Privacy Policy
This policy explains what personal data the Prismara Discord bot and this website process, why, and what your choices are. We keep it short on purpose: the bot is built to store as little as possible.
1. Who is responsible
Prismara is run by its operator, who can be reached by email at glaceevee@proton.me or in our support server on Discord. For the moderation records a server keeps with Prismara (cases, notes, flags), the people who manage that server decide how they are used, and the operator provides the tool and stores the data on their behalf.
2. What we process
Messages (not stored)
To moderate, the bot receives the messages posted in channels it can see (this needs Discord’s Message Content intent). Message text is checked in memory by the filters and by the AI model and is not written to the bot’s database. Two things are worth knowing:
- To show “before” text in the edit and delete log, the bot keeps the latest 200 messages per channel in memory only. They disappear when the bot restarts or when newer messages replace them.
- When a server turns on a log channel, the bot posts content into it (for example the text of a flagged, edited or deleted message). That text is then stored by Discord inside that server, under the server’s own access rules, and not by us.
Data stored in the bot’s database
- Server settings: IDs of servers, channels and roles, switches and limits, blocked words and regex patterns, the text of the server’s rules channel, and a history of who changed which setting.
- Moderation records: the Discord user ID of the member and of the moderator, the time, the channel ID, the reason and the action (warn, mute, kick, ban, flag, purge and so on) as case entries and automatic flags. Flags store the reason and a confidence label, not the message itself.
- Moderator notes: text that a moderator typed about a member, with the author’s ID.
- Applications (only in servers that create application forms): the answers a member typed into an application form, the form’s name, the member’s ID, the time and the moderator’s decision with the reason they typed. The questions are chosen by the server’s administrators, so a form could ask for personal details: members should only share what they are comfortable with.
- Short-term records: pending timed unbans, members who have not yet completed verification, and the IDs of the settings panels the bot has posted.
- Anti-alt network fingerprints (only in servers that turn on “Anti-alt”): see the next section.
Apart from that, the bot does not store names, avatars, email addresses, IP addresses, or message text. It reads some public Discord profile data (such as username, account creation date, join date, roles and avatar) when it needs to, for example for the lookup tool, join screening or a log entry, and shows it to the moderators who asked.
Anti-alt verification (optional, per server)
A server’s administrators can switch on “Anti-alt” to catch ban evasion and alternate accounts. Members then finish verification on this website: they log in with Discord (only the identify permission: your user ID and username, no email address, no server list, no messages) and the website looks at the network address your browser connects from.
- The IP address itself is not stored. It is turned into a keyed hash (for IPv6, of the /64 network). The key is kept outside the database. The hash is different for every server, cannot be read back into an address, and is only used to tell whether another account of the same server verified from the same network. Hashes are stored with your user ID and the dates you were seen.
- If another account matches, the server’s moderators see which account (not an address) and the server’s setting decides what happens: nothing, a moderator review, a kick, a timeout or a ban. A shared connection (family, school, workplace, VPN) can match by mistake: a moderator can clear you.
- The server keeps a short history of each match (which accounts matched and what the server’s setting did about it, as user IDs and a date), so moderators can review it and so repeated attempts can be told apart from a first one.
- Fingerprints and that history are deleted automatically after the number of days the server chose (90 by default), when the bot is removed from the server, or earlier on request. Moderators who approved you as “not an alt” leave a record of that approval (your ID and theirs) for the same purpose.
- During the login the website sets one short-lived cookie (valid 15 minutes, only on the verification pages) that ties the login to your browser. It is not used for tracking and is deleted when you are done. The login code is exchanged once and the access token is revoked right away.
Look-alike alert (optional, per server)
A server can switch on an alert for new members who look like accounts banned from that server. When someone joins, the bot compares their public profile (username and profile picture) with the public profiles of the server’s banned users, which it reads from Discord and keeps in memory only for a few minutes. Nothing is stored, and the bot only alerts moderators; it never punishes because of a resemblance.
Direct messages
The bot may send you a DM, for example a warning or a note that you were removed, if the server has this feature turned on. Backups and alerts are sent to the bot’s owner in the same way.
This website
This website uses no analytics, no advertising and no third-party scripts, fonts or embeds, and sets no cookies except the short-lived verification cookie described above. Like any web server, it may keep technical request logs (such as time, requested page and IP address) for security and troubleshooting. These are not used to identify visitors and are not shared.
3. Why we process it, and on what basis
We use the data only to run the moderation features that server administrators switch on: keeping communities safe, enforcing their rules, keeping a record of moderator actions and protecting the Service from abuse. Where the EU or UK GDPR applies, this rests on the legitimate interest of server communities and of the operator in safe, moderated spaces (Art. 6(1)(f)), balanced against your interests and rights. We do not use the data for advertising, profiling for sale, or training AI models.
4. The AI model
The AI check runs on the machine that hosts the bot. The model is downloaded once from a public model repository and cached; your messages are not sent to an external AI service. It returns scores for categories such as toxicity or threats, which the bot compares with the thresholds the server has set.
5. Who we share data with
- Discord Inc. The bot works through Discord, and everything you post there is subject to Discord’s own Privacy Policy.
- The server’s moderators. Cases, notes and flags about a member are visible to moderators of that server who have the right permissions. They are not shown to other servers.
- Hosting. The bot runs on infrastructure controlled by the operator. We do not sell personal data and we do not share it with other third parties, except if the law requires it.
6. Backups
The database is backed up regularly. A copy is sent by DM to the operator and a few recent copies are kept on the hosting machine. Backups can be encrypted with a password. They contain the data described in section 2 and are kept only as long as the backup rotation keeps them (by default the most recent seven copies on the machine). Data you have deleted therefore disappears from backups when older copies are replaced.
7. How long we keep data
- When the bot is removed from a server, the data stored for that server is deleted automatically (settings, flags, cases, notes, rules text and so on). Copies in backups age out as described above.
- While the bot stays in a server, moderation records are kept until a moderator deletes or pardons them, because servers need a history to moderate fairly.
- Applications that have been decided are deleted automatically 180 days after they were sent. Applications still waiting for a decision are kept until a moderator decides them or the form is deleted.
- Messages held in memory are discarded as described in section 2 and when the bot restarts.
8. Your rights and choices
Depending on where you live, you may have the right to access the data about you, have it corrected or deleted, restrict or object to its processing, and complain to your data protection authority. To use these rights, or to ask which records exist about you, contact us by email at glaceevee@proton.me or in our support server on Discord. Because the records belong to a server, we may need to involve that server’s moderators, and we may keep records that are needed to protect the community or to comply with the law. You can also ask a server’s moderators to remove entries about you, and you can stop all processing by leaving the server. Server owners can remove the bot at any time.
9. Children
The Service is meant for people who are old enough to use Discord, and we do not knowingly collect data from children below that age. If you think a child’s data was stored, contact us and we will remove it.
10. Security
Access to the bot and its database is limited to the operator, and backups can be encrypted. No system is perfectly secure, so we cannot guarantee absolute security. If we learn of a breach that affects you, we will act as the law requires.
11. Changes
We may update this policy when the Service changes. The date at the top shows the latest version, and we will try to announce significant changes, for example in the support server.
12. Contact
For privacy questions or requests, contact us by email at glaceevee@proton.me or in our support server on Discord.