Privacy Policy

1. Who we are

MoonBot is an independent Discord bot run by its developer. It is not affiliated with Discord Inc. We are responsible for the data described here. The staff of each server decides which MoonBot modules are enabled on that server.

2. What we collect

• Discord account: your user ID, username, display name and avatar, and your roles and join date in servers that use MoonBot, as provided by Discord.
• Web verification: when a server asks you to verify on our website and you authorize MoonBot (Discord scopes identify and guilds, plus guilds.join only on servers we allowed to use member backup): the list of your servers (ID, name and icon, up to 50), your Discord access and refresh tokens, your IP address and up to 20 previous ones, your account age, whether a VPN or proxy was detected, and a hash of browser and device signals used to detect bots and alternate accounts.
• Dashboard: when you log in: your login IP address and browser user agent, your session, and, if you turn them on, your two-factor authentication secret, hashed backup codes and a hashed password.
• Messages: message content is read in memory to apply the rules a server configured (automod, anti-spam, scam links, commands, autoresponders). MoonBot keeps it only in these cases: edited and deleted messages are posted to the server's own staff log channel when that server enabled logging; modmail messages are relayed to the server's staff; when a server's staff creates a server backup with messages included, the last 100 messages of each text channel (author, text, attachment links) are saved so the server can be rebuilt after an attack. In memory only, never on disk: the snipe command keeps deleted or edited messages for 5 minutes (10 at most), and the mentions log keeps the first 200 characters of messages that mention you, 24 hours by default, so you can see who pinged you.
• Server features: only for modules a server enables: moderation history (warnings, cases, strikes, ban appeals and their text), levels and XP, economy balances, birthdays you enter, tickets, giveaway entries, and activity statistics stored as counts (number and type of messages, emoji use), never as message text.
• Technical logs: error reports, which can contain Discord IDs.

We do not request your email address and we never record voice or audio.

3. How we use it

• To run the features a server enabled: moderation, logs, verification, welcome messages, levels and the rest.
• To protect servers: detect raids, bots, scam links, VPNs and alternate accounts of banned members.
• To add you back to a server you verified on, with your guilds.join token, only on servers we allowed to use member backup, and only when that server's staff restores its members after a raid or a server restore. Member backup is off on every other server: nothing is saved for it.
• To secure your dashboard account and tell a server's staff who logged in, when that server turned on login alerts.
• We never use your data for advertising or profiling, and never to train AI models.

Legal basis (GDPR): providing the service you or your server asked for, and our legitimate interest in keeping servers safe.

4. Who receives it

• Discord: MoonBot runs on Discord and exchanges data with it to work.
• The staff of your servers: the staff of a server can see that server's logs, moderation history and verification results, including VPN or alternate-account flags. When a server turns on dashboard login logs, your login IP address and browser are posted to its staff log channel.
• IP reputation services: when a server turns on VPN and proxy detection, only your IP address is sent to proxycheck.io (over HTTPS), to ip-api.com as a fallback (its free tier uses unencrypted HTTP), or to vpnapi.io when the server provides its own key.
• Other services: music searches are sent to YouTube. Lists of Tor exit nodes and phishing domains are downloaded without sending any of your data.
• Authorities: only when the law requires it.

Nobody else: no data broker, no advertiser.

5. Storage and security

Data is stored on our own server, encrypted at rest (AES-256-GCM), and the website is only served over HTTPS. Passwords and backup codes are hashed, dashboard sessions are protected against cross-site requests, and only the bot's operator can access the server.

6. How long we keep it

• Dashboard sessions: 30 days without activity, 90 days at most.
• Snipe: 5 minutes (10 at most), in memory only.
• Error logs: 30 days. Activity statistics: 90 days by default, adjustable by each server.
• Verification and security records (IP addresses, device hash, Discord tokens): kept while they protect the servers you verified on, until you ask for deletion. Removing MoonBot from Discord's Authorized Apps makes the tokens unusable at once.
• Server settings: deleted when the bot leaves a server. A copy is kept so the owner can restore them by inviting the bot again, and is deleted on request. Other module data (moderation history, levels…) is kept until the server owner or you ask for deletion.
• Data requests: kept to handle them and to show they were handled. A copy of your data attached to a request is removed when the request is closed.
• Server backups, including the messages they contain: the 10 most recent per server, the oldest replaced automatically. They stay after the bot leaves so the server can still be rebuilt, and are deleted at the owner's request.

7. Your rights

You can ask to access, correct or delete the data MoonBot holds about you. On request we delete your verification data, IP history, device hashes, Discord tokens and dashboard account. Messages already posted in a server's own Discord channels belong to that server; we do not control them. You can also delete it yourself, at once, from the User Center of the dashboard; if a server holds a ban on your account, your security records (IP history, device hashes, e-mail) are kept until a person reviews the request this files.

To make a request, use the form below. You sign in with Discord so we know the request comes from you. We answer on this page within one month, and a Discord DM tells you when the answer is there.

If you live in the EU, you can also lodge a complaint with your data protection authority (in France, the CNIL).

8. Children

MoonBot is meant for people who meet Discord's minimum age (13 in most countries). We do not knowingly collect data from younger children; contact us and we will delete it.

9. Changes

When this policy changes we update this page and its date, and we announce important changes on our support server.

10. Contact

Questions or requests about your data: use the form in section 7. If you cannot sign in with Discord, write to dsmoonbot@proton.me