Privacy policy · Updated October 31, 2026
Your privacy on mcord, explained clearly
This policy explains what data mcord handles when you create an account, join a community, send messages, upload files, use voice or video, enable notifications, or secure your account. mcord uses that data to operate and protect the service; it does not currently sell personal data or use it for targeted advertising.
What data mcord handles
Account and profile data can include your email address, nickname, display name, public tag, avatar, banner, bio, status, privacy choices, and activity-sharing choices. Passwords are stored as Argon2id hashes rather than readable passwords. If you enable two-factor authentication, its secret is encrypted and recovery codes are stored as one-way hashes.
Community data includes guild membership, roles, permissions, friendships, blocks, messages, DMs, reactions, mentions, read state, notification choices, call events, files, and other content you choose to provide. Other members see content according to the guild, channel, DM, and privacy settings you use.
Technical and security data can include IP address, user agent, operating system, browser, device type, timezone, an approximate location derived from network headers or timezone—not precise GPS—session history, QR-login events, security audit records, and an encrypted web-push subscription when notifications are enabled.
- Microphone, camera, screen-share, proximity, Bluetooth, and notification access are requested only when the related feature needs them and remain subject to device or browser permission controls.
- Voice, video, and screen-share media is transmitted through mcord-operated realtime infrastructure so the people in the session can receive it.
- The current core release does not provide built-in voice-call recording or transcription.
Why data is used and who may receive it
mcord uses data to create and authenticate accounts, deliver messages and realtime calls, maintain sessions across devices, show presence and activity when enabled, route notifications, prevent abuse, investigate security events, enforce guild controls, moderate the service, and improve reliability.
Data is shared with the members and guild administrators you interact with, according to the product's visibility and permission model. It may also be processed by infrastructure providers that host or deliver mcord services. Voice regions use mcord-managed LiveKit infrastructure. If you enable web push, the encrypted notification payload and delivery metadata pass through the push service selected by your browser or operating system.
A bot or integration installed in a guild may receive messages, member details, events, or files allowed by its permissions and intents. Third-party bot developers are responsible for their own privacy practices, so review their policy before authorizing one. mcord may also disclose limited data when required by law or when necessary to protect users, the service, or others from harm.
- mcord does not currently sell personal data.
- mcord does not currently run a third-party targeted-advertising system.
- Public profile and community content should be treated as visible to the audience you select.
Retention, your controls, and how to contact us
Account, profile, guild, message, and uploaded content is generally kept while it is needed to provide the service or until it is changed, deleted, removed by moderation, or no longer operationally necessary. The current default session lifetime is up to 30 days. Desktop QR challenges expire after two minutes and stale challenge records are removed after a limited cleanup period. Push subscriptions are tied to sessions and stale endpoints are removed.
Some security records, audit history, backups, deleted-message markers, and transaction metadata may remain longer when needed for integrity, abuse prevention, recovery, dispute handling, or legal obligations. Retention can vary by record and may change as the service evolves; mcord does not promise that every copy disappears immediately from every system when an item is removed from the interface.
Settings → Account provides Disable account and Delete account. Both require your current password and an authenticator or recovery code when 2FA is enabled, and sign you out on every device. Disabling is reversible and does not automatically delete your account. Deletion has a 30-day recovery window: sign in, complete verification, and explicitly choose to restore before the deadline. After the deadline restoration is unavailable and automatic cleanup erases live-service profile data, credentials, contacts, private settings, badges, and owned support tickets. Shared messages and attachments remain attributed to Deleted User; remove individual messages beforehand if you do not want them retained. Minimal moderation records and non-identifying account markers may remain to preserve safety and conversation integrity. Cleanup can be delayed by outages; backup copies are not erased immediately and follow the server operator’s backup retention policy. Transfer or delete owned servers and delete owned active bot applications before account deletion. For other access, correction, deletion, or privacy requests, contact admin@mcord.ir.
- Contact: admin@mcord.ir
- This policy applies to the mcord website, Windows client, Android app, and PWA.
- mcord is not intentionally directed to children who cannot lawfully consent under the rules that apply to them; a parent or guardian can contact us about a concern.
- Material policy changes will be published on this page with a new update date.
FAQ
Questions and direct answers
Does mcord sell personal data or use it for targeted ads?
No. mcord does not currently sell personal data or operate a third-party targeted-advertising system.
Does mcord record voice or video calls?
The current core release does not provide built-in call recording or transcription. Live media is transmitted through mcord-operated realtime infrastructure to session participants. A participant's local tools or an independently authorized integration may operate separately from mcord's core feature.
Does mcord collect precise GPS location?
The current account-session system does not request precise GPS for sign-in. It may store an approximate country or city supplied by network infrastructure and the timezone provided by the client.
What can an installed bot access?
A bot can receive only the data and events exposed by its granted guild permissions and intents, but the bot developer controls what happens after that data reaches the bot. Review the bot's own privacy policy before authorizing it.
How do I delete my mcord account or request my data?
Open Settings → Account → Delete account and complete the password and, if enabled, 2FA check. You have 30 days to sign in and explicitly cancel deletion. After that, restoration is unavailable and live-service account cleanup runs automatically. Shared conversation messages and attachments remain under Deleted User. For other data requests, contact admin@mcord.ir.
Where can I contact mcord about privacy?
Email admin@mcord.ir with your question or request.
MCORD · STAY CLOSE