Every field named.
Nothing buried.

Kizzey sends a tiny, opt-out diagnostics ping so the developer can see which features people actually use and fix the ones that break. Your Discord token never leaves your phone, and neither does your password, your DMs or your IP. If you use Kizzey Chat, what you post there is stored, and this page says exactly what and where. If you use Kizzey Chat, what you post there is stored, and this page says exactly what and where.

Token stays on your device Calls end to end encrypted No IP address stored Never sold or shared Off in one tap Erasure on request

What changed in this update

New on 22 August 2026: Donations. Kizzey now takes card payments in the app. Your card details never reach Kizzey at all: they go straight from the payment sheet to the payment provider, encrypted. There is a section below that says exactly what the encryption does guarantee, what it does not, and the handful of things the relay can still see even though the audio is closed to it. Nothing you say is recorded or stored, by anyone, at any point.

Also new: privacy settings for your profile. Your photo, last seen, KCoin, streak, level, about and clan each get their own audience, set to everyone, your clan or nobody, with per-person always and never lists. Nothing was made more visible by this change: the settings start where your profile already stood, and every one of them can only narrow it.

Previously, on 4 August 2026: message erasure, which removes every message you have sent in Kizzey Chat without closing your account, and the four things this policy had never said plainly before: who is responsible, the lawful basis for each thing held, how long it is kept, and your rights as buttons in the app rather than an email address to hunt for.

Get a copy, or have it erased

Section 00

Who is responsible

Kizzey is made and run by one person: UnpackedX, an independent developer, working on Kizzey as a personal open-source project rather than through a company. There is no team, no parent organisation, no investor, and nobody else with access to the data described on this page.

Who decides what is collected

UnpackedX, the developer of Kizzey. In data protection terms that makes them the controller for everything on this page.

How to get in touch

cryptdex@protonmail.com, or open an issue on Codeberg. For a copy of your data or an erasure, the app's own buttons are faster.

Where it is processed

On Cloudflare's network (Workers and D1). Cloudflare is a processor: it hosts the code and the database and does nothing else with the data.

Independent of Discord

Kizzey is an unofficial fork, not affiliated with or endorsed by Discord Inc. Your Discord account stays governed by Discord's own policy.

Sections 01 and 02

Why it exists, and what the ping carries

So the developer can see how many people use Kizzey and which features actually get used, and spend time there instead of guessing. That is the entire purpose. No ads, no selling data, nothing shared with anyone else. Once per launch, then roughly every 15 minutes while the app runs and analytics is on, a single ping carries:

Install ID

A one off random value made on first launch, kept only on your device. It groups your launches so you count as one person. Not tied to your hardware or your account.

Device and system

Manufacturer and model (for example Samsung SM-S918B), Android version, and your language (en-GB).

App version

The Kizzey version name and build number, so a bug can be tied to a release.

Which features are on

A simple on or off per toggle, and which RPC you last ran. Switch states only, never what is inside your presence.

Discord identity while on

Your Discord user ID, username, display name and avatar, so the developer can see which accounts use Kizzey. Your email, servers, friends and DMs are not collected.

Check in times

When your app last pinged and how many times, added by the server, so it can show who is active. No location, no IP.

Enhanced diagnostics opt in, off

Only if you switch on Enhance Diagnostic Collection in the Shizuku section: a limited, Kizzey scoped debug snapshot, its own logcat plus the media, audio and battery dumpsys it already reads. Never other apps' data, your messages, tokens, or IP.

One time install count. The first time Kizzey launches it sends a single minimal ping, your install ID, app version and device model only, no Discord identity, no usage, no toggle states, so a new install is counted once even if you leave analytics off. It is sent one time and never again; everything else above is only sent while analytics is on.

Section 02b

Kizzey Chat and the gallery

These are community features you opt into by using them, and they work the only way a community can: what you post is stored so other people can read it. That is not analytics and it is not hidden in the ping, so it gets its own section. If you never open Kizzey Chat, none of the rows below ever exist for you.

Messages you send in Kizzey Chat

Text, any images or files you attach, reactions, poll votes and read receipts. Stored in chat_msgs, chat_reactions, poll_votes and chat_reads, and relayed to a private Discord channel the developer runs. For: being a chat. Other members see them, which is the point.

