Privacy Policy

Last updated: July 23, 2026

The short version. GorillaOS signs you in with Discord and takes payments through Stripe. We keep only what we need to run your account, your tier, and your license — your Discord profile, your subscription status, and a one-way device fingerprint that stops paid mods from being shared. We don't sell your data, we don't run ad trackers, and any AI/API keys you type into the app stay encrypted on your own PC. You must be 13 or older to use GorillaOS.

This policy explains what GorillaOS ("we", "us", "the operator") collects when you use the GorillaOS website, launcher, and mods (together, the "Service"), how we use it, and the choices you have. GorillaOS is an independent project and is not affiliated with, endorsed by, or sponsored by Another Axiom, Inc. or Gorilla Tag.

1. Information we collect

When you sign in with Discord

We use Discord OAuth. With your permission, Discord shares:

Your Discord user ID, username, display name, and avatar;
Your Discord email address;
Permission to add you to the GorillaOS Discord server (the guilds.join scope) and to read the roles you hold there, which is how your tier is determined.

When you subscribe or buy a gift

Payments are processed by Stripe. We never see or store your full card number. Stripe handles that. We store your Stripe customer ID, subscription/checkout IDs, plan, status, and renewal date so we can keep your tier active and show it on your dashboard.

When you install and run the mods

Device identifier (HWID): a one-way hash derived from your machine so a paid license can be tied to your PC and not shared. It cannot be reversed into anything about your computer.
Presence & usage: that you are online/using the Service, your current tier, and basic launcher activity, so we can show live counts and keep your session valid.
Stats you choose to submit: if you opt into features like Ranked, an aggregate of your in-game competitive stats (linked to your Discord ID) is stored to power leaderboards.

Automatically

Standard technical data: IP address, browser/user-agent, and server logs, used for security, abuse prevention, and keeping the Service running.

API keys and microphone audio

This depends on which feature you're using, so here is the split in full.

Keys you enter in the mod itself are encrypted and stored locally on your PC, tied to that machine. They are not uploaded to us, and they are used to call the AI provider directly from your PC.
Keys you save in Verity or gtag-assistant are different: those features run through our server, so we do receive the key and store it, encrypted, against your account. We use it only to make the calls you asked for, we never show it back to you or to anyone else, and you can clear it at any time from the app, which deletes it.
Microphone audio: when the mod talks to an AI provider directly, the audio does not pass through us. When you use Verity's or gtag-assistant's voice features, the recording is sent to our server, forwarded to the speech provider to be turned into text, and not kept afterwards.

If you would rather we never held a key at all, use your own key in the mod's own settings rather than in Verity or gtag-assistant.

2. How we use your information

Provide and operate the Service and your account;
Determine and apply your tier, assign Discord roles, and unlock features;
Process payments, renewals, and gift codes;
Enforce licensing and prevent sharing, piracy, fraud, and abuse;
Power opt-in features such as leaderboards and live player counts;
Provide support and respond to your requests;
Comply with legal obligations.

3. Legal bases (EEA/UK users)

Where the GDPR applies, we process your data to perform our contract with you (running your account and subscription), for our legitimate interests (security, anti-piracy, improving the Service), to meet legal obligations, and with your consent where required (e.g. optional features). You may withdraw consent at any time.

4. How we share information

We do not sell your personal information. We share it only with service providers who help us run GorillaOS, and only as needed:

Provider	Purpose
Discord	Sign-in, identity, roles, community server
Stripe	Payment processing & subscriptions
Hosting provider (backend)	Running the servers and database
AI / voice providers you choose	Only if you enable those features, and configured with your own keys

We may also disclose information if required by law, to protect our rights, or in connection with a business transfer.

5. Cookies

We do not use advertising, profiling or cross-site tracking cookies, and there are no third-party analytics on this site. Everything we set is first-party and used only to run it:

Session cookie — keeps you signed in. Expires after 14 days.
Sign-in state cookie — a short-lived value used during Discord sign-in to check the request came from you. Deleted as soon as sign-in finishes.
Launcher handover cookie — only set when you sign in from the desktop launcher, so we can hand the result back to it. Deleted immediately after.
Visitor count cookie — a random id with no personal data in it, so the "online now" number does not count the same browser twice. Expires after 30 days.

The first three are essential to the Service and do not require consent. The visitor-count cookie is used only for that live count, is not shared with anyone, and is not used to build a profile of you. You can clear any of them in your browser at any time; clearing the session cookie signs you out.

6. Data retention

We keep account and subscription data for as long as your account is active and as needed to provide the Service, resolve disputes, and meet legal/accounting obligations. Presence data is transient and continuously overwritten. When you ask us to delete your account, we remove your personal data except where we must keep limited records (e.g. payment records) by law.

7. Your rights & choices

Depending on where you live, you may have the right to access, correct, delete, export, or object to our use of your personal data, and to withdraw consent. California residents have the right to know, delete, and to opt out of "sale" of personal information — we do not sell personal information. To exercise any right, contact us (below) from the email tied to your Discord account or via our Discord. We will not discriminate against you for exercising these rights.

8. Children's privacy

GorillaOS is not intended for children under 13. You must be at least 13 years old (and old enough under Discord's own terms) to create an account, and at least 18 (or have verifiable permission from a parent or guardian) to make a purchase. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us and we will delete it promptly.

9. Security

We protect data in transit with HTTPS, encrypt locally-stored keys, bind licenses to a device fingerprint, and serve paid mod files only to authorized accounts. No method of transmission or storage is 100% secure, but we work to protect your information and limit what we collect in the first place.

10. International users

GorillaOS is operated from, and its servers are located in, the United States. If you use the Service from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data-protection laws than your country.

11. Changes to this policy

We may update this policy from time to time. When we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you through the Service or Discord.

12. Contact us

Questions or requests about your privacy: email gorillaossupport@gmail.com or reach us in the GorillaOS Discord.