1. Introduction
SmartStreamLabs operates CurseForge Updates, a Discord application for CurseForge release announcements with an optional authenticated dashboard and optional Discord-native AutoMod configuration. This Policy describes the information required to provide and secure those functions.
2. Information received from Discord
Dashboard sign-in uses Discord OAuth scopes identify and
guilds. The application receives and uses:
- your Discord user ID, username, global display name, and avatar information;
- IDs, names, icons, and ownership status for Discord servers in your guild list; and
- Discord permission values used to identify servers you own or can manage.
The HTTP server and rate-limiting controls may also process network information such as an IP address transiently to receive requests and prevent abuse. Hosting infrastructure may maintain ordinary security or access logs according to its configuration.
3. Discord bot and configuration data
The persistent bot state may contain:
- Discord guild, configured channel, and optional mention-role IDs;
- selected CurseForge project and author subscriptions;
- release types, loaders, Minecraft versions, server-pack, and crosspost settings;
- optional AutoMod settings, exemptions, alert-channel IDs, and managed rule IDs;
- known file IDs, announcement and delivery records used to prevent duplicates; and
- operational timestamps, retry status, and health counters.
IDs are retained as strings and are used to address the selected Discord and CurseForge resources. Configuration is separated by Discord guild.
4. Message content
CurseForge Updates does not require Discord's privileged Message Content Intent and does not scan general user conversations for its normal operation. For duplicate recovery, it may retrieve a limited number of recent messages in the configured announcement channel and inspect only its own messages for an announcement marker.
Optional AutoMod protection uses Discord's native Auto Moderation engine. The bot configures Discord rules through the Auto Moderation API; it does not implement a separate message-content scraper for AutoMod.
5. CurseForge data
Through the official CurseForge API, the service processes public project names and IDs, authors, project URLs, file and release metadata, release status, loaders, Minecraft versions, changelogs, and project logos. This information is used to detect, filter, format, and link to public releases.
6. OAuth tokens, sessions, and cookies
Discord OAuth access and refresh tokens are handled by server-side authentication code and held only inside an encrypted and authenticated HttpOnly session cookie. They are not returned by dashboard APIs or made available to browser JavaScript. The cookie is SameSite=Lax and is marked Secure in production.
The session also carries authentication state, a CSRF token, and the selected guild ID. Dashboard sessions expire according to the configured session duration, which defaults to 12 hours. Short-lived OAuth and install state values are used to validate callbacks. No advertising or analytics cookie is currently used.
7. Operational credentials
The Discord bot token, Discord OAuth client secret, CurseForge API key, and dashboard session secret are operational credentials. They are stored outside public page and API responses and are not intentionally exposed to dashboard users.
8. How information is used
Information is used to:
- authenticate dashboard users and verify current server-management authority;
- install and configure the bot for an authorized Discord server;
- monitor selected CurseForge projects and authors;
- filter and post release announcements to configured destinations;
- prevent duplicate announcements and safely recover uncertain deliveries;
- configure and reconcile optional Discord-native AutoMod rules; and
- protect the service, limit abuse, and diagnose operational errors.
9. Legal and safety disclosures
SmartStreamLabs may disclose relevant information when reasonably necessary to comply with law or a valid legal process, protect users or service security, investigate or prevent abuse, enforce these Terms, or meet Discord, CurseForge, or hosting-provider requirements. Only information reasonably relevant to the purpose should be disclosed.
10. Third-party services
Discord processes account, guild, message, OAuth, and AutoMod activity under its own policies. CurseForge/Overwolf processes project and API activity under its own policies. Users should review the privacy information published by those providers. Their systems and practices are not controlled by SmartStreamLabs.
11. Data selling
SmartStreamLabs does not sell CurseForge Updates user data.
12. Advertising and analytics
CurseForge Updates does not currently use personal information for third-party advertising and does not include third-party analytics, advertising pixels, or social tracking pixels. This Policy will be updated if those practices materially change.
13. Data retention
Persistent configuration, subscription, known-release, announcement, and delivery data is retained while needed to provide reliable service and duplicate protection. The current implementation does not apply an automatic fixed deletion period to that state. Some guild configuration may remain after the bot is removed so it can be restored if the bot is reinstalled.
Session information expires according to the configured dashboard session duration. Short-lived authorization caches and callback state expire or are replaced as part of normal authentication and installation flows.
14. Data removal
Authorized server administrators can remove project and author subscriptions and stop using the dashboard or bot. Removing the bot disables the server configuration but does not automatically erase its persistent state. To request removal of stored guild or dashboard-related data, contact SmartStreamLabs Support Discord and provide enough information to identify the affected Discord server. Requests may require verification of server authority.
15. Security
The service uses server-side credential handling, encrypted and authenticated session cookies, CSRF and Origin checks for mutations, current Discord guild-authorization checks, restrictive browser security headers, rate limits, and atomic state writes. These measures reduce risk but no online service can guarantee absolute security.
16. Children's privacy
CurseForge Updates is intended for people permitted to use Discord and does not knowingly target children below Discord's applicable age requirements. A parent or guardian with a concern may contact SmartStreamLabs Support Discord.
17. International users
Discord servers and dashboard users may be located in different countries. By using the service, you understand that information may be processed where the service and its infrastructure operate, subject to applicable law and provider terms.
18. Policy changes
SmartStreamLabs may update this Policy to reflect service, security, or legal changes. The date at the top identifies the current version. Material changes should be communicated through an appropriate project or support channel where practical.
19. Contact
Privacy questions and data-removal requests can be directed to SmartStreamLabs Support Discord.