Your Kizzey profile

Display name, bio, profile picture, favourite song, showcased presets, level, XP, streak, roles, name effects, appreciations, and "My device" if you switch it on. Stored in chat_profiles. For: being someone in the room rather than an id.

Gallery presets and Dev Wall reactions

Anything you publish: shared presets and Smart Detection setups, votes and reactions. For: publishing it, which is what you asked for by posting.

Reports and moderation records

If you report a message, or one of yours is reported, that record is kept while the matter is open. For: keeping the room usable. Erased with everything else when you ask.

Nothing here is scanned or mined. Your chat messages are not read for analytics, not fed into Kizzey Learning, and not used to profile you. They are stored so the chat can show them, and that is all. "My device" is off until you turn it on, and the text is yours to write or blank.

Donations

Paying, and what is kept

Donating is optional and nothing here applies unless you choose to do it. The card sheet is drawn by our payment provider, not by Kizzey, and this is the part worth reading twice: your card number never reaches Kizzey. It is entered into the provider’s own sheet and encrypted to them. Kizzey’s server never sees it, never stores it, and could not read it if it tried.

What Kizzey keeps

The amount, the currency, the date, a payment reference from the provider, and which Kizzey account it belongs to. Stored in donations and donation_charges. For: moving the goal bar, granting your tier, and being able to answer you if a payment goes wrong.

What Kizzey never receives

Your card number, expiry or security code. Your billing address. Your email address. Kizzey does not ask the payment sheet for any of them, so there is nothing to leak.

Your name, only if you tick the box

There is a tick box above the pay button asking whether your name may appear on the supporters list. It is off unless you turn it on. Leave it off and your donation still counts toward the goal and still grants your tier, but the room is told “Someone donated” and no name is published.

The payment provider

They are the ones who actually take the payment, and they hold what a card payment requires: the card, and the postcode their fraud checks need. They are bound by their own privacy policy and by the card schemes. Kizzey is a customer of theirs, not a party to your card details.

Donation records are kept while the account exists, because they are what your tier is proved from. They are included in a data export, and erased with everything else if you ask to be forgotten — except where the provider or the law requires a payment record to be retained for accounting, which is not Kizzey’s to delete.

Section 02d

Choosing who sees what

Your profile is not all-or-nothing. Your photo, last seen, KCoin, streak, level, about and clan each have their own audience: everyone, your clan, or nobody. Each one also takes an always share with and a never share with list for named people, and never wins over always.

Enforced on the server

A hidden field is not sent to people who may not see it, rather than sent and hidden by the app. Somebody reading the raw network traffic sees the same nothing you intended them to see.

A public photo, if you want one

When your real picture is hidden from someone, you can offer a different one in its place. It only appears once somebody is actually excluded, because otherwise there is nobody it could ever be shown to.

These settings can only ever narrow what is visible. They started where your profile already stood when they were introduced, so turning them on has never revealed anything that was previously hidden.

Optional

Kizzey Learning opt in

A separate choice. Turn it on and Kizzey looks for patterns in how well the app runs and which community features get used. It is anonymous, tied only to your random install ID, never your messages, tokens, or DMs.

Off until you agree Install ID only No extra ping

Reliability and performance

Your network speed and connection type, whether RPC connects and reconnects cleanly, app start time, and crash signals. For: fixing reliability issues before they reach you.

Preset and community activity

Counts only: how many presets you create or import, how often you use the gallery. Never the contents of a preset, a post, or a message.

How the learning part works. Patterns are learned in aggregate across many anonymous installs, to improve the app, not to profile you as an individual. Turn it off and these signals stop immediately.

Section 03

What is never collected

Your Discord messages

No content, no typing, nothing you send or read on Discord itself. What you post in Kizzey Chat is a different thing, and section 02b says so.

Tokens and passwords

Your Discord token stays on your device, never sent to the analytics server.

Account details

No email, no server list, no friends, no DMs.

Media and audio content

No song files, no audio, no screen or video, only a feature's on or off state. Voice calls are never recorded, and the server could not read them if they were.

IP, location and files

No IP address, no GPS, no files, no contacts.

The content of anything

Kizzey Learning counts that you did something, never what it was.

Kizzey talks to Discord for you, but your actual Discord usage is between you and Discord under their privacy policy. Kizzey never sees any of it.

