Privacy Policy

Last updated: February 27, 2026

Mico ("we", "us", or "our") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and what we never do with it. We built Mico with a privacy-first approach: we collect only what we need, we never sell your data, and we never use your content to train AI models.

1. Data We Collect

Discord Account Data

When you sign in via Discord OAuth, we receive and store:

  • Your Discord user ID, username, and avatar hash
  • A temporary access token to call the Discord API on your behalf (guilds list)

We do not store your Discord email address or password.

Application Data

When you submit an application through a panel, we store:

  • Your answers to the panel questions
  • Submission timestamp and application status
  • The server (guild) and panel the application belongs to

Server Configuration Data

Server administrators' configuration settings, including:

  • Panel settings, questions, and permissions
  • Webhook URLs (stored encrypted)
  • Subscription plan details
  • Audit log entries for accountability

Usage & Analytics

We use Google Analytics 4 (GA4) on the marketing website (micoapp.io) only, and only with your explicit consent via the cookie consent banner. Analytics are never active in the dashboard or bot without consent.

We collect aggregate usage metrics (e.g. number of applications processed) to understand how the service is used and improve it. These metrics contain no personally identifiable information.

2. How We Use Your Data

We use collected data exclusively to:

  • Operate the Mico bot and dashboard
  • Process and store application submissions
  • Authenticate you via Discord OAuth
  • Send Discord DM notifications for application status updates
  • Process subscription payments (via Stripe — see Section 5)
  • Maintain audit logs for server administrators
  • Improve our services based on aggregate usage patterns

3. AI Scoring — What We Do and Don't Do

Our AI commitment

AI is used solely to score application answers. Your data is never used to train AI models, and it is never retained by our AI provider beyond the immediate API call.

  • What AI does: When a panel has AI scoring enabled, your application answers are sent to OpenAI's API to generate a numeric score and brief feedback for server reviewers.
  • What AI does not do: Your answers are never stored by OpenAI for training purposes. We use OpenAI's API with zero data retention settings where available.
  • No AI training on your data: We do not use your application content, answers, or any personal data to train, fine-tune, or improve any AI model — ours or anyone else's.
  • Your control: Server administrators can disable AI scoring per panel. If disabled, no application data is sent to OpenAI.

4. Data Sharing

We never sell your data.

Your personal data and application content are never sold, rented, or traded to any third party.

We share data only with:

  • Stripe: Payment processing. We share only what's necessary for billing (email, payment info). Stripe has its own Privacy Policy.
  • OpenAI: Application answers are sent when AI scoring is enabled, for the sole purpose of generating scores. No persistent storage by OpenAI.
  • Discord: We interact with Discord's API to authenticate users and send notifications. Discord has its own Privacy Policy.
  • Server Administrators: Application content is visible to authorized managers and reviewers of the Discord server where you applied.

5. Payment Data

Subscription payments are processed by Stripe. We never store full credit card numbers or payment method details on our servers. Stripe handles all payment data under their PCI-DSS compliance. We receive only a subscription status and anonymous customer ID from Stripe.

6. Data Retention

  • Application data: Retained while the associated Discord server uses Mico. Deleted when a server removes the bot or requests deletion.
  • Account data: Retained while you have an active session. Your Discord tokens are short-lived and refreshed as needed.
  • Audit logs: Retained for up to 12 months.
  • Analytics: Aggregated analytics data retained for up to 26 months per GA4 defaults.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to certain processing of your data
  • Export your data in a portable format

To exercise any of these rights, contact us via our support server or email us directly.

8. Cookies

We use the following cookies:

  • Authentication session cookie: Required for dashboard login. Cannot be declined without losing access to the dashboard.
  • Analytics consent cookie: Remembers your cookie preference (analytics_consent). Expires in 1 year.
  • GA4 cookies: Only set if you accept analytics. Can be declined via the consent banner.

9. Security

We protect your data using industry-standard measures including HTTPS encryption in transit, encrypted storage for sensitive configuration values (such as webhook URLs), and strict access controls. However, no method of transmission over the internet is 100% secure.

10. Children's Privacy

Mico is not directed to children under 13. Discord's own Terms of Service require users to be at least 13 years old. If we become aware that we've collected data from a child under 13, we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. We will notify users of significant changes via our support server or the dashboard. Continued use of Mico after changes constitutes acceptance of the new policy.

12. Contact

Questions about this privacy policy? Reach us via our Discord support server.