Private pilot policy

Only what coordination needs.

Party Pending stores guild/channel/role identifiers, Discord opt-ins, immutable availability and game ballots, election snapshots, decisions, and provider-operation audit. Individual choices are private organizer data; public Discord messages expose aggregates only.

Google access

Consent requests OpenID identity and calendar.app.created. Verified issuer and account subject identify a shared account grant; not email. Tokens are encrypted at rest using a deployment key outside PostgreSQL. We do not read personal calendars, add guests, manage sharing, or ask participants for Google accounts.

Retention and deletion

Ballot identities and election audit are purged 90 days after local outcome, including snapshots, lookup tokens, job payloads and outbox content. Session cleanup tombstones retain opaque app identifiers, remote targets and desired state without rosters or choices. Confirmed bot uninstall starts a 30-day guild-private deletion clock only after two authenticated probes. Transient failures do not start deletion.

Dormant opt-in identities expire after 90 days without a recent join or local election outcome. A current frozen electorate is protected until its outcome. /leave removes the future-cycle opt-in immediately.

Operational logs contain redacted errors, never OAuth codes, tokens, Authorization headers or raw ballots. Operators must retain logs no more than 30 days and encrypted backups no more than 30 days after deletion; backup hosting is not configured in this local build.

Disconnect is not remote deletion

Disconnect detaches this guild and preserves other guilds on a shared Google grant. Existing events can remain. Account-wide revoke disables all matching bindings. Lost consent can prevent cleanup; uncertain writes remain explicitly blocked. Neither action deletes other users’ copies.

Private pilot support: contact the Discord organizer or the operator who invited your group. Public support ownership and production hosting remain release prerequisites.