Privacy Policy

What data is processed?

• Discord account data: when you log in via Discord OAuth2 (with the scope "identify guilds"), Discord provides us with your Discord user ID, username, avatar hash, an access token, and the list of servers you are a member of, so we can show you which servers you can manage. This data is stored exclusively in a signed, httpOnly session cookie in your browser (cookie name "dashboard_session", valid for 7 days) - it is never written to our database.
• Server/message data: for features like AutoMod, logging, tickets, or leveling, the bot processes message content, channel and role IDs, and member lists of the servers it is active on - exclusively to provide that feature (e.g. spam detection, XP calculation, ticket management). This data is stored in a self-hosted PostgreSQL database (see "Hosting" below), never with a third-party database provider.
• Voluntary information: some features (e.g. birthdays, the marriage system, the economy system) store data that users enter themselves via commands.
• Usage statistics: anonymized counters for command usage and server activity, used to improve the bot.
• Music searches: normalized search terms and their verified public YouTube results (title, artist, duration, video ID, and page URL) are stored as a shared search cache. No Discord user ID, server ID, channel ID, IP address, or other information identifying the person searching is stored.
• Anonymous compliments: Content, recipient, status, and reports are stored per server. The sender ID is hidden from the public and recipient but may be viewed by authorized moderators to investigate abuse. The sender link is automatically anonymized after the server-defined period (90 days by default).

What is the data used for?

Exclusively to provide the bot features and the dashboard. Data is never shared with third parties or sold.

Retention & deletion

Data is stored for as long as the bot is active on the respective server, or as long as it is needed for the feature. Music search terms and cached results are retained for 30 days from the most recent matching search and then deleted automatically; repeating the same search starts this period again. Server admins can request deletion of all stored data for their server at any time, either by removing the bot or by contacting us (see below).

Cookies

The dashboard uses exactly three cookies, all strictly necessary for it to function. No advertising or analytics cookies are set, and no local storage is used for tracking.

• "dashboard_session" - keeps you logged in; contains your signed session data (see above); valid for 7 days.
• "dashboard_locale" - remembers your chosen dashboard language (German/English); valid for 1 year.
• "oauth_state" - a short-lived value used only during the Discord login process to protect against cross-site request forgery (CSRF); deleted immediately after login.

Hosting

The bot, dashboard, and database run on our own hardware at a private residence in Germany - not with a commercial cloud provider. To make the dashboard reachable over the public internet without exposing our home network directly, traffic is routed through Cloudflare (Cloudflare, Inc. / Cloudflare Germany GmbH) via Cloudflare Tunnel, which also terminates the HTTPS connection. Cloudflare therefore has technical access to encrypted traffic metadata (e.g. IP addresses) as an order processor under Art. 28 GDPR, covered by Cloudflare's standard Data Processing Addendum. The domain itself is registered with Spaceship, which only handles domain registration and has no access to user data.