Privacy Policy

Last updated: August 18, 2026

This Privacy Policy explains how FixQuotes collects and uses personal data when you use FixQuotes.com, the Community portal, our Discord and Slack integrations, and our other services.

Who Is Responsible for Your Data?

The data controller is FixQuotes, an independent Norwegian editorial and development studio operating FixQuotes.com. Questions and privacy requests can be sent through our contact form.

Information We Collect

Website and device data: IP address, browser and device information, pages viewed, referrer, timestamps, and related security and diagnostic information.
First-party content-view records: For supported public content pages, we may store the content type and internal content ID, timestamp, IP address, country code, browser user-agent, referring page, campaign source, medium and campaign when present, and a page count for the current browser session. We use these records to measure long-term popularity of authors, quotes and other content, maintain rankings, detect invalid or abusive traffic, and operate and improve the site.
Quote views and votes: IP addresses and related event data used to prevent duplicate activity, maintain statistics, and detect abuse.
Information you submit: Your name, email address, message, quote suggestion, correction, or other information you provide through a form.
Bot and app data: Discord server or Slack workspace IDs, channel IDs, subscription settings, timezone and delivery preferences, command activity, requesting platform IDs, and which quotes were delivered.
Custom quotes: Quote text and any optional author or topic supplied by an administrator, together with timestamps, revision history, and records identifying the administrator who created, edited, or deleted an item.

Discord Community Sign-In

Community sign-in uses Discord OAuth. We request the identify and guilds scopes; we do not request your Discord email address.

Discord profile: Discord account ID, username, display name, and avatar.
Discord servers: The guilds scope makes your full Discord server list available to FixQuotes, including the information needed to evaluate ownership and permissions. We then filter that list and show only servers where you are the owner or have Administrator or Manage Server permission. Discord does not perform this filtering before transferring the list to us.
FixQuotes subscription associations: After a fresh, complete Discord permission list is retrieved successfully, we store an internal association between your Community identity and existing active or inactive FixQuotes Discord subscription records for servers you can manage. A subscription record identifies the Discord server and channel where the bot is or was configured. The association and its verification timestamps help us link your Community account to the relevant bot subscriptions without storing your ordinary Discord server memberships.
Authorization data: Granted scopes and encrypted Discord access and refresh tokens. Tokens are used to retrieve your current profile and server permissions.
Session and security data: Hashed authentication-session and CSRF token values, IP address, user agent, last-seen time, and login, logout, and security events. A strictly necessary ASP session supports the OAuth handoff and callback.

The stored subscription association is a convenience snapshot, not proof that you still have permission and not an ownership record. Discord's current owner, Administrator, or Manage Server result remains authoritative whenever you access a server's Community features. The snapshot is replaced only after a fresh, complete permission list is retrieved successfully, so links that no longer match are removed at that point; a failed or incomplete response does not replace it.

The Community OAuth scopes do not allow FixQuotes to read your Discord direct messages or message history. Permission checks may be repeated so that access ends when you no longer manage a server.

Shared Custom Quote Collections

A custom quote collection belongs to the Discord server or Slack workspace, not to one administrator. Other authorized administrators can view and change the same collection, and its quotes may be delivered to members through the relevant bot. Audit records associate changes with the administrator who made them so we can resolve conflicts, investigate abuse, and protect the service.

Cookies and Local Storage

Community authentication: A necessary authentication session can remain valid for up to 30 days. Shorter-lived ASP session and OAuth security values are used to complete sign-in and defend against request forgery.
Session page count: The pageView session-storage value counts pages during the current browser session and may be included in first-party content-view records. It expires when the browser session ends.
Shortlist: Saved quotes are stored in your browser's local storage and do not leave your device unless you export or share them.

You can clear browser storage in your browser settings. Blocking necessary storage may prevent sign-in or other features from working.

Browser Extension and WordPress Plugin

The FixQuotes Browser Extension fetches the daily quote feed and keeps display preferences locally in your browser. It does not create a FixQuotes user profile. The WordPress plugin retrieves public quote content and may cache that content on the WordPress site; FixQuotes receives the standard HTTP information generated when the site requests our feed or images.

How and Why We Use Personal Data

For users in the EEA, including Norway, our legal bases are:

Performance of a contract: To authenticate you, provide the Community portal and bot features you request, manage subscriptions and custom quotes, and respond to your submissions.
Legitimate interests: To operate and improve the service, measure content popularity, maintain rankings and long-term statistics, plan capacity, check administrator permissions, maintain audit history, protect accounts, prevent duplicate views and votes, investigate abuse, and diagnose failures. You may object to this processing as described below.
Legal obligations: To retain or disclose information when applicable law requires it.

