Rytmo Link privacy notice

Updated: 29 October 2026. This notice describes the Rytmo Link companion extension and its credential handoff with the Rytmo dashboard. Publisher contact: xcpxmp@gmail.com.

Purpose and information handled

Rytmo Link opens a Discord account and selected channel at the request of a signed-in Rytmo workspace owner. It handles the saved Discord authentication token, Discord account identifier, selected server/channel identifiers, a short-lived request nonce and expiry, and the initiating dashboard tab identity. Discord's identity endpoint can return additional profile fields; the extension uses the account ID to check that the correct account was selected and does not persist the returned profile.

How the handoff works

The extension creates a temporary cryptographic key in memory. The Rytmo dashboard sends the extension's public key to the Rytmo server through the owner's authenticated session. The server checks ownership and encrypts the credential handoff. The extension decrypts it locally, sends the token to Discord to check account identity, writes the token entry in Discord's local storage, and opens the requested channel. Discord necessarily receives the credential and selected channel request. Requests to Rytmo and Discord use HTTPS.

The extension communicates only with the Rytmo dashboard at rytmo.duckdns.org and Discord at discord.com for this feature. Those services also process ordinary connection metadata such as IP address and request timing. Installing through the Chrome Web Store also involves Google's store and browser services under their own terms and policies.

Storage and activity records

The extension does not save tokens to extension storage, URLs, clipboard or logs. Keys and decrypted handoff values are held temporarily in memory; JavaScript cannot guarantee immediate erasure of every memory copy. A handoff expires after one minute and can be consumed once. The token placed in Discord's browser storage can remain available as part of the Discord session until it is cleared or the session is otherwise invalidated. Other Discord tabs in the same browser profile share that session.

Rytmo already stores the account credential encrypted in its server-side vault. Requesting a browser handoff records an activity event with the owner/account/server references and timestamp, without the plaintext token. Removing a token from Rytmo removes the active saved credential and pauses its worker; historical backups may still contain the prior encrypted credential. This extension does not change the dashboard's existing backup retention.

Access and controls

Browser handoffs require the workspace owner to sign in directly; administrator impersonation cannot request them. The dashboard's administrators retain their existing management access and ability to review dashboard activity records. The extension does not scan messages or general browsing history and contains no advertising or analytics code.

Users can remove the extension through the browser's extension manager. Removing the extension does not sign out an existing Discord browser session or remove credentials already saved in Rytmo. To stop future handoffs, remove the saved token in Rytmo. Manage the Discord session separately through Discord or the browser's site-data controls.

Contact

Contact the Rytmo Link publisher at xcpxmp@gmail.com for support, privacy questions or a request about data held by Rytmo. Do not include a Discord token, password or session cookie in your email.