Privacy Policy

Last updated: 15 July 2026

The short version. The core editor is local by default and does not require an account. Your current draft, locally saved messages, recent webhook URLs, attachments, preferences, and any AI API keys are kept in your browser. Data leaves your device only when you use a feature that needs it: sending to Discord, creating a short link or schedule, saving to a server library, joining a collaborative Activity, using AI or a plugin, sending feedback, signing in, or managing a paid plan. Those choices and their retention are explained below. We do not sell your data.

This policy explains what DWEEB (the "Discord Webhook Embed Builder," "we," "us"), hosted at dweeb.faizo.net, does with information when you use the site. DWEEB is free for noncommercial use and source-available; the source code is available at github.com/FaizoKen/DWEEB.

1. Local-by-default editor data

The core DWEEB editor is a client-side application. The following are saved to your browser's localStorage / IndexedDB and are not sent to our servers merely by editing:

The message you're currently editing (auto-saved draft).
Webhook URLs you enter and your list of recently used webhooks.
Messages you explicitly save as Browser drafts.
Attachments/images you add while building, until you send or upload them.
API keys for the optional AI assistant (bring-your-own-key).
Interface preferences (e.g. the last server you connected to).

This data stays on your device until you remove it. You can clear it at any time by clearing your browser's site data for dweeb.faizo.net, or by using the in-app controls (Reset, remove a saved webhook, etc.).

Choosing an action can transmit the relevant data. For example, Send uploads the message and attachments to Discord; AI sends your prompt, draft context, and key to your selected provider; and a server draft uploads the message to DWEEB's server library. The sections below describe each case.

Plugins. A plugin configuration iframe may request only the editor resources declared in its bundled manifest. Saved-webhook lists contain labels, not tokens. If a plugin needs a webhook credential, DWEEB names the plugin and destination and asks you before sharing that one URL. A stateful plugin retains an approved URL in its own configuration so it can keep handling interactions. Removing the component or clearing browser data does not delete that server-side plugin record. The bundled Modal Form and Self Role services store these plugin configurations in their SQLite databases; treat the plugin operator as a recipient of the credential. Delete or replace the webhook in Discord to revoke access. Plugin configuration and interaction services process the other data needed for the action, so attach and configure only plugins you trust.

2. Share links

When you create a share link, the entire message is compressed into the URL's # hash fragment (for example dweeb.faizo.net/#s=…). By design, browsers never send the fragment to a web server, so the contents of a share link are not received or stored by us. However, anyone you give the link to can open and read that message, so treat share links accordingly.

Short links (optional). If you choose to create a short link, the compressed message is uploaded to our server and stored under a random id so it can be served from a short dweeb.faizo.net/s/… URL. Unlike the hash link above, this means the message contents do reach us. Short links automatically expire and are deleted after 7 days. The short-link record itself contains no account or IP-address field; ordinary infrastructure and security logs may still process request metadata as described below. Don't create one for a message you wouldn't want on our server — use the default hash link instead.

3. Sending messages to Discord

In the web app, clicking Send, Restore, or update normally makes your browser talk directly to Discord's webhook API. Your webhook URL, message content, and any uploaded files go to Discord. Activity publishing and scheduled posts must instead pass through our proxy so they can work while embedded or after your browser closes. This is governed by Discord's Privacy Policy. A webhook URL is a credential — treat it like a password and only share it with people you trust.

Messages can contain image, video, and other media URLs. Opening a preview or shared design may cause the viewer's browser to request that media from its host, which can receive normal web-request information such as the viewer's IP address and browser details.

4. Signing in with Discord (optional)

If you choose to sign in with Discord to load a server's roles, channels, and emojis, we use Discord's OAuth flow. From it we receive your Discord user ID, your username/display name, your avatar, an access token, and the list of servers you can manage. This information is stored in an encrypted, HttpOnly session cookie kept in your browser — we do not maintain a server-side account database. The access token is used only to confirm you belong to a server before returning its data, and that data is briefly cached on our proxy to reduce calls to Discord. Signing out clears the session. If you never sign in, none of this applies.

5. Server-backed features (optional)

These features store or relay data because they cannot work solely in one browser:

Scheduled posts. We store the Discord webhook URL, message payload, schedule, destination identifiers, and ownership/management data. Sensitive payloads and webhook URLs are sealed at rest. Active schedules remain until they run or are cancelled; completed and failed rows are normally removed after 7 days.
Server message library. Server drafts and a rolling history of messages posted through DWEEB store the message payload and, where needed for later editing, the webhook URL. Sensitive values are sealed at rest. Drafts remain until a server manager deletes them; posted history evicts older entries as the server's plan window fills. People who can manage that Discord server can access its library.
Discord Activity. Collaborative room state and presence are relayed in real time. Recoverable Activity drafts are stored server-side and normally expire after 7 days without activity. Publishing and editing are proxied to Discord and may be recorded in the server's posted-message history.
Feedback. When you submit the feedback form, we receive the category, summary, details, and optional contact you enter. Normal proxy logs may also contain request metadata such as an IP address and browser user agent. The report is relayed to our feedback forum and retained there so maintainers and community members with access to that forum can respond and help improve DWEEB. When you submit from the Discord Activity, the report also includes your verified Discord display name and user ID. Do not include secrets.
Plans and billing. Stripe processes checkout and payment details. We keep a limited subscription mirror containing the identifiers and status needed to bind a plan to a Discord server and enforce its quotas; DWEEB does not receive or store full card details.

