Security & trust

Everything a server owner might want to check before adding Ipo's Tournament Bot, in one place.

Who runs it

Ipo's Tournament Bot is an independent project run by iposbots in the UK. It isn't affiliated with Ubisoft or Discord. Questions or problems: iposbots@proton.me.

What the bot can do in your server

The bot only needs the permissions below, and this is what each one is for. It never needs to kick or ban members, change your server settings, or use webhooks.

Right now the invite still asks for Administrator while we finish moving the bot over to just this list. This note goes away once that switch is made.

PermissionUsed for
View ChannelsSeeing the sign-up, match, draft and leaderboard channels it runs.
Send MessagesSign-up posts, brackets, match info, map votes and announcements.
Embed LinksEvery sign-up, bracket and leaderboard post is an embed.
Read Message HistoryFinding its own earlier posts again so it can update them.
Manage ChannelsCreating and removing private match channels, draft channels and #leaderboard.
Manage RolesGiving players the verified role, and letting a sub into a match channel.
Manage NicknamesAdding the "Name [UbiName]" tag to players who add their Ubisoft name.
Create InviteThe invite link on your public tournament listing.
Mention @everyonePinging the server when a tournament has a winner.
ConnectLetting draft teams into their voice channels.
Pin MessagesPinning the match info in each match channel.

The bot's role needs to sit above the verified role in your server's role list, so it can hand that role out. Discord never lets any bot rename the server owner.

Ubisoft accounts

The bot never asks for, sees or stores a Ubisoft password or login. Players just type their Ubisoft name. The bot checks that nobody else in the same server is already using that name, then adds it to the player's nickname. It doesn't prove the account belongs to them, so organizers should still use their judgement for big tournaments.

Your data

The bot keeps only what it needs to run tournaments: Ubisoft names, sign-ups, results, leaderboard wins, bans and your server's settings. Finished tournaments are deleted automatically, and if the bot is removed from a server, that server's data is deleted 30 days later. Players can wipe their own data at any time with /delete-data, in one server or all of them. Nothing is sold or used for ads.

Full details: the bot's /privacy command, and this site's Privacy Policy.

If the bot goes down mid-tournament

Every sign-up, bracket, result, vote and draft is saved the moment it happens, so after a restart the bot picks up where it left off, including match channels and their buttons. In the rare case a round gets stuck, the host can finish it from the website. You can always see whether the bot is up, and its uptime over the last 90 days, on the status page.

This website

You log in with Discord, so we never see your Discord password. Payments go through Stripe's own checkout, so we never see your card. The site's admin login needs a password plus a one-time code sent by email for every sensitive action, and it logs out on its own.

Found a problem?

If you think you've found a security issue in the bot or this site, email iposbots@proton.me and please don't share it publicly until it's fixed. We'll reply as soon as we can.