Section 03b

Why each thing is allowed to be held

Under the UK GDPR and the EU GDPR, holding data needs a stated reason. Here is the reason for every category on this page, in one table, with no "and other purposes" clause hiding at the end.

What	Lawful basis	What that means here
The one time install ping install id, app version, device model	Legitimate interests	Counting installs once so the developer knows how many people have the app. Minimal, non identifying, and it happens exactly once. You can object.
The ongoing analytics ping device, settings, Discord identity, check ins	Consent	You agreed on first run and can withdraw it in one tap in Settings. Withdraw it and the app sends nothing at all.
Kizzey Learning reliability signals, feature counts	Consent	Separate, off by default, opt in only. Withdrawable on its own without turning off basic analytics.
Enhanced diagnostics Kizzey scoped debug snapshot	Consent	Off by default, behind its own switch in the Shizuku section.
Kizzey Chat and gallery your messages and profile	Contract	You asked to be in a community; showing your messages to that community is the service itself. Stop posting and nothing new is stored.
Moderation and reports	Legitimate interests	Keeping a shared room usable and dealing with abuse. Weighed against your interests, and erased when you ask.
Data requests the request, its decision, and an audit line per event	Legal obligation	Answering an access or erasure request means recording that it was made and what was done. This record is kept even when everything else about you is erased, and is not itself erasable. It holds your install id, the display name you had at the time, which request you made, what you wrote on it, the decision and the reason given, and what the erasure removed. It holds no messages, no device data and no IP address. Without it there would be no evidence that your request was honoured, which is the one thing that protects you as well as us.

No special category data, ever. Kizzey does not collect health, biometric, political, religious, sexual orientation or ethnicity data, and has no feature that would need it. There is also no automated decision making and no profiling that produces any effect on you.

Section 03c

How long it is kept

Plainly: what Kizzey holds is kept permanently until you ask for it to be deleted. There is no rolling purge and no quiet expiry, because a two year old install row is what makes "how many people still use the old version" answerable at all. What there is instead of a timer is a button: ask, and it goes.

What	Kept for	Removed when
Install row, settings snapshot, Discord identity	Indefinitely	You request deletion, or you turn analytics off (the row stops updating; ask to have it removed).
Kizzey Chat messages, reactions, read receipts	Indefinitely	You delete the message yourself, or you request deletion of everything.
Kizzey profile, shared presets	Indefinitely	You remove them, or you request deletion.
Kizzey Learning daily aggregates	Indefinitely	You request deletion. Switching Learning off stops new rows immediately.
Enhanced diagnostics snapshots	Indefinitely	You request deletion.
Data request records	Kept	Never, on purpose: it is the proof your request was honoured. It holds the install id, the kind of request and the outcome, and nothing else about you.
Right to be forgotten tombstone	Kept	Never, while the block stands. It is the install id and a flag: the minimum needed to keep the door closed, which is the thing you asked for.

A fresh install generates a brand new random id with no link to the old one, so reinstalling is itself a clean break for everything except a standing right to be forgotten block.

Section 03d

Your rights, as buttons

These rights exist whether or not an app makes them convenient. Kizzey makes them convenient: open Kizzey Profile, then Your data in the app. Each one opens a request that a person reads and answers. Nothing is erased automatically, because an erasure cannot be undone.

1
Open Kizzey Profile in the app and scroll to Your data.
2
Choose Request a copy of my data, Request message erasure, Request deletion, or Right to be forgotten.
3
It shows as Waiting until reviewed, then Approved or Declined, always with a written reason. An approved copy becomes a Download my data button for 10 minutes, with a countdown; after that, or once you have taken the copy, you ask again.

Access

A machine readable copy of every row held against your install id, table by table.

Message erasure

Every message you have sent in Kizzey Chat is deleted from the server, along with anything attached to them: pictures, audio, polls, the reactions on them and any of your messages that were pinned. Reactions you left on other people's messages go too. Your profile, KCoin, items and level are not touched and your chat stays open: this is taking back what you said, not leaving. Copies already downloaded to other people's phones are outside the server's reach and disappear as their apps refresh.

Erasure

Everything goes: profile, messages, presets, appreciations, donation records, diagnostics, install row. You can start again afterwards.

