Trycord
Create account Open the app

Legal

Privacy Policy

What the software stores, why it stores it, who can see it, and how long it is kept. The first half of this document is the same on every instance, because the software behaves the same way everywhere. The second half is the part only the operator can write: their identity, their jurisdiction, their subprocessors and their retention periods.

Legal review required before publication. This document comes from the Trycord project as a starting point for an instance. It is not legal advice, and nobody has reviewed it for the instance serving it. The fields marked OPERATOR are facts only the operator can supply: their identity, their lawful basis, their subprocessors, where the instance is hosted, how long things are kept, and their age threshold. Fill them in, and have a qualified lawyer read the result, before presenting this document as binding. The contact points in these documents are the project's own. If you run your own instance, replace them with yours before you publish them.

Version: 1.0 · Template last revised: 2026-09-20 · Effective on this instance: OPERATOR: the date this policy takes effect on this instance

1. Who is responsible for your data

The operator of the instance is the controller of the personal data on it. They decide why it is processed, how long it is kept, and who it is shared with. The Trycord project is not the controller of data on an instance it does not run.

Operator: OPERATOR: the legal name of whoever runs this instance · Privacy contact: the project's Discord, discord.gg/dSF7eqsJuP

2. What the software stores

An instance stores what you give it, and what the service needs to run:

  • Account data — username, display name, an email address if you give one, and a bcrypt hash of your password. The password itself is never stored. The version of the terms and this policy you accepted, and the date you accepted it, are recorded against your account.
  • Profile data — status text, biography, avatar and banner images, the icon and banner of a community you own, and the files you attach to messages.
  • Content — the messages you send in communities and in direct messages, the history of edits and deletions, your reactions, your pins and your mutes.
  • Social graph — the communities you have joined, the roles you hold in them, and your friendships and friend requests.
  • Moderation records — reports you file, appeals you submit, actions taken against accounts or communities, and an audit log of administrative actions.
  • Short-lived tokens — password reset and email verification tokens, stored only as a SHA-256 hash, and a list of revoked session tokens.

The application server keeps no request log of its own. If the instance sits behind a reverse proxy such as nginx or Caddy, that proxy may record addresses and request paths; what it keeps, and for how long, is the operator's configuration rather than the software's.

3. Why it is processed

  • To provide the service — running the software requires storing your account and the content you send. This rests on your acceptance of the terms.
  • To keep the service secure — revoking sessions, rate limiting, enforcing role permissions, and investigating abuse.
  • To meet requests made to you — delivering password reset and email verification mail, and answering a request to see, correct or erase your data.
  • To meet a legal obligation — retaining a record where the law requires it, including where content is illegal and the operator is obliged to preserve it or report it.

The lawful basis that applies under the law of this instance is OPERATOR: the lawful basis for processing on this instance — for example performance of a contract, legitimate interest, consent, or a legal obligation.

4. Who else can see it

Personal information is not sold, and it is not used to train models. It is visible to other people only where the product requires it: other members of a community can read the messages you post there and see your display name, avatar and roles; the recipient of a direct message sees what you send them; a community's moderators can act on its members and see its message history.

A moderator on a community is not an employee of the operator and does not act on the operator's instructions. If a community is federated with another instance, the operator of that instance receives what was authorised for sharing and nothing else.

5. Processors and subprocessors

Some processing is done by somebody else: an email provider if SMTP is configured for password resets, a hosting provider, a storage provider. The operator's list is OPERATOR: the processors this instance uses, and what each may access. An instance with no SMTP configured sends no email at all.

6. Where data is stored

By default, files are written to a directory on the machine running the server, and the database is a SQLite file or a MySQL or PostgreSQL database on that machine or on one the operator controls. An operator may instead point file storage at an S3-compatible object store — Amazon S3, Cloudflare R2, MinIO or another provider.

Either way the storage is the operator's to secure, and the software expects it to be private: every file is served through an authenticated route that checks the access first, so a publicly readable bucket would expose attachments that the software would otherwise gate.

Where the instance is hosted, and whether data is transferred outside the operator's jurisdiction, is OPERATOR: where this instance is hosted, and where any processor named in section 5 is located.

