Legal · Discord community
Community Privacy Policy
Version 1.0 · Last revised 26 October 2026
This policy covers the Sublunar Discord server, which we call the Lounge, and the Sublunar Official bot that runs it. It explains what we collect when you apply, when you are a member, and when you talk to the bot, why we collect it, how long we keep it, and the rights you have under the GDPR. The website privacy policy covers sublunar.ai; the Sublunar app on your Mac keeps everything on your device and is covered in section 9 of that policy.
The short version
- The Lounge is apply to join. We read your application by hand and keep it so we can decide, and so we remember the decision.
- Inside the server the bot keeps moderation and safety logs: who joined or left, role changes, edited and deleted messages in logged channels, tickets. That is what keeps a hundred people safe with a team of five.
- We use no analytics, no advertising and no profiling. Nothing is sold or shared for marketing.
- Discord itself is a separate company with its own privacy policy. What Discord collects is theirs, not ours.
- You can ask us to show, export or delete what we hold about you at any time: hello@sublunar.ai, or open a ticket in the server.
1. Who we are
The Sublunar Discord server and the Sublunar Official bot are operated by Sublunar, a project of Buildable Labs, Romania (together "Sublunar", "we", "us"). Sublunar is the controller of the data described here. Contact for anything in this policy: hello@sublunar.ai. We have not appointed a data protection officer because of our size; that address reaches the person responsible.
2. What we collect, and why
| When you… | We collect | Why | Legal basis | Kept for |
|---|---|---|---|---|
| Apply to the Lounge | Your Discord user ID and username, your answers to the three application questions (what you do, which Mac and how much memory, why you want AI that stays on your machine), an optional link, and the time you applied | To decide whether to accept you, and to remember the decision so we do not ask twice | Steps before a contract (your request to join), GDPR art. 6(1)(b) | While you are a member. If declined or withdrawn, 12 months, then deleted |
| Are accepted | Your cohort number, the roles you hold, and the date you joined | To run membership: numbered cohorts, permissions, who can see what | Our legitimate interest in running the community, art. 6(1)(f) | While you are a member, then 30 days |
| Join, leave, or change roles | Your Discord user ID, the event, and the time, written by the bot to a log channel only the team can see | Safety and moderation: spotting raids, reversing mistakes, handling appeals | Legitimate interest, art. 6(1)(f) | 90 days |
| Post in a logged channel | Edited and deleted messages, with your Discord user ID and the time. Normal messages that you do not edit or delete are not copied anywhere by us; they stay on Discord | Moderation: seeing what was said before it was changed or removed | Legitimate interest, art. 6(1)(f) | 90 days |
| Open a ticket | What you write in the ticket, your Discord user ID, and a transcript when the ticket closes | To help you, and to keep a record of what was agreed | Legitimate interest, art. 6(1)(f) | 12 months |
| Report a rule break | Your report and the messages it points to | To act on it | Legitimate interest, art. 6(1)(f) | 12 months |
| Answer the onboarding questions | Your choices, which Discord turns into roles and channels | To show you the channels you asked for | Your consent, art. 6(1)(a); change them any time in Channels & Roles | While you are a member |
We do not collect anything else. We do not read your direct messages, we do not scan files you upload, and we do not use your messages to train any model. We never ask for, and ask you not to post, sensitive data: health, political opinions, religion, and the like. We make no automated decisions about you; every application is read by a person.
3. Where the data lives
Most of it lives inside Discord: application answers, logs and transcripts are posted by the bot to channels only the team can see. The bot itself runs on Railway, a hosting provider, and keeps a small database of applications, cohort numbers and ticket records so it can do its job. Nothing from the Lounge is sent to the Sublunar app or to any model.
4. Who we share data with
We do not sell personal data and we do not share it for anyone else's marketing. These companies process data on our behalf, under contracts that bind them to protect it:
- Discord Inc. (United States), which provides the server, the voice and text channels, and the login. Discord is an independent controller for what it collects itself; see discord.com/privacy.
- Railway (United States), which hosts the Sublunar Official bot and its database.
- Cloudflare (United States, with EU data centres), which serves sublunar.ai and the links the bot points to.
We will disclose data if the law requires it, and we will tell you unless we are not allowed to.
5. International transfers
Discord and Railway are in the United States. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards in place.
6. How long we keep data
The table in section 2 gives the period for each kind of data. When a period ends, the bot deletes the record and the team deletes the channel messages. If you leave the server, your membership record goes after 30 days; logs and transcripts follow their own periods because they protect other members too.
7. Security
Team channels are visible only to the roles that need them. Bot access tokens are stored as secrets, never in code. Two people, the founder and the Community Director, can delete logs; nobody can edit them. We keep the team small on purpose.
8. Your rights
Under the GDPR you can ask us to:
- show you what we hold about you (access);
- correct it (rectification);
- delete it (erasure), which we will do unless we need it for an open report or a legal reason;
- limit how we use it (restriction);
- give it to you in a file (portability) where it was provided by you;
- object to processing based on our legitimate interests;
- withdraw consent for the onboarding choices at any time, which only affects what you see from then on.
Email hello@sublunar.ai from an address you control, or open a ticket in the server from your Discord account. We answer within 30 days, usually much sooner. If you are not satisfied you can complain to the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or to the authority in your own country.
9. Leaving
You can leave the server at any time from Discord. Leaving does not delete your application record on its own; ask us if you want it gone sooner than the periods above. Your cohort number is retired, not reused.
10. Children
You must meet Discord's minimum age for your country to be in the server. Private beta builds may carry their own age requirement, stated when they are offered. If we learn that a member is under the minimum age, we remove the account and delete its data.
11. Other services
Links posted in the server lead to other sites with their own policies. The official ones are listed in the links channel; treat everything else as somebody else's.
12. Changes
We will update this page when our practices change and note the date at the top. If a change matters to you, for example a new purpose for your application data, we will post it in the announcements channel before it takes effect.
13. Contact
Sublunar · Buildable Labs, Romania · hello@sublunar.ai