Discord

Users retain ownership of the content and files they submit, but they grant Discord a broad, worldwide, sublicensable, transferable license to use, reproduce, distribute, and create derivative works from it. The license is scoped to providing, developing, and improving the services, which is expansive for a professional context.

Discord is a communications platform rather than a generative AI product, so it does not clearly address ownership of AI-generated 'output.' Content created via features falls under the same broad 'your content' license, and the policy is silent on ownership of any AI-generated results, creating ambiguity.

Discord uses certain content—particularly publicly available content and content in larger spaces—to develop, improve, and build automated systems and models, including content moderation and safety features. Users can limit some improvement-related processing via settings, but the use of public content for models is broadly reserved.

Discord retains data until it determines it is no longer needed or for legal compliance, referring to an external retention policy rather than stating explicit schedules or deletion SLAs in the policy itself. Users can delete accounts and content, and data access requests are fulfilled within 30 days, but no specific retention timeframes or security-audit retention obligations (e.g., HIPAA, SOC 2) are disclosed.

Discord discloses data to vendors, payment processors, cloud providers, advertising/analytics partners, related companies, and third-party developers/bots, and explicitly states it does not sell personal information. Sharing with third-party bots and services is integral to the platform, but sharing limited data with advertising platforms and receiving data from advertisers/data brokers introduces moderate risk beyond the core service.

Discord provides explicit opt-out mechanisms, including settings to limit data used to improve services, limit personalization and sponsored content, and opt out of marketing communications. Users can also disable or delete accounts and revoke consent, and residents of certain regions have additional statutory rights.

Discord references GDPR, CCPA, and LGPD, and it certifies under the EU-U.S., Swiss-U.S., and UK Data Privacy Frameworks, with standard contractual clauses for international transfers. However, no enterprise security certifications such as SOC 2, ISO 27001, HIPAA, or FedRAMP are mentioned, limiting suitability for regulated industries.

The policies provide no transparency into automated decision-making logic, model behavior, or enterprise auditing capabilities. Automated systems are used for content moderation and personalization, but users are given no explainability tools or audit rights.

Discord discloses encryption in transit and at rest (TLS), access controls, optional two-factor authentication, and end-to-end encryption for voice/video calls. However, it does not describe penetration testing, bug bounty programs, formal incident response, a dedicated trust center, or any breach history, and there is no SOC 2 or ISO 27001 attestation.

Discord is fundamentally a consumer product and does not offer a differentiated enterprise tier with distinct data-handling protections; paid services relate to features like Nitro rather than enhanced privacy. The same broad content license and liability caps apply regardless of whether a user accesses on behalf of an entity, offering no material data-handling upgrade for business use.

Discord reserves the right to access, review, and moderate content, including generating transcriptions of content during investigations and proactively scanning attachments and other content. While generally aimed at safety and enforcement, this means user prompts and content are not guaranteed private from human or automated review.

Discord discloses that it responds to law enforcement and government requests and publishes a Transparency Report, and it may disclose data to comply with the law or prevent harm. The Terms impose a binding arbitration clause and class-action waiver on U.S. and Canadian users, significantly limiting users' litigation rights, along with a one-year claim limitation and a low liability cap.

Discord collects significant PII including username, email, phone, birthday, IP address, device/browser data, usage patterns, and payment/billing information, and in some cases government-issued IDs, bank account, and tax information for sellers. It also processes camera/microphone access and may receive demographic data from third parties; disclosure is generally adequate but the breadth includes sensitive categories.