Dealio
Privacy Policy
1. Operator and scope
Bilgehan Boz, Çanakkale, Turkey, operates Dealio and is responsible for its processing of your personal data. This policy covers the Discord bot and its public website. Contact: blghnboz17@gmail.com.
2. Information we process
We receive your Discord user ID and command inputs; the public SteamID64 you configure; your country, language, notification consent, delivery preferences and timezone; per-game targets, currency, discounts and mute settings. We store wishlist snapshots including game IDs, names, priority and date added, observed prices, check results and times, rule revisions, delivery status, error codes and Discord message identifiers. Delivery identifiers establish acceptance by Discord, not whether you read a message. As usage records, each interaction stores your Discord ID, the ID of the server it came from (none in DMs), its context (server, bot DM or private channel), the install type (added to a server or “Add to My Apps”), the name of the command or button you used (not what you typed), your Discord language setting and the time; setup steps store their outcome and, if any, an error code. For servers the bot is added to or removed from, the server ID, name, member count and time are recorded. When the operator acts on an account in the admin panel (for example a check, a region change, a block or a message), the action, that account’s Discord ID, any detail such as a block reason, the outcome and the time are recorded. Operator announcements and direct messages are stored with their text, their audience (for a direct message, the recipient’s Discord ID) and each recipient’s delivery status. If you open a support ticket in the Dealio support server, we store the ticket number, your Discord ID, the IDs of that server, its ticket channel and your private ticket thread, the topic you picked, the ticket’s status, who closed it (you, the team or Discord) and when it was opened and closed. The description you type and any screenshots you attach are posted to your private thread, which only you and the support team can see; neither they nor the conversation are stored in Dealio’s database.
3. Steam and Discord
Validated vanity names may be sent to Valve to resolve a SteamID64. Steam receives the public SteamID64, game IDs, country and language required for price checks. During setup, Valve also returns the profile’s public name and avatar so you can confirm the account; they are shown to you and not stored. Your Discord ID is not sent to Steam. To show historical low prices in alerts and game details, IsThereAnyDeal receives only Steam game IDs and the Store country, never your Discord or Steam identifiers. Passwords are never requested. We use the Guilds intent, without privileged Message Content, Guild Members or Presence intents; ordinary conversations are not read.
4. Purposes and grounds
Data is used to provide the configuration, price checks, requested notifications, delivery retry, history, support tickets, deletion and service security you request. Where the EU/UK GDPR or Turkey’s Law No. 6698 (KVKK) applies, the legal bases are: performance of the service you request (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) for your configuration, price checks, alerts, retries, history, support tickets and deletion; legitimate interests in running, securing and improving a free service and preventing abuse (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) for usage records, server history, admin records, logs and backups; and legal obligations where they apply. Sale DMs start only after you explicitly turn them on in setup; you can pause them or delete your data at any time. Consent is obtained where legally required. Data is not sold or used for targeted advertising; no solely automated decisions with legal or similarly significant effects are made. Usage records are used to operate, protect and improve the service. The operator can view this information, together with Discord’s public profile details (username, display name, avatar, account creation date), in an admin panel reachable only by the operator over SSH; profile details are read live from Discord and not stored. The operator can turn off Dealio access for an account or a server in case of abuse. Users who completed setup and so agreed to DMs may receive service announcements or direct messages from the operator by DM; no advertising is sent. If Steam hides your wishlist, Dealio tells you once by DM how to make it public: once per hidden period if you completed setup (it stores how many checks in a row found the wishlist hidden and when that message was attempted and delivered, and clears this at the next successful check), and at most once a day if setup stopped for that reason (nothing is stored; Discord delivers the message to your DMs only if they are open to Dealio).
5. Hosting and recipients
The production bot and SQLite database run on Microsoft Azure in Sweden Central. The public website uses GitHub Pages. Backups are encrypted before leaving the VM and stored in a private GitHub repository. The recovery key is stored in a restricted GitHub Actions secret and in the operator’s private recovery copy. Healthchecks.io receives only service, backup and recovery success/failure signals and non-identifying error categories, never user IDs, wishlists or the database. The provider may process network metadata. Discord, Valve, IsThereAnyDeal and Microsoft process necessary service and ordinary network metadata under their respective practices. Data may also be disclosed where required by law or to protect rights. The source code is public on GitHub under the MIT license and contains no user data.