Right to be forgotten

Erasure and chat access closed permanently. The only thing kept is the random install id needed to enforce that. Reversible only by asking to be restored, and you would return to an empty profile.

Rectification

Everything Kizzey holds that describes you is editable by you in the app, right now, without asking anyone.

Withdraw consent and object

Analytics and Kizzey Learning each switch off independently, in one tap, immediately. Off means the app sends nothing at all, not even a flag saying it is off.

Portability

The export is JSON, not a screenshot, so you can take it somewhere else or keep it.

How long it takes. Kizzey is one person, so requests are answered by hand, normally within a few days and within one month at the outside, which is the statutory deadline. There is no charge. If a request is declined you are told why, in writing, in the app.

If you are unhappy with the answer. Email cryptdex@protonmail.com first and it will be looked at again. You also have the right to complain to a data protection authority: in the UK that is the Information Commissioner's Office, and in the EU it is the supervisory authority for the country you live in. Using the buttons above does not take that right away.

Section 04

Turning it off

1
Open Settings in Kizzey.
2
Flip Kizzey Analytics off to stop the ping entirely, or Kizzey Learning off to keep basic analytics but stop pattern collection.
3
Done. Your choice sticks and applies from the next launch.

Off means nothing. With analytics off, Kizzey sends no ping at all, not your settings, not your Discord ID, not even a "telemetry is off" flag. The server simply never hears from you.

Section 05

Where it goes

Every ping is sent over HTTPS to a small Cloudflare Worker the developer runs, which stores it in a Cloudflare D1 database. That is the whole pipeline. No ad networks, no analytics vendors, no data brokers. Everyone who touches any of it, in full, with no fourth entry:

Who	What they hold	Why	Where
Cloudflare Workers, D1, Durable Objects	Everything on this page: the analytics rows, your Kizzey profile, chat messages.	They host the code and the database. They do nothing else with it.	Global edge network
Discord	Kizzey Chat messages and any image you attach, relayed into a private channel; images are then served from Discord's CDN. Your presence, sent with your token, as the app's whole purpose.	Chat is relayed to a Discord channel so it can be moderated from one place, and images need somewhere to live.	Discord Inc.
Codeberg	Nothing about you. The app checks Codeberg for new releases, an ordinary web request; Codeberg's own server logs see it, as any host would.	Update checks and the download page. Also hosts this website.	Codeberg e.V., Germany

Data is processed on infrastructure that spans multiple countries, including outside the UK and EEA, because that is what a global edge network is. Cloudflare's own transfer safeguards apply; Kizzey adds no further transfer of its own.

Section 06

This website

The page you are reading is a static file. It is worth saying what it does not do, because "the app is private, the website is a tracking farm" is a common and reasonable suspicion.

No cookies, no analytics, no ads

No cookies are set. No Google Analytics, no Plausible, no Meta pixel, no ad network, no tag manager, no A/B tooling.

Third party requests

The icons on this page are inline SVG in the page source. The typefaces come from Google Fonts and the layout stylesheet from the Tailwind CDN, so those two hosts see the request that fetches them. Nothing else loads from anyone else, and no script here reports anything about you anywhere.

Hosted on Codeberg Pages

kizzeyrpc.xyz is served by Codeberg Pages, with DNS at Porkbun. Like any web host, Codeberg's servers see the request (your IP and user agent) in order to answer it. Kizzey neither receives nor stores that.

One thing is stored locally

Your light or dark choice, in your own browser's localStorage under kizzey-theme. It never leaves your browser.

The stats dashboard at the same domain is token gated and for the developer only. It shows the data described on this page; it is not public, and it sets no cookies either.

Section 07

How it is protected

Encrypted in transit

Every request is HTTPS end to end, terminated by Cloudflare. Nothing is sent in the clear, on any endpoint.

Encrypted at rest

The database is Cloudflare D1, which Cloudflare encrypts at rest. Uploaded images live in Discord's CDN, likewise on their storage.

Your token never leaves your device

Stored in Kizzey's app private storage, readable only by Kizzey, and sent to Discord and nowhere else. The analytics ping carries one bit saying whether you are signed in. See the source.

