Privacy Policy

SECTION 01

Scope and operator

This policy covers the TVA Systems Discord bot, management website, desktop app, and related infrastructure. The responsible service operator is the independently operated TVA Systems service, administered by its owner on Discord.

Discord and individual server administrators also process information for their own purposes. Their policies and responsibilities are separate. This policy describes TVA Systems; it does not control Discord’s records or every copy held by a server administrator.

SECTION 02

Information we process

We receive information from Discord, from you, from authorized server staff, and from service activity. We do not request your Discord password. Avoid including sensitive personal information or secrets in ordinary messages, files, or forms. Filters for recognized secret fields cannot detect every secret placed in free text.

SECTION 03

Why information is used

• Authenticate accounts and apply current staff, developer, server, and file permissions.
• Provide requested commands, AI replies, files, announcements, and administration.
• Maintain moderation, personnel, invite, and operational records for enabled features.
• Restore saved work, diagnose failures, maintain backups, and secure the Service.
• Respond to support and privacy requests and meet legal or platform obligations.

Where a legal basis is required, processing may rely on performing a requested service, legitimate interests in secure and functional administration, a legal obligation, or consent when required. The applicable basis depends on the feature and circumstances. Consent to optional processing can be withdrawn by contacting us or using the available feature controls; withdrawal does not make earlier lawful processing unlawful.

SECTION 04

AI conversations and message context

AI features send the prompt and selected context to the configured inference system to produce a reply. Context can include recent conversation turns, relevant profile information, recent messages from an enabled public AI channel, and file excerpts the requesting user is permitted to access.

The current deployment sends selected request content through an authenticated worker connection to LM Studio on an operator-managed computer. The model, personality, and additional behavior rules are configurable. Operators with access to that computer, model server, or its diagnostics may be able to inspect request content. Model inference is distinct from model training: TVA Systems does not implement model training on Discord messages and must not use Discord message content to train AI models without the permission Discord requires. If a hosted AI provider is introduced, we must assess its data handling and update this policy where needed before changing these practices.

Private app conversations are not automatically published to Discord channels, but “private” does not mean inaccessible to the Operator or infrastructure administrators. Selecting a Discord channel as an interaction target can change which channel-specific context and controls are used; messages deliberately sent or posted to Discord are visible to their intended recipients. Do not treat AI chat as a confidential professional relationship.

SECTION 05

IP addresses and network restrictions

The website receives network connection information. For account-level network restrictions, the application accepts a forwarded public IP address only under its explicitly configured trusted-proxy rules; otherwise a usable public network identifier may be unavailable. It converts an accepted address into a keyed SHA-256 fingerprint before forwarding it to the bot account system. The bot stores that fingerprint rather than a plain IP address in these account/session records.

Matching fingerprints can link accounts using the same public connection. The Operator can apply or remove a known-network restriction, and security diagnostics can show fingerprint values. The current account record keeps up to 20 known network fingerprints. This is a count limit, not a time-based deletion schedule. Hosting providers and other infrastructure can separately process or retain raw IP addresses.

Network matching is not precise geolocation, a device fingerprint, or proof that accounts belong to the same person. Shared or changing addresses can cause errors. Affected users can contact the Operator for a review or a privacy request even if app access is blocked.

SECTION 06

Who may access information

• You and authorized server staff: information exposed by the features and permissions they are allowed to use, including moderation and audit reports. Server staff may manage personnel and connected Discord roles where authorized.
• The Operator and authorized maintainers: information needed to operate, secure, support, and administer the Service. The bot owner has elevated access and can bypass application file locks. Owner account-management controls show registered identities, access roles, active-session counts, recent activity and restriction state; they do not display passwords.
• Discord: information sent through Discord interactions, messages, roles, and other API features, under Discord’s own policies.
• Infrastructure providers: BotHosting provides application hosting and hosting backups. Configured database/storage providers and operator-managed devices may also process service data. The desktop app uses GitHub to distribute software updates; the update check does not require uploading your private bot records.
• Recipients you direct: for example, an announcement channel, a message recipient, or authorized viewers of a file.
• Legal and safety recipients: when disclosure is legally required or otherwise permitted by applicable law and Discord’s requirements.

We do not sell Discord API data or disclose it to data brokers or advertising networks. Service-provider access must be limited to providing the relevant service and protecting data. We do not use this policy to authorize sharing that Discord prohibits.

SECTION 07

Cookies and local storage

The hosted website uses a necessary sign-in cookie named __Host-tva_session. It is marked Secure, HttpOnly, and SameSite=Strict. An initial sign-in form session lasts up to 10 minutes. Ordinary verified sign-in sessions expire after 8 hours; choosing “Remember this device” creates a session lasting up to 30 days. Sign-out invalidates the active session. Account controls can revoke other sessions, and a password change revokes other app sessions. Remembered sign-in is an authentication credential, not permission to share an account. Verification codes expire after 5 minutes.

