Privacy Policy

Effective Date: June 24, 2026 · Last Updated: September 8, 2026

1. Information the Bot Can Access

Discord gives the bot a limited set of privileged data feeds ("intents"):

• Message content: text, attachments, and embeds, checked as they arrive to run channel rules, filters, and replies. Text is not stored except in the directed memory described below.
• Server, channel, and member status: where the bot may operate, the roles you hold, your join and leave events, and whether you are banned, so the appeals site can confirm a ban is genuine.
• Message authorship and reactions: each message's author, and who reacted with which emoji on which message. Only identifiers and content-shape flags reach the stored records, never the text.

2. How That Information Is Used

The bot uses that information to run its features:

• Enforce channel rules and posting limits: check each message, remove what breaks the rules, and tell the author why. A media link with no Discord preview may get a HEAD request for its file type, downloading nothing.
• Purge a member's attachment posts on an admin's command or when they leave, manage combo, verification, and interest roles, and answer admin commands and configuration panels.
• Send one-time messages such as a media overview or welcome, reply with a short quip when someone directs a message at the bot, and run Marshal's Lab when enabled: a temporary channel it replies in and deletes when the room closes.
• Carry out staff moderation and the optional filters an admin enables. Anti-spam works from short-lived in-memory shape signals, not text. Phishing tries local patterns first, then may send a bare URL to Google Web Risk. Message logging posts edited or deleted text to a staff log channel in Discord, not the bot's database.
• Run the optional social features: ask-to-DM requests, ban appeals, and support tickets, whose private threads keep uninvited members out.
• Accept anonymous questions: post the member's title and body as a bot-authored forum post, apply the #anonymous tag, and copy the member and full question to the configured message log.
• Authenticate web dashboard visitors, run its public and staff pages including the staff Activity page reports, and let a signed-in person browse or delete their own indexed attachment posts and read their own stats and warning record. Each person sees only their own figures.

The bot uses information only to provide, secure, maintain, and review these features. No advertising, unrelated profiling, sale, or rental of your data.

3. Information the Bot Stores

Saved data lives in MySQL on the bot host. Credentials, a cache, appeal images, and generated-picture bytes use local files. A test configuration may list Discord user IDs allowed to bypass the appeal ban check.

Server setup and housekeeping

• Configuration: whatever an admin sets up: channel and role settings for every optional feature, sticky text, filter switches, and webhook credentials.
• Housekeeping: small operational records for the bot's own work: job checkpoints, digest tallies, posting and lockout rows, index progress, and the references that keep staff mod-log undo buttons in sync. IDs, counts, or timestamps only, cleared once done or within 90 days.
• Anonymous-question cooldowns: your member ID, server, server-day, forum thread ID, and starter-message ID. The question text is not copied into the bot's database. The row is removed when the post is deleted or when the bot leaves the server.

Member tracking

• One-time delivery lists and last-active day: who already received the media overview DM or welcome, and each member's date of last message. No time, channel, or content. Deleted when you leave.
• Quip relationship stats: per member, light interaction counts and a few "mood" numbers that drift back to defaults, plus up to ten short impressions in Marshal's own words, never a quote of anything you said. Never message content, and each impression fades.
• Generated quip name: if your only visible name is your username, the bot stores a neutral stand-in chosen locally, without storing or sending the username. Retired when you set a safe name, deleted on departure.
• Quip conversation memory: a few recent messages you aimed at the bot by mention or reply, plus its replies. Nothing from general chat is ever stored. Purged within 48 hours or when you leave.
• Channel window: a short run of recent chat per channel, held in memory only, so the bot can read the room when someone speaks to it. It never reaches the database, ages out within half an hour, and clears on a restart or a departure.
• Marshal's own tastes: a short list of his own opinions. A heuristic tries to keep them about topics rather than members; it is not proof. Each fades.
• Emoji tallies: per member, how often each emoji appears in your messages. The emoji and a count only, no text and no post reference, shown only to you on your own page.
• Reaction records: who reacted with which emoji on which message, kept as IDs and a timestamp, never message content. Removed when the reaction or the message is deleted.

Message metadata and activity

• Message index: for every message, the server, channel, message, and author IDs, a timestamp, a few content-shape flags, and sanitized attachment names. No message text, URLs, attachment bytes, or embed bodies. A deleted message keeps a marked row with its names cleared, so all-time counts stay accurate.
• Activity reporting: one aggregate report per server after an index audit: totals, busiest channels, and a short top-poster list with names as they were then. Alongside it, per-day counts only, pruned after a year.