First-Party Content-View Logging

FixQuotes records eligible public content views in its own database. A record may contain the content type and ID, timestamp, IP address, country code, browser user-agent, referrer, session page count, and campaign source, medium and campaign when present. We use it to calculate popularity and rankings, understand demand, detect invalid or abusive traffic, and operate and improve the site.

Who Receives Data?

We do not sell personal data. Depending on the feature you use, data may be disclosed to:

Discord or Slack: To complete authorization, check permissions, receive commands, and deliver bot responses. Their own terms and privacy policies also apply.
Other members and administrators: Custom quote content is shared within the relevant server or workspace. Authorized administrators may also see collection-management information.
Infrastructure providers: Hosting, database, content-delivery, monitoring, backup, and security providers that help us operate FixQuotes.
Authorities or other parties: When required by law or reasonably necessary to protect users, the service, or legal rights.

Retention

We retain data only for the purpose stated, subject to legal holds and the limited time needed for backup rotation:

OAuth nonce: 10 minutes.
OAuth handoff records: Expire after 2 minutes and are removed by the next daily cleanup, normally within about 1 day after expiry.
Active Community session: Up to 30 days. Records of expired or revoked sessions are removed after 30 further days.
Discord authorization: Encrypted OAuth token ciphertext and granted scopes are cleared when the account is deleted. Otherwise, they are cleared after no active session remains and the 30-day retention period for the last expired or revoked session has ended.
FixQuotes subscription associations: Reconciled after a fresh, complete Discord permission list is successfully retrieved. Links that no longer match are removed by that refresh. All of your stored links and the last-sync timestamp are removed immediately when you delete your Community account; otherwise, they are removed when the related Discord authorization data is cleared as described above.
Deleted custom quotes: Soft-deleted for 90 days before permanent removal.
Community audit records: 365 days from the recorded action. Audit snapshots can include the quote text, author, and topic and may therefore remain after a soft-deleted quote row is permanently removed at 90 days. Account deletion anonymizes the administrator reference in these records.
Dormant Community accounts: Removed or anonymized after 365 days without activity.
Active subscriptions and shared custom quotes: Kept while the server or workspace uses the feature, until an authorized administrator deletes them or they are otherwise no longer needed.
First-party content-view records: There is currently no fixed automatic expiry. They are retained to maintain long-term popularity, rankings and editorial statistics. Records may be deleted when associated content is deleted, when invalid or test traffic is removed, or following an applicable privacy request.
Local browser data: Kept on your device until you or your browser removes it.

Other website, form, delivery, and security records are retained only as long as reasonably necessary for their stated purpose, dispute handling, or a legal obligation.

Deleting Your Community Account

You can use the self-service account deletion option while signed in to the Community portal. Deletion removes your Discord authorization, active sessions, stored FixQuotes subscription associations, and their last-sync timestamp, and removes or anonymizes your Community profile and actor references.

Account deletion does not automatically delete active custom quotes in a shared server collection. The quote content remains available to that server, but your identity is removed or anonymized from its actor history. If you want a quote removed as well, delete it before deleting your account or ask another authorized server administrator. If you cannot sign in, submit a request through our contact form. More general deletion guidance is available on our Data Deletion page.

Your Privacy Rights

Subject to applicable law, you may have the right to:

access your personal data and receive a copy;
correct inaccurate or incomplete data;
request erasure;
restrict processing;
receive portable data where the right applies;
object to processing based on legitimate interests; and
withdraw consent at any time.

Use our contact form to exercise a right. We may need to verify your identity and will normally respond within one month. You may also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or the supervisory authority where you live or work.

Security

We use technical and organizational safeguards appropriate to the service. These include encrypting Discord OAuth tokens and storing hashes rather than raw values for Community session and CSRF verification. No transmission or storage system can be guaranteed completely secure.

International Transfers

Discord, Slack, Google, or infrastructure providers may process data outside Norway or the EEA. Where required, we rely on an applicable adequacy decision, standard contractual clauses, or another lawful transfer mechanism.

Children's Privacy

FixQuotes is not directed to children under 13. Discord users must also meet the higher minimum age, if any, required in their country. If you believe a child has provided personal data contrary to these requirements, please contact us.

Changes and Contact

We may update this policy as the service or legal requirements change. We will post the updated policy here and change the date above. For questions or privacy requests, please contact FixQuotes.