us personal information, contact us and we will delete it.

9. Contact and changes

Privacy questions and requests: our Discord server at discord.gg/zerobox or by email at [email protected]. We may update this policy from time to time; material changes will be announced through the Service before they take effect, and the date at the top reflects the latest revision.