6. The AI assistant (optional)

The optional AI assistant is bring-your-own-key. When you use it, your prompt and your API key are sent directly from your browser to the provider or compatible gateway you selected (e.g. OpenAI, Anthropic, Google, Groq, OpenRouter, or your Ollama endpoint). DWEEB does not proxy or store those prompts or keys. Your use of a provider is subject to that provider's privacy policy and terms. A custom endpoint is controlled by whoever operates it.

7. Analytics

We use Google Analytics to understand how DWEEB is used (for example, how many people visit and which features are popular). Google Analytics may collect information such as the pages you view, your approximate location derived from your IP address, and your device and browser type, and may set cookies. This is governed by Google's Privacy Policy. DWEEB sends a page's public canonical URL rather than the live address bar, reduces a referring URL to its site origin, and limits product events to fixed public fields. Draft hashes, webhook and OAuth values, Discord identifiers, and message text are not analytics fields. DWEEB does not load Google Analytics when your browser sends Do Not Track or Global Privacy Control. You can also opt out using the Google Analytics opt-out browser add-on or a content blocker.

8. Crash reports (diagnostics)

Because DWEEB's editor UI runs in your browser, a bug that breaks it is otherwise invisible to us. When an unexpected runtime error occurs, DWEEB sends a small, automatic crash report to our proxy so we can find and fix it. A report contains only technical diagnostics: the error message and a few lines of the code stack trace, the app version, and the page path (for example /templates). It never includes your message content — in particular it never includes the # hash fragment where a draft or share link lives — and it carries no account, webhook URL, API key, or other input you typed. Reports are de-duplicated and rate-limited so a single bug can't flood us, and they're written to our short-lived server logs, not a user profile. Because they contain no personal data and are essential to keeping the app working, crash reports aren't separately opt-in. DWEEB suppresses them when your browser sends Do Not Track or Global Privacy Control; a content blocker can suppress them too.

9. Hosting and server logs

The site is hosted on GitHub Pages. Like most web infrastructure, our hosting and the Discord login proxy process technical data such as IP addresses to deliver the service, apply per-IP rate limiting, and protect against abuse. We don't use this to build user profiles.

10. Cookies

Session cookie — set only when you sign in with Discord (encrypted, HttpOnly), plus a short-lived OAuth state cookie for security. Cleared on sign-out.
Analytics cookies — set by Google Analytics, as described above.

We do not use advertising or cross-site tracking cookies.

11. Third-party services

DWEEB relies on these third parties, each with its own privacy policy:

Discord — webhooks, sign-in, and server data.
Google Analytics — usage analytics.
GitHub Pages — hosting and content delivery.
Stripe — optional checkout and subscription management.
Whichever AI provider you select, if you use the AI assistant.
Any plugin you choose to attach to a component — each runs as an independent service with its own privacy policy.
Hosts of external media URLs included in messages you preview or open.

12. Data retention

Local data persists until you remove it or clear this site's browser storage. Short links expire after 7 days. Activity drafts normally expire after 7 inactive days. Completed or failed schedules are normally swept after 7 days; active schedules remain until completion or cancellation. Server-library drafts remain until deleted, while posted history is a rolling plan-sized window. Stateful plugin configuration remains in that plugin service until its operator removes it; DWEEB currently has no automatic plugin-record deletion when you remove a component. Revoking the Discord webhook immediately makes a retained URL unusable. Subscription records are retained as needed to administer plans, resolve disputes, and meet legal obligations. Operational, security, feedback, and crash-report logs are retained only as long as reasonably needed for those purposes.

13. Children

DWEEB is not directed to children. You must meet Discord's minimum age requirement (at least 13, or older where your local law requires) to use Discord-related features.

14. Your rights

Depending on where you live (e.g. under the GDPR or CCPA), you may have rights to access, correct, or delete personal data. In practice, most of your data is local and already under your control: clear your browser's site data to erase it, sign out to clear the session cookie, cancel schedules, and delete server-library entries with the in-app controls. For anything else held on our side, or to make a request, contact us using the details below.

15. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of DWEEB after a change means you accept the revised policy.

16. Contact

Questions about privacy? Email mail@faizo.net or join the DWEEB support server.