6. Retention
Notification history is displayed for 30 days. Price-change observations are kept for 90 days. Application logs written from 29 September 2026 use seven-day retention; older system logs follow the host’s existing rotation policy. Active queues and deduplication identifiers for continuing offers may remain longer to avoid duplicate delivery. Your current configuration and wishlist snapshot remain until you delete them; removing the bot from a server or leaving a server does not delete them. Each encrypted backup is replaced by a new one after seven days; provider deletion can take additional time. Before each software update, a copy of the database is saved on the same server, readable only by the service account, so the update can be undone; a copy older than seven days is deleted automatically by the next update. Non-identifying recovery evidence is kept for 35 days. The free Healthchecks.io plan keeps the latest 100 signal records per check. Usage records are kept 90 days, announcements and operator messages with their delivery records 90 days from sending (once sending has finished), and admin panel action records one year; the server join/leave history contains no personal data and may be kept indefinitely. For an account whose access was turned off because of abuse, the Discord ID and an optional reason are kept until the block is lifted. Support ticket records are kept for 90 days after the ticket is closed; the ticket thread itself is a Discord conversation and stays in the support server until the team deletes it.
7. Deletion
Confirming /delete-data deletes your configuration, game rules, schedule, snapshots, check state, notification records, usage records, support ticket records and the delivery records of announcements sent to you from the active database; usage records are removed even if you never completed setup. It also deletes direct messages the operator sent only to you and removes your Discord ID from the audience of any other message. Admin panel action records about your account are kept for their one-year retention as a record of operator actions, but your Discord ID in them is replaced with a one-way hash. /delete-data stays available to an account whose access was turned off, but the block record itself is kept so the abuse cannot simply repeat. Public game-price observations contain no Discord or Steam user identifiers and can remain for their retention period. Deletion does not remove Discord messages, including support ticket threads, or independent provider records; to have a ticket thread deleted, ask in the ticket or by email. Existing encrypted backups and pre-update copies are not edited individually; backups expire through retention and pre-update copies are removed as described in section 6. Application logs expire through their seven-day retention. To keep a restore from undoing a deletion, the server keeps a one-way hash of your Discord user ID and the deletion time for 35 days, in a file separate from the database. When the bot starts, it uses that record to delete any restored configuration created before your deletion. A setup you make after deleting is kept. If the server itself is lost, deletions made after the last backup can’t be re-applied. In that case, run /delete-data again or contact us.
8. Logs and security
Operational logs contain service state and diagnostic information. Interaction tokens, webhook secrets and authorization values are redacted before application logging. Bot tokens and environment files are excluded from application backups. Access controls, HTTPS, limited gateway permissions and SQLite secure deletion are used. No storage or transmission system can be guaranteed absolutely secure.
9. International transfers and your rights
Discord, Valve, IsThereAnyDeal, Microsoft/GitHub and Healthchecks.io may process data outside Turkey or your country of residence. Transfers for which Dealio is responsible are subject to applicable legal requirements and safeguards; third-party processing is governed by those providers. Subject to applicable conditions, you may request access, correction, deletion, restriction and a portable copy of your data and information about purposes and recipients; object to processing based on legitimate interests and to qualifying automated results; and exercise other rights under applicable data protection law. You can delete your data yourself with /delete-data. For other requests, write to blghnboz17@gmail.com from an address you can be identified by, and include your Discord username; we may ask you to confirm the request from your Discord account. Requests are answered within the period applicable law requires (generally 30 days). You may also complain to a data protection authority: in Turkey the Personal Data Protection Authority (KVKK), in the EU/EEA the authority of your country of residence.
10. Website, children and changes
The website uses no advertising trackers or account login. Hosting providers may process IP and browser information. The service is not directed to children below Discord’s minimum age or any higher applicable minimum age. Material changes to this policy will be reflected in the date and communicated where appropriate.