Privacy policy

Last changed 6 September 2026.

What is stored

Server configuration you set through /setup and the commands: channel and role IDs, thresholds, toggles, and the text you type into a setting — a welcome message, a command prefix, a list of blocked words, the phrase that triggers a scheduled channel wipe, the user IDs you exempt from a filter. Moderation records: the case number, who acted, who it was against, the reason you typed, and when. Where a feature needs it, the IDs of messages or channels it created so it can manage them later.

Configuration text is stored as you wrote it, deliberately: your moderators have to be able to read back what the server is set to do. It is not somebody's private words about themselves — it is the rules of your server, written by whoever runs it.

What is never stored

Message content. Nothing retains what people say in your channels. Ticket transcripts are the single exception, they are off by default, and turning them on is a deliberate choice with its own warning. Text somebody deliberately submits to the bot — a ban appeal, an application, the form when a ticket is opened — is kept, because a review that cannot be read is not a review; it is encrypted, and the section below says exactly which fields.

IP addresses. Where the bot must recognise an address it has seen before, it stores a keyed hash of it and never the address. The question it asks is only "have I seen this before", which an equality test answers. A stolen database contains no addresses at all, and the digests are useless without a key that is not in it.

Anything given to a third party. Verification draws its own CAPTCHA in process. There is no captcha provider, no analytics, no CDN and no font service — this page loads nothing from any other origin, which is enforced by its Content-Security-Policy rather than promised.

Encryption

Free text people write in confidence is encrypted with AES-256-GCM before it is stored, and decrypted only as it is shown to the staff it was written for. That is three things: ban appeals, staff application answers, and the answers given when opening a ticket. The key is derived from a secret that exists only in the bot's own environment — the website runs as a separate service that does not have it and could not use it — so a copy of the database on its own yields ciphertext.

What is not encrypted, said plainly: the question a staff member wrote beside each answer, moderator-typed reasons on a moderation record, and your server's settings. None of those are somebody's private words about themselves, and encrypting them would cost your moderators the ability to search their own records.

Deletion

Remove the bot from your server and its configuration and records for that server are deleted. A server owner or administrator can also request deletion at any time; ask in the support server and it happens on request, not on a schedule.

Who can see what

Configuration is visible to people who can already run /setup — by default that means Manage Server. Moderation records are visible to your moderators. Nobody operating the bot reads your server's data as a matter of course, and there is no interface that would make it convenient to.