Who can reach the data

One person: the developer. No team, no contractors, no shared logins. Admin routes are gated by a single secret held as a Cloudflare Workers secret, never in the app and never in the public repository.

Identifiers are minimised

The key is a random install id made on your device, not an advertising id, not your hardware id, not your account. Where an id is shown to other members it is a non reversible hash of it.

If there is ever a breach

If data on this page is ever exposed, it will be posted on the Dev Wall in app and on this page within 72 hours of being discovered, naming what was affected. The relevant authority will be notified where the law requires it. This has not happened.

An honest limit. Kizzey is one person's open source project, not an audited service. There is no SOC 2 report and no penetration test, and this page will never pretend otherwise. What there is instead: a small surface, a minimal data set, published source anyone can read, and the ability to have everything erased on request.

Section 08

Do not take our word for it

Kizzey is open source, so every claim above is checkable rather than promised. Here are the exact lines that matter, quoted from the published source. If the code and this page ever disagree, the code is the truth and this page is the bug. Report it and it gets fixed.

Where the token goes KizzyAnalytics.kt

// Signed-in state independent of whether identity capture has finished: a valid-token
// install whose USER_DATA/USER_ID is still empty (heal pending) is logged in, not anon.
// Never sends the token itself, only this one bit.
put("logged_in", if (Prefs[Prefs.TOKEN, ""].isNotBlank()) 1 else 0)

The stored token is read in exactly four other places, all of them Discord's own connection: the gateway socket, the RPC client, the API repository, and the shared presence coordinator. Search the repository for Prefs.TOKEN and you will find every one of them.

What the ping actually contains KizzyAnalytics.kt

val payload = buildJsonObject {
    put("id", installId())                       // random, made on this device
    put("appVersion", versionName)
    put("versionCode", versionCode)
    put("android", Build.VERSION.SDK_INT)
    put("androidRelease", Build.VERSION.RELEASE ?: "?")
    put("manufacturer", Build.MANUFACTURER ?: "?")
    put("device", Build.MODEL ?: "?")
    put("locale", Locale.getDefault().toLanguageTag())
    put("uid", Prefs[Prefs.USER_ID, ""])         // Discord user id
    put("logged_in", ...)                        // the one bit, above
    put("username", user?.username ?: "")
    put("globalName", user?.globalName ?: "")
    put("avatar", user?.avatar ?: "")
    ...                                          // feature on/off flags follow
}

There is no IP field because the worker never reads one, and no message field because no message is ever passed to it.

What an erasure erases worker/src/index.js

const OWNED_TABLES = [
  ['chat_msgs','install_id'], ['chat_reactions','install_id'], ['chat_reads','install_id'],
  ['chat_presence','install_id'], ['chat_reports','install_id'],
  ['donations','install_id'], ['donation_charges','install_id'], ...
  ['preset_gallery','install_id'], ['sd_presets','install_id'], ['polls','install_id'],
  ['diagnostics','install_id'], ['daily_active','install_id'], ['learning_daily','install_id'],
  ['chat_profiles','install_id'], ['installs','id'],
];

One list, walked by both the export and the deletion, so a copy of your data and an erasure can never cover different things. Appreciations are keyed by the public hash rather than the id, so they are erased in both directions separately; the event and moderation logs, which carry a 12 character fragment of the id, are cleaned too. The deletion returns a per table count, stored on your request as the receipt.

Read it yourself

The analytics client is one file, KizzyAnalytics.kt, and every network call in the app goes through a named client you can grep for.

Every endpoint, named

The app talks to exactly three hosts: this developer's Cloudflare Worker, discord.com (your presence, with your token), and codeberg.org (update checks). Nothing else, on any screen.

Age

Kizzey needs a Discord account, and Discord's own terms set a minimum age of 13, or higher where local law requires it. Kizzey is not designed for or directed at children and does not knowingly hold data from anyone below that age. If you believe a child's data is held here, email cryptdex@protonmail.com and it will be erased without needing a formal request.

Changes to this policy

The date at the top is the last time this page changed. A change that widens what is collected, or changes why, is announced in the app as well, on the Dev Wall and in the changelog, rather than silently edited here. Anything genuinely new that needs your agreement asks for it in a dialog, off by default, exactly as Kizzey Learning did. Older versions are in the git history of the site's repository.

Every field named.Nothing buried.