Privacy Policy

The Service stores only what it needs to protect and restore your server:

• Server configuration — server ID, command prefix, embed color, module on/off state, trigger limits and windows, punishments, log-channel IDs.
• Trust lists — Discord user IDs that server staff add as whitelisted users or extra owners.
• Backup snapshots — the structure of your server: channel/category names and permission layouts, role names/colors/permissions, emoji and sticker names with their image URLs, and core server settings. Snapshots are used only to restore your server.
• Security logs — records of trigger trips and the actions taken (who did what, when), so staff can audit incidents.
• Transient anti-spam state — short-lived counters (e.g. recent joins or messages within a trigger window) held in memory and discarded within minutes.

• No message content archives — the bot is not a chat logger and backups do not contain your conversations.
• No passwords — authentication is handled entirely by Discord OAuth2; we never see your credentials.
• No payment data — the Service is free and collects none.
• No selling or sharing of data with advertisers or data brokers. Ever.

The dashboard uses Discord OAuth2 with the minimal scopes 'identify' and 'guilds'. This lets us show who you are (username, avatar) and which servers you manage, so you only ever see settings for servers where you hold Manage Server permission.

• Your session is stored in a signed cookie on your own browser (JWT). We do not keep a server-side copy of your Discord access token beyond the session.
• The dashboard reads and writes the same database records as the bot's own commands — signing in creates no additional profile about you.

• Backups rotate automatically — only the latest 3 automatic and 2 manual snapshots per server are kept; older ones are deleted permanently.
• Configuration is kept while the bot is in your server so protection keeps working across restarts.
• If the bot is removed from a server, its stored configuration becomes inert and is eligible for cleanup.

You can request deletion of your server's stored data (configuration, snapshots, logs) or of your user ID from trust lists at any time.

• Ask in the support server — a maintainer will verify you control the server in question and purge its records.
• Server owners can also simply remove the bot; per-server protection data stops being used immediately.

Data lives in an access-controlled MongoDB instance reachable only by the bot and the dashboard backend. Dashboard traffic is encrypted in transit (HTTPS), and settings changes require a Discord login that proves you manage the server. Retention of backups is fixed inside the engine so that an attacker who gains dashboard access cannot quietly disable your safety net.

The Service is not directed at children under 13 (or the higher minimum age Discord requires in your country) and we do not knowingly collect data from them. If you believe a child's data has been stored, contact us for removal.

If this policy changes materially, we will announce it in the support server and update the date at the top of this page. Continued use of the Service after a change means you accept the updated policy.