Moderation records

• Warnings: who, by whom, why, and when. One ages off per three clean months. A resolved warning is visible to that member without naming staff and deleted within two years.
• Temporary bans: who was banned, why, by whom, when it lifts, the single-use return invite code, and a random tracking ID for resuming the ban after a restart. Deleted once the ban has ended and the invite is cleaned up, or kept and retried later if Discord is unreachable.
• Temporary role grants: the member, role, and moderator involved, when the role is removed, and whether the member already held the role. Deleted at the scheduled removal.

Optional features

• DM requests: asker and recipient, outcome, and the shared private thread as the ongoing record. Accept and rejection counters are kept to flag possible harassment, after which staff monitoring begins.
• Support tickets: per-server configuration, and one record per ticket covering who opened it, what they submitted, and how it was settled, plus the participant list. Suggestions keep their text and vote post, which never names the submitter. The conversation itself stays on Discord.
• Ban appeals: your user ID, username, and display name, the appeal and reply text from both sides, any images you upload (stored on the bot host), and how staff decided it. Images are removed with the record.
• Generated picture archive: completed bytes, a bounded model-authored scene description, and local keywords, plus one short entry per drawing attempt with a provider reference and outcome, kept even when nothing is posted. No separate source-message or identity field, conversation payload, or provider detail is stored.
• Pending bot delivery: bot text or an exact archived-picture route, with routing, retry, and timing data. The text may name or paraphrase context. No prompt, source, description, or provider data is kept.
• Self-service media deletion: a receipt for each deletion you confirm, covering who, scope, status, and counts.

Web sign-in

Discord OAuth uses only the identify scope; access tokens are not retained. The browser gets a signed session cookie lasting about a day, plus a short-lived login cookie, both HttpOnly, SameSite=Lax, and Secure. A new sign-in invalidates older sessions, and logging out revokes every copy.

Presence and mirrored-guide names and avatars show only to signed-in, current, non-banned members. Everyone else sees @user or no identity. The year-long first-party mb_age_ok cookie records only an 18+ gate acknowledgment.

Marshal's Lab

The temporary room keeps member-free server settings, one room record, silence records, and user-free tallies. It gauges how busy a server is from an in-memory message-rate count with no content or IDs. Its recent chatter follows the Channel window limits above.

What it does not store

Apart from a sticky an admin creates, the bot does not keep general-chat text, attachment bytes, or embeds, beyond the narrow directed-memory and pending-delivery exceptions above. Beyond the records already listed it keeps no usernames or role rosters, no links it checked for scams, and no rolling posting-limit counts: a Web Risk lookup sends the URL alone, and the counts live in memory only.

4. How Long Information Is Retained

Most records last as long as the thing they describe: settings until changed, pending items until resolved. A server's data is deleted when the bot leaves that server, or on request. The exceptions:

• Web sessions: the browser cookie expires in about a day. The server-side session record has no automatic expiry and lasts until an operator review. Removing it signs that user out everywhere.
• Quip relationship stats, their impression notes, and a member's last-active day go when the member leaves or asks; notes also fade on their own before that. Emoji tallies and reaction records stay, since they are re-derived from messages still in the server, and go only when the bot itself leaves.
• Self-service deletion receipts are deleted 30 days after the job finishes. Support tickets stay with their archived Discord thread as the server's support history.
• Ban appeals are capped at 500 per server and remain, with their uploaded images, until an admin purges them via /mod config or asks us to delete that data.
• Generated pictures are capped at 16 MiB each and, per server, at 64 pictures and 256 MiB total. Least-recently-used pictures rotate out and the archive is deleted with that server.
• Pending bot delivery is capped at 64 text rows and 64 picture routes per server, and rows remain until delivery or until their captured destination becomes invalid. A row may replay after a restart, so a message can rarely arrive twice.
• Marshal's Lab: a silence never outlives the room, and the room record and its counters are pruned about a month after it closes. In-memory chatter ages out, is scrubbed on a member or server departure, and disappears with the channel.

5. Who We Share Information With

We do not sell, rent, or otherwise pass along what the bot observes or stores, with these exceptions:

• Discord, since the bot runs on its platform (see Discord's Privacy Policy).
• Google Web Risk, only when the phishing filter is enabled and configured: the checked URL, never message text, usernames, or user IDs (see Google's Privacy Policy).
• OpenAI, only when the host has enabled the optional AI quip feature. Described below.
• For a GIF or picture, only the bounded phrase the bot authored for the visual request goes to Klipy or OpenAI. It may reflect discussion words; no separate source message or raw Discord identity field is added. Completed pictures may be kept in the archive above and reused later.
• Google Fonts, when a visitor opens the optional web dashboard: the browser requests fonts from Google and may send ordinary request metadata such as an IP address, but no member content. These legal pages make no such request.
• When the law, legal process, or a valid government request requires it.

