PRIVACY POLICY

BrainRotAI, a small business operated from the Commonwealth of Virginia, USA, is the data controller for the ScenarioRoast / BrainRotAI Discord bot (the "Bot"), the web dashboard at https://www.brainrotai.io, and our Stripe checkout flows. Contact: support@brainrotai.io. Discord's own privacy policy separately governs Discord's processing of your data on its platform.

• Discord message content: message text, author user ID, channel and server IDs, and timestamps — collected continuously in servers where the Bot is installed, and BACKFILLED from recent server history when the Bot first joins a server (see Section 4).
• Derived data: vector embeddings of messages, used to imitate writing style and retrieve relevant context for features like /ask and roasts.
• Discord account data: your user ID, username, display name, and avatar; server membership as needed for features.
• Web dashboard (Discord OAuth sign-in): Discord user ID, username, avatar, email address, and the list of servers you belong to (used only to show servers you share with the Bot).
• Purchase data: Stripe transaction IDs, amounts, the server credited, and timestamps. We NEVER receive or store card numbers — payment details go directly to Stripe (stripe.com/privacy).
• Service data: Brain Cells balances, game and XP state, command usage, opt-out status, and basic security logs (IP address, user agent) for the website.
• Optional voice enrollment (/voice-enroll): if YOU choose to submit a recording of your own voice with explicit consent, it is sent once to our voice provider (Fish Audio or xAI) to create a synthetic voice profile; we do NOT store the recording — only the resulting voice profile id. It is used solely to voice AI answers about you, and /voice-remove (or opting out) deletes the profile and withdraws consent.
• Live voice calls (/call): when a caller starts a /call, ONLY that caller's microphone audio in the voice channel is processed — it is transcribed in real time (via Google Gemini) so the AI clone can answer, then immediately discarded. Call audio is never stored, and no other member of the voice channel is captured or transcribed. The call-start message in the channel discloses that the caller's mic is live.

We do not seek any sensitive data categories (such as racial or ethnic origin, health, sexual orientation, or precise geolocation), we do not knowingly collect data from children under 13, and we never collect financial account numbers. The one exception you control: optional voice enrollment, described below — we never collect voice data unless you explicitly submit it.

• Only to provide the Service's stated features: generating roasts, parody impersonations, trading cards, games, and images; running the Brain Cells economy and XP; dashboard sign-in and server management; payment fulfillment; and safety, moderation, and abuse prevention.
• Message content and prompts are sent to Google Gemini and OpenAI at request time for inference only — to generate the specific output requested.
• We DO NOT use your messages to train or fine-tune AI models. We do not sell personal data. We do not use your data for targeted advertising or share it with data brokers or ad networks.
• Optional cross-server memory (OFF by default): if YOU enable it in the dashboard Settings, your own messages from any server you share with the bot may be used to make your AI clone and roasts more accurate in other servers. It only ever widens the use of your own messages — never anyone else's — and you can turn it off at any time.

Read this section — it is the most important one. When a server administrator invites the Bot to a server, the Bot imports recent message history from that server, including messages from members who have not personally used the Bot. The inviting administrator authorizes this for the server. New messages are collected on an ongoing basis while the Bot remains in the server.

• Opt out any time: run /roast-optout in Discord (or use the dashboard toggle). This IMMEDIATELY purges all of your stored messages and embeddings and blocks all future collection and processing of your data, across all features and servers. Opted-out users cannot be roasted, impersonated, or included in cards.
• Opt back in with /roast-optin whenever you choose.
• Server administrators can remove the Bot at any time, which stops all collection for that server; that server's message data is deleted within 30 days of removal.

• Discord Inc. — the platform and its APIs (discord.com/privacy).
• Google LLC (Gemini API) — text generation at request time (ai.google.dev/gemini-api/terms).
• OpenAI LLC (image API) — image generation at request time; API data is not used by OpenAI to train models by default (openai.com/enterprise-privacy).
• Stripe Inc. — payment processing (stripe.com/privacy).
• Railway Corp. — US-based hosting infrastructure where our databases live.
• Google LLC (Google Analytics) — aggregate website traffic measurement, only with your cookie-banner consent (see Section 11).
• Fish Audio Inc. and/or xAI Corp. — text-to-speech and (only with your explicit enrollment) private synthetic voice profiles for voice replies (fish.audio, x.ai/legal).

Sharing is limited to these service providers, legal compliance, and your own express direction. We do not sell personal data and do not share it for cross-context behavioral advertising. If the business is ever acquired or merged, data may transfer with notice to you.

• Message content and embeddings are kept only while the Bot remains in the relevant server and you have not opted out.
• Opt-out purges are immediate. Other deletion requests are honored within 30 days.
• When the Bot is removed from a server, that server's message data is deleted within 30 days.
• Stripe transaction records are retained up to 7 years as required for tax and accounting.
• Deleted data leaves backups on the normal backup rotation cycle (within 35 days).

Regardless of where you live, we honor the following requests for everyone (modeled on the Virginia Consumer Data Protection Act, even though our size is below its statutory thresholds): confirm whether we process your data and access it; correct it; delete it; receive a portable copy; and opt out of any targeted advertising, sale, or profiling — none of which we do in the first place.

• How to exercise: run /roast-optout in Discord (identity is verified automatically), use the dashboard opt-out toggle, or email support@brainrotai.io from any address with your Discord user ID.
• We respond within 45 days (extendable once by 45 days for complex requests), free of charge. If we decline a request, you may appeal by replying to our decision email.
• California residents: we are not currently a covered business under the CCPA/CPRA, but we honor the same requests from you.
• EU/UK users: our legal bases are performance of contract (features you invoke), legitimate interests (server-wide features, security), and consent (dashboard sign-in). You have rights of access, rectification, erasure, restriction, portability, and objection — the opt-out command is the fastest way to object and erase.

The Service is not directed to children under 13 and may only be used by people 13 or older (or the higher minimum age of digital consent in your country). We do not knowingly collect personal information from children under 13. If we obtain actual knowledge that we have collected personal information from a child under 13, we will delete it promptly. Parents or guardians can report a child's account to support@brainrotai.io.

Data is encrypted in transit and stored on access-controlled, US-based infrastructure with encrypted-at-rest volumes and minimal administrative access. No system is perfectly secure — if a security breach affecting your personal information occurs, we will notify you and the appropriate authorities as required by applicable law, including Va. Code § 18.2-186.6, and we will notify Discord of any unauthorized access to data obtained through its APIs.

All data is stored and processed in the United States. If you use the Service from outside the US, your data is transferred to and processed in the US. Our subprocessors (Google, OpenAI, Stripe) process data under their own published compliance frameworks.

The dashboard uses strictly necessary session cookies to keep you signed in with Discord OAuth. Separately, the public website uses Google Analytics to understand traffic and measure whether our advertising works — but only if you accept the cookie banner. Analytics and advertising cookies default to OFF (Google Consent Mode); declining the banner keeps them off, and the site works identically either way. Analytics data is aggregate (pages visited, referral source, approximate region) and is never joined with your Discord messages or roast data. See Google's privacy policy at policies.google.com/privacy.

Material changes to this policy will be announced on the Site with a new effective date, and prior versions are archived. Questions, requests, or complaints: support@brainrotai.io (BrainRotAI, Virginia, USA). See also our Terms of Service.