Browser storage also saves preferences such as formatting drafts and workspace state. The version and time of explicit Terms agreement are stored with the account. Public accounts without staff or developer assignments can use Overview and AI Workspace after registration and sign-in. Account preferences and announcement acknowledgements are stored by the bot so they can persist across sign-ins; clearing browser storage does not remove those records. Mobile web-app installation does not itself request location, contacts, microphone, or camera access. Files or images are submitted only through the relevant user-selected feature. The web app caches a small offline fallback and static assets; its service worker does not cache authenticated API responses. Existing Windows owner installations store connection settings locally using the operating system’s protected storage facilities. Fresh companion installations use the hosted sign-in flow without embedding owner connection credentials. Authorized owner diagnostics may retrieve hardware and model status from the Operator’s AI computer; that feature does not inventory every app user’s device.

No advertising cookies or third-party analytics scripts are included in the current website. Clearing site data removes local preferences and cookies but does not delete records already stored by the bot or hosting systems.

SECTION 08

Retention and recovery

Different records have different lifecycles. The current implementation does not apply one automatic deletion deadline to all data.

• AI public-channel context and pre-deletion message snapshots: use a 24-hour active retention window. A resulting audit report or other separately saved record can last longer.
• AI conversation history: is bounded to the most recent 40 entries per conversation scope when memory is enabled. This is a count limit, not a promise of deletion after a fixed number of days.
• Accounts, saved drafts, files, moderation records, staff records, and invite attribution: do not all have automatic expiry. They remain until removed through supported controls or an operator-handled deletion request, subject to applicable obligations.
• Sessions, preferences, acknowledgements, and restrictions: expired or revoked sessions cease authorizing access, but that does not guarantee immediate erasure of their stored record. Preferences and restrictions remain until changed or removed. Announcement acknowledgement lists and app-account audit lists are bounded to the latest 1,000 entries; these are count limits, not fixed retention periods.
• Deleted files: ordinary archive deletion is a recoverable deletion marker, not permanent erasure of file contents.
• Logs and backups: rotation and retention depend on the log type and storage system. Copies can remain after an active record is removed. Backup expiry is not a single verified service-wide interval.

We must not retain Discord API data longer than needed for permitted functionality, except where law requires retention. We handle applicable deletion requests promptly, including relevant active storage and provider-held copies. Where a legal retention duty applies, we will explain it when permitted. A restore must not be used to reintroduce information that should remain deleted.

SECTION 09

Your choices and privacy requests

Contact the TVA Systems owner on Discord. Identify your request as a support, privacy, or security matter. Include your Discord user ID or username and the affected server, where relevant. Never send passwords, sign-in codes, bot tokens, or API keys.

Ask to access, correct, export, or delete your information, or to object to or restrict processing where those rights apply. Tell us the affected feature, server, and approximate dates so we can locate the records. We may ask you to verify control of the Discord account and clarify the scope, but not to provide its password. We will respond within applicable legal deadlines and explain any lawful limitation.

You can ask the AI to forget my conversations to clear supported AI memory for your account in the relevant server. This does not delete separate moderation logs, saved drafts, archives, backups, or copies of messages held by Discord. Removing the bot, leaving a server, signing out, or deleting a Discord message is not a comprehensive data-deletion request.

Server staff can disable or configure relevant features. Depending on your location, you may also have rights to withdraw consent, portability, or complaint to a competent data-protection authority. You may contact us even if your app access has been revoked.

SECTION 10

Security and access limitations

Controls include verified Discord sign-in, permission checks, protected session cookies, salted password hashing, rate limits, and restricted management interfaces. Three incorrect app-password attempts trigger a 10-minute lockout. Passwords are not displayed in the owner’s account list.

No system is completely secure. File locks and role checks are access controls, not end-to-end encryption. We do not promise that every database, log, or backup is encrypted merely because website traffic uses HTTPS. Report suspected unauthorized access through the contact above; we will investigate and provide notifications required by applicable law and platform obligations.

SECTION 11

Processing locations

Discord, hosting or database providers, and operator-managed systems may process data in different countries. Location depends on the infrastructure actually used. We do not promise storage in a particular country. Where applicable law requires safeguards for an international transfer, the Operator must put those safeguards in place.

SECTION 12

Age requirements

The Service is not directed to children under 13 or anyone below Discord’s applicable minimum age. Parent or guardian involvement may be required by local law. If you believe a child below the applicable age has provided information, contact the Operator so we can investigate and take appropriate action.

SECTION 13

Policy changes and related documents

We will update this page’s date and version when practices change and communicate material changes where required. This policy describes the service reviewed on October 30, 2026; it does not guarantee that future features will use identical data flows.

Read the Terms of Service for service rules, Discord’s Privacy Policy for Discord’s practices, and Discord’s Developer Terms for the Operator’s platform obligations.

SECTION 14

Legal notice: independent fan project

TVA Systems is an independent, fan-created project. It is not affiliated with, endorsed by, sponsored by, licensed by, or operated by The Walt Disney Company, Marvel, Marvel Studios, or their subsidiaries or affiliates.

Marvel, Disney, the Time Variance Authority (TVA), related characters, names, logos, artwork, and other protected materials belong to their respective rights holders. TVA Systems does not claim ownership of those third-party properties. References and theming do not imply an official partnership or permission to reuse protected material.

This Privacy Policy describes data handling by the independent TVA Systems Operator. Disney and Marvel do not operate this service or administer its accounts. Direct privacy requests and service questions to the TVA Systems Operator using the contact information above.