Last reviewed for the website template: November 8, 2026.
1. Overview
UL WM is a Discord bot that helps server members create watermarked copies of images. This policy describes the default behavior of the accompanying UL WM website and the example self-hosted Node.js watermark bot. If your deployment has been customized, your published policy must reflect those changes.
2. Information we handle
- Website sign-in: If you choose to sign in using Discord, we request the identify permission to read your Discord user ID, username, and avatar. The website places a signed session containing that limited profile in an HttpOnly cookie.
- Bot configuration: The example bot saves Discord server identifiers, watermark text or settings, and optional uploaded watermark logos to the bot's local persistent storage.
- Image processing: Images selected for watermarking are retrieved temporarily so a new, watermarked image can be generated and returned through Discord. The example website itself does not accept uploads or store generated images.
- Technical information: Your infrastructure provider may process basic HTTP request metadata and operational logs for security and troubleshooting.
3. Why we use it
We use the information to authenticate optional website accounts, apply each server's watermark settings, process submitted image files, provide the requested bot functionality, and maintain service reliability and security.
4. Discord OAuth2 and cookies
The website uses Discord's official authorization-code login flow. OAuth access tokens are used only to retrieve the basic Discord profile during sign-in and are not written to the website's persistent storage. A signed session cookie is valid for up to 24 hours. Temporary login-state cookies expire after up to 10 minutes. Signing out clears the session cookie.
5. Storage and retention
The example bot persists watermark settings and optional logo files until they are changed or cleared, or the deployment operator removes them. Watermarked output is posted back to Discord and is then subject to Discord's own policies. The exact lifespan of third-party hosting logs depends on your provider's settings.
6. Sharing and third parties
Discord operates the platform and handles Discord accounts, attachments, and authentication. The operator's hosting provider may process the website's or bot's technical data. This template website has no advertising trackers or third-party analytics installed.
7. Your choices and requests
Discord users can choose not to sign in to this website, sign out at any time, or revoke access to this application in their Discord account settings. Server administrators can use /wmclear to clear the active watermark configuration. For further access, deletion, or privacy questions, contact the operator below.
8. Security
We use HttpOnly cookies for session data, a signed session token, state validation and PKCE for OAuth2, and HTTPS for deployed production sites. No method of transmitting or storing information is perfectly secure.
9. Changes and contact
This policy may be updated when the service or its data processing changes. For privacy questions or deletion requests, contact the configured support email or use the support link.