What goes to OpenAI

A directed message may include relationship stats, impression notes, and conversation memory. Bounded context may add media counts; attachment filenames, descriptions, content types, and dimensions; and bounded embed text. Raw media bytes, linked content, URLs, and pixel inspection stay out. A recognized public Tenor or Klipy GIF share may add one short label derived locally from its public naming. Its raw provider data and animation are neither sent nor fetched.

Safe display names and roles may be sent. MediaBot does not add usernames, raw Discord member IDs, or channel names as identity metadata. Missing safe names use stand-ins.

Each request carries a stable pseudonymous safety_identifier: a versioned, domain-separated SHA-256 digest computed locally and scoped to that member. Multi-member Lab scans use a room-scoped digest; content-free warming and diagnostics use a service-scoped digest. MediaBot never adds the underlying raw member or room ID as identity or safety metadata, though member-authored text sent as described above can contain arbitrary strings, including an ID somebody typed. The API credential does not participate in the digest and appears only as request authorization, and MediaBot does not log or persist this identifier.

Outside the Lab, only directed messages, a pointed-at post, addressed context, and a content-free live Lab snapshot leave the host. The snapshot carries phase, rough time remaining, and cumulative distinct-speaker and member-message totals. Responses use store: true, so application state is retained by OpenAI for at least 30 days under the effective organization policy and is visible to authorized organization users in Platform Logs. Drawn-image requests use it too, so the scene description and finished picture stay on OpenAI's side about as long. MediaBot does not copy prompts or member text into its local delivery queue; accepted bot text may enter it. OpenAI processes input under OpenAI's Privacy Policy.

Marshal's Lab, the one exception

Marshal's Lab is the one place chat reaches OpenAI without being addressed, inside its temporary channel. Directed Lab messages use the same context, and rare Lab-opening requests send bounded text, standing, and a pseudonymous safety identifier.

The bot scans recent room lines, each bounded in length. The in-memory window, including any recognized GIF label, expires within half an hour. Restart or departure clears it; the label is never persisted.

Speakers use safe display names or a room-local stand-in such as "Member B". Any other user mention becomes someone; channel and role mentions stay generic. Each speaker also carries the pronouns their roles state, or a neutral default. The answered member carries safe name or stand-in, roles, relationship stats and mood numbers, impressions, recent directed messages, and coarse tenure.

Overheard lines do not move moods. Lab room chatter is never stored in MediaBot's directed conversation memory; neither are GIF labels, though a label may shape a bounded model-authored visual phrase.

Inside the Lab the bot may delete a message or temporarily revoke Send Messages there. Neither creates a warning, strike, or moderation record. Lab messages stay indexed and still count toward the all-time totals on the staff Activity page.

6. How We Protect Information

We take reasonable steps to protect what the bot stores. No system is perfectly secure, so we cannot promise absolute safety.

7. Adults Only

MediaBot is built for 18+ (NSFW) Discord servers, and you must be at least 18 to use it. We do not knowingly collect personal information from anyone under 18. If we learn that someone under 18 has used the bot, an operator reviews the user-linked records described here and deletes or de-identifies them where reasonably possible, keeping only a limited moderation, appeal, security, or legal record while it is still needed.

8. Your Choices

• Remove the bot, or turn a feature off. An admin can do either any time, taking the stored setup with it, or ask us to delete that server's configuration and related records.
• Interest roles are ordinary Discord roles you can change or clear in the picker at any time. One nobody holds is deleted shortly after.
• Your attachment posts. Anyone with a valid Discord sign-in can open /me, including former members, non-members, and banned users, browse their indexed attachment posts, and delete one post, one channel's worth, or all of them after a fresh sign-in. A live preview is fetched from Discord at that moment, never downloaded or stored.
• Ticket threads are excluded from that self-service deletion and from the bot's mass cleanup, because they can hold evidence for open investigations.
• Everything else. That is the only user-initiated data control the bot offers. It does not provide data export, correction, or complete account erasure, and other records expire on the schedules above. Your account, profile, and message history belong to your Discord account and are managed through Discord itself.

Questions about this Policy, or about these tools, can go to a current server Administrator on Discord.

9. Changes to This Policy

We may update this policy and will revise the "Last Updated" date at the top when we do. Continuing to use the bot after a change means you accept the updated policy.