Privacy Policy

This Privacy Policy explains what information the Pepper music bot (the "Bot") and the website at pepper.muralianand.in collect, why we collect it, how long we keep it, and the choices you have. It applies to everyone who uses Pepper in a Discord server, links an account to it, or browses the website.

Pepper is an independent project. It is not affiliated with, endorsed by, or operated by Discord, Spotify, Apple, SoundCloud, Deezer or any other platform it can play from. Your use of those platforms remains governed by their own policies.

Pepper has no sign-up form. Everything below is collected as a by-product of using the Bot's commands inside Discord.

We use the information described above only to:

• Run the Bot — resolve searches, queue and play tracks, apply filters, loops and volume, and restore state after a restart or node failover.
• Smart autoplay — when you turn on /autoplay, Pepper looks at the songs requested this session, plus the top songs of the people in the voice channel and of the server from the last 90 days, gathers similar songs and queues the ones that best fit the mood. See AI in smart autoplay below.
• Show your statistics — the /chart command reports your own top tracks, artists and listening time, plus the same for the server you run it in.
• Localise responses — your saved language preference selects one of Pepper's supported translations.
• Enforce permissions — the DJ role and command cooldowns depend on stored identifiers.
• Maintain and improve the service — diagnosing bugs, investigating abuse and planning capacity.
• Publish aggregate statistics — see the section on public statistics below.

We do not use your data to build advertising profiles, and we do not make automated decisions that have legal or similarly significant effects on you.

Smart autoplay is the only part of Pepper that uses AI, and it only runs while someone in your server has turned on /autoplay. Pepper first builds a shortlist of similar songs with its own scoring, then sends that shortlist to an AI model from OpenAI, which chooses the songs that best continue the session and returns a short mood label.

• What the AI receives: song titles and artist names — the songs requested this session, a few favourites of the listeners and the server, recently skipped songs and the shortlist — along with genre tags for those artists from Last.fm.
• What it never receives: Discord usernames, user or server IDs, avatars, messages, voice audio, or who requested or skipped which song.
• No training on your data by us: we do not use your data to train AI models. OpenAI handles API requests under its own API data policies, which state that API data is not used to train its models by default.
• No decisions about you: the AI only chooses which songs play next. If it is slow, unavailable or over its daily limit, Pepper uses its own scoring instead.
• Opting out: turn autoplay off with /autoplay enabled:false. Nothing is sent to the AI while it is off.

Linking Spotify is entirely optional. Pepper works fully without it. When you run /login spotify, you are sent to Spotify's own authorisation page — Pepper never sees your Spotify password.

• Scope requested: playlist-read-private and playlist-read-collaborative — permission to read your playlists, and nothing else.
• What Pepper cannot do: it cannot modify or delete your playlists, cannot follow or unfollow anything, cannot post to your account, and cannot see your Spotify listening activity or account details beyond your display name.
• What is stored: the access and refresh tokens Spotify issues, and your Spotify display name, held so the link survives restarts without asking you to sign in again.
• How to revoke: run /logout and the stored tokens are deleted immediately. You can also revoke access at any time from your Spotify account's Apps settings page.

Our website publishes aggregate statistics about Pepper — total tracks played, popular songs and artists, the most played radio stations, active servers and a live view of what is currently playing across the network.

Server-level statistics are keyed by server ID and reflect what was played by that community. Private message content, member lists and voice activity are never part of these statistics.

Pepper relies on a small number of external services to work. Each one receives only what it needs:

• Discord — the platform Pepper runs on. All interactions pass through Discord and are subject to their privacy policy.
• Music platforms and radio stations — our audio servers fetch the track or live stream itself from its source. Those sources see a request from our infrastructure, not from you.
• Spotify — contacted only when you have linked an account, and only to read your playlists.
• Radio Browser — the public station directory behind /radio. It receives the text you type into /radio (as you type, to suggest stations), your server's region to put local stations first, and a play count when one of its stations is started. These requests come from our servers and carry no Discord identifier.
• Last.fm and Deezer — used by smart autoplay to find similar songs and genre tags. They receive song titles and artist names only, sent from our servers with no Discord identifier.
• OpenAI — the AI model behind smart autoplay's picks. It receives song titles, artist names and genre tags, as described in AI in smart autoplay, and no Discord identifier.
• Database and hosting providers — store the data described in this policy on our behalf under their own security commitments.
• Google Analytics — website usage measurement only. It is not used inside the Bot.

We do not sell, rent or trade your information. We disclose it only to these service providers, or where required to comply with a valid legal obligation, or to investigate abuse and protect the safety and integrity of the service.

• Listening history and preferences are kept while you continue to use Pepper, because they power /chart and the statistics on this site.
• Spotify tokens are deleted immediately when you run /logout.
• Radio listening is kept on the same terms as listening history, because it powers the radio statistics on this site.
• Custom playlists are kept until you delete them with /playlist delete, which erases the playlist and its songs immediately.
• Autoplay session data is discarded when autoplay is turned off or the player ends. Neither Pepper nor the AI keeps a record of it afterwards.
• Technical logs are short-lived and rotate out automatically.
• Server data may be removed once Pepper is no longer in that server.

To request deletion of your personal data, contact us in our official Discord server. We will verify that the request comes from the account in question and action it, keeping only what we are legally required to retain.

Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you.
• Ask us to correct information that is inaccurate.
• Ask us to delete your data.
• Withdraw a connection you previously authorised, such as Spotify.
• Object to, or ask us to restrict, certain processing.

You can exercise all of these by contacting us in the support server. You can also limit what Pepper records simply by not using it — no data is collected about a member who never issues a command and whose tracks are never queued.

Access to Pepper's database is restricted to the maintainers who operate it. Traffic between Pepper, Discord and our providers uses encrypted connections, and the statistics API that powers our website is protected by a server-side key that is never exposed to browsers.

No system is perfectly secure. We cannot guarantee absolute security, and you share information with Pepper at your own discretion. If we ever become aware of a breach affecting your data, we will inform affected users through our support server and, where required, the relevant authorities.

Pepper is operated from India and uses hosting and audio infrastructure in several countries. By using the Bot, you understand that your information may be transferred to and processed in countries other than your own, which may have different data protection rules. We take reasonable steps to ensure it remains protected as described here.

Pepper is not directed at children. Discord requires users to be at least 13 years old, or older where local law sets a higher minimum, and the same applies to Pepper. We do not knowingly collect information from anyone below that age. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

We may update this Policy as Pepper evolves. The "last updated" date at the top of this page always reflects the current version, and material changes will be announced in our support server. Continuing to use Pepper after an update means you accept the revised Policy.

Questions about this Policy, a data request, or something that looks wrong? Reach us in our official Discord server. We aim to respond to privacy requests within 30 days.