7. Retention

These periods are built into the software and apply on every instance:

  • Revoked session tokens — purged hourly, once past the session's own expiry.
  • Password reset and email verification tokens — purged hourly, once used or once expired.
  • Uploaded files not yet attached to a message — deleted after 24 hours, along with their database record.

Everything else — messages, communities, roles, moderation and audit records — is kept until it is deleted, or until the account is erased. The software implements no other automatic expiry. Any longer period the operator applies, and the retention of backups, is OPERATOR: any retention period longer than these, and the backup retention schedule. Trycord does not manage backups, so a backup taken before an erasure still contains the data until that backup is discarded.

8. Your rights

Depending on where you live you may be entitled to see, correct, delete, export or restrict the use of your personal information, and to object to how it is used. In the app you can read and change your own profile, revoke your sessions, and ask for your account to be erased.

For anything else, ask the operator at the project's Discord, discord.gg/dSF7eqsJuP. The operator may ask you to prove that the request is yours, and must answer within the period the applicable law sets out. If you are not satisfied with the answer, the law of your jurisdiction usually provides a route to complain to a supervisory authority.

9. How erasure works

You can ask for your account to be deleted from Settings → Account → Delete my account. The request asks for your password and is reviewed by an administrator before it runs. When it runs:

  • Erased: your username, email address, display name, biography, avatar and banner, every file you uploaded, your sessions, friendships, friend requests and notifications. Your username is replaced with a placeholder, so it stays unique and cannot be reassigned to someone else.
  • Kept: the messages you posted, and any moderation or audit record that names you. These are kept so that other people's conversations remain intact, and so that action taken against your account, or by your account, stays on the record. They resolve to a deleted account rather than to you.
  • Transferred: a community you owned is handed to its longest-standing remaining member, so the people still using it are not left without an owner.

You can withdraw a request before it is processed, from the same screen. Every request and decision is written to the audit log.

10. Security measures in the software

  • Passwords are hashed with bcrypt, at a work factor of 12 by default and configurable per instance.
  • Sessions are signed tokens with an individual identifier, so one session can be revoked and all of them can be revoked at once. Revoking sessions also disconnects any live connection opened by the old session.
  • Permissions are enforced on the server for every request, not in the client. The role hierarchy limits who may grant, edit, reorder or remove which role.
  • Uploads are identified by their contents, not by the file name the sender supplied. Images, PDFs and a few text formats are served inline; a file the server cannot place is stored and served as a download, so a browser is never asked to interpret bytes the server did not recognise. Avatars, banners and community icons must be images.
  • A Content-Security-Policy is sent with client resources, inline scripts are not permitted, and the origins allowed to call the API are configurable.
  • Administrative actions, moderation actions and erasure decisions are written to an audit log.

Transport encryption is the operator's responsibility. Trycord speaks plain HTTP and expects to sit behind a proxy that terminates TLS, except in local development. No method of transmission is perfect, and the operator cannot promise absolute security.

11. Cookies and local storage

The website and the application store a small amount in your browser: a session cookie, your theme choice, and a token that identifies your signed-in session. There are no advertising or tracking cookies. The Cookies and local storage page describes each one and how to clear it.

12. Children

The software does not enforce an age threshold. It has no age check and no mechanism for verifying how old a user is, and it does not verify that the email address given at registration belongs to the person who gave it. An operator who serves children is responsible for the threshold they apply and for enforcing it. The threshold on this instance is OPERATOR: the age threshold for this instance, or a statement that the service is not directed at children.

Material that depicts the sexual exploitation of a child is prohibited on every instance, is not saved, and is reported to the authorities where the law requires it. The rules are in section 5 of the Terms of Service and the reporting route is on the Trust and Safety page. An operator who hosts an instance does not become exempt from the law that applies to them by running it.

13. No automated decisions

The software does not make decisions about you by itself. It does not score accounts, infer characteristics, or build a profile for advertising. Enforcement decisions are made by a person, and section 7 of the Terms of Service says how you can ask for one to be looked at again.

14. Changes to this policy

The software versions this policy, and records on your account the version you accepted and the date. When a new version is published, users are asked to accept it before it takes effect. The version and the date are at the top of this page.

15. Contact

Privacy questions about this instance go to the privacy contact named in section 1. Anything that is not a privacy question belongs on the Support page.