DisGo Privacy Policy

Last updated: October 26, 2026

1. Who we are

DisGo (“DisGo”, “we”, “us”) is a Windows application and website at disgo.app that routes only Discord traffic through DisGo servers so Discord works reliably on restricted networks. This policy explains what information we collect through the website, the DisGo app and our sign-in services, why we collect it, and the choices you have. Contact: privacy@disgo.app.

2. Information we collect

Account information. When you sign in with an email code we store your email address. When you choose “Continue with Google” we receive, with your permission, your Google account’s email address, name and profile picture (avatar) and Google’s unique account identifier. We request only the basic openid, email and profile scopes; we never get your Google password and never access Gmail, Drive, Contacts or any other Google service.

Service and usage data. Your plan, monthly data allowance and the number of bytes sent and received through DisGo, with connection start/end times and the route used. We do not record the content of your Discord messages, voice, files or the websites you visit.

Device identifier. To enforce our fair-use rules (one free allowance per computer, limited accounts per computer) the app computes a salted, one-way hash of your Windows machine ID and hardware serial numbers (motherboard, CPU, disk). Only the hash leaves your computer; raw serial numbers are never sent. We also store the app version and whether the computer appears to be a virtual machine.

IP addresses and technical data. Our servers and providers process your IP address and basic request data (browser/app version, time) to deliver the service, prevent abuse and apply rate limits. IP addresses are used in short-lived rate-limit counters and the last-seen IP of a linked device.

Diagnostics (on by default). To keep connections stable, the app automatically sends anonymous technical reports: app version, Windows version, your internet provider’s network name (ISP/ASN, not your IP address), route test results, failover events, connection errors and a hashed machine ID. Reports never include your Discord messages, traffic content, files or passwords, and user names in file paths are removed on your device before sending. You can turn this off at any time with “Share diagnostics” in Settings.

Waitlist. If you join the waitlist we store your email and, if you choose, your internet provider.

Communications. If you email us, we keep the message to answer you.

3. How we use information

To create and secure your account and sign you in (email codes, Google sign-in, linking the desktop app to your account).
To provide the service: issue connection credentials, measure usage against your plan and show it to you.
To prevent fraud and abuse: fair-use limits per device, blocking disposable or duplicate email addresses, rate limits and bot protection.
To keep DisGo reliable: monitoring, troubleshooting and anonymous diagnostics (unless you turn them off).
To send service emails you request (sign-in codes, waitlist confirmation). We do not send marketing email without your consent.

4. Google user data

DisGo uses Google Sign-In only to authenticate you. The Google user data we receive (email address, name, profile picture and account ID) is used solely to create and identify your DisGo account, sign you in, show your name and avatar in your account, and contact you about your account. We do not use Google user data for advertising, do not sell it, and do not transfer it to third parties except the service providers listed below that host our authentication and database, as necessary to provide the service, for security, or to comply with law.

Limited Use. DisGo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalized artificial-intelligence or machine-learning models, and humans do not read it except with your consent, for security purposes, or to comply with law.

You can revoke DisGo’s access at any time at myaccount.google.com/permissions.

5. Cookies and local storage

We use only strictly necessary cookies: secure, HTTP-only Supabase session cookies that keep you signed in. Your language choice is kept in your browser’s local storage. Cloudflare Turnstile, our bot-protection check on sign-in and waitlist forms, may process technical signals and set cookies needed to tell humans from bots (see Turnstile privacy addendum). We do not use advertising or cross-site tracking cookies and do not use third-party analytics.

We do not sell or rent personal information. We share it only with providers that process it on our behalf under contract:

Supabase — authentication and database, hosted in the EU (Frankfurt, Germany).
Vercel — website and API hosting.
Resend — delivery of sign-in and service emails.
Cloudflare — Turnstile bot protection and DNS.
Google — sign-in, only if you choose “Continue with Google”.

DisGo’s connection servers carry your Discord traffic in encrypted form and do not log its content. We may disclose information if required by law, or to protect the rights and safety of our users and the service.

7. Data retention

Account data (email, Google profile data, plan): while your account exists; deleted within 30 days after you delete your account.
Usage records: up to 12 months for billing and fair-use, then deleted or aggregated.
Device identifier hashes and fair-use records: while any linked account is active, and up to 12 months after last use.
Rate-limit counters with IP addresses: minutes to 24 hours.
Diagnostics reports: up to 90 days.
Server logs from our hosting providers: per their short retention, typically up to 30 days.

8. Security

Data is encrypted in transit (TLS) and at rest by our providers. Database access is protected with row-level security so each user can read only their own data, and administrative keys stay on our servers. Sign-in uses one-time codes or Google OAuth; we never store passwords. Device identifiers are salted hashes. No method is 100% secure, but we work to protect your data and will notify you as required by law if a breach affects you.

9. Your rights and choices

Depending on where you live (for example under the GDPR), you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to withdraw consent. You can:

See your account details and usage in your account on the website.
Turn diagnostics off in the app’s Settings, and uninstall the app at any time.
Revoke Google access at Google Account permissions.
Request access or deletion by emailing privacy@disgo.app from your account’s email address. We respond within 30 days. Deleting your account removes your email, Google profile data and usage history; anonymous fair-use records may be kept as described above.

You may also complain to your local data-protection authority.

10. Children

DisGo is not intended for children under 13 (or the minimum age required in your country, such as 16 in parts of the EU), and we do not knowingly collect their data. If you believe a child has given us information, contact us and we will delete it.

11. International transfers

Your data is stored in the EU and may be processed in other countries by the providers above, under appropriate safeguards such as Standard Contractual Clauses.

12. Changes to this policy

We may update this policy. We will change the “Last updated” date and, for significant changes, notify you in the app or by email before they take effect.

13. Contact

Questions or requests about privacy: privacy@disgo.app. Developer: Ahmad Khajeh, DisGo, https://disgo.app.