Privacy Policy

Last updated 21 June 2026

Clankwarden is a Discord moderation and anti-scam bot. This policy describes exactly what data the bot stores, why it stores it, how long it keeps it, and how it can be deleted. It reflects the bot's actual behaviour. Nothing here is aspirational. Clankwarden stores only the data its moderation features need, and all of it is scoped to the individual server (guild) it was produced in. The one exception is the optional cross-server signal, which is off by default and, when enabled, shares only an anonymous aggregate (see Sharing).

What is collected, and why

• Server configuration: the channels, roles, thresholds and toggles you set. No personal data; this is just how the bot is configured for your server.
• Containment state: for a contained (“clanked”) account: its user ID, containment level and score, the roles it had before containment (so they can be restored), and timestamps. Needed to apply, track and release the .clank system.
• Message content captured at containment time: the specific messages that triggered a containment, kept as evidence for the moderation decision.
• Account-link analysis: relationships between user IDs used to detect coordinated scammer or bot rings.
• Warnings: the target user ID, reason, and the moderator who issued each warning (the .warn system).
• Moderation audit log, for each tracked action: the actor ID, target ID and an action summary. For message delete/edit events, the message text is recorded so the log is meaningful.
• Dehoist actions: the user ID, the action taken, and the name before and after, as an audit of automatic impersonation handling.
• Reports, cases & investigation notes: the reporter, target and hunter IDs and the free-text reason or notes, for the report → case → intel moderation loop.
• Hunter records: for a moderator in the Hunter system, their case counts, accuracy, XP and rank.
• Sticky-role snapshots: the role IDs a member held when they left, so those roles can be restored if they rejoin.
• Member history: a member's user ID, last-known username / display name / global name, account-creation date, and join/leave timestamps -- their dossier and tenure timeline. Kept after a member leaves so tenure stays visible, and bounded by a retention window (below).
• Command-usage analytics: the user ID, the command run, and the arguments the user typed (trimmed) -- backing .commandstats. Bounded by a retention window (below).

Clankwarden does not store presences, full channel transcripts, emails, IP addresses, or any payment data. Raw message content is stored in only two places: the evidence captured when an account is contained, and the text of deleted or edited messages in the moderation audit log. Both are subject to the retention windows below.

Gateway intents

The bot requests the message_content intent (to route its prefix commands and scan for scam signals), the members intent (join, leave and update handling for containment and logging), and auto_moderation_execution (to act on Discord AutoMod hits). It does not request the presence intent.

Retention

• Containment records are removed when a user is released.
• Stored message evidence can be aged out automatically by an operator setting (EVIDENCE_RETENTION_DAYS); a daily task deletes evidence older than the configured window.
• The moderation audit log has its own optional retention window (MOD_LOG_RETENTION_DAYS, default 0 = keep forever, since the tamper-evident chain is the audit record). It can be pruned manually with .modlog prune <days>; note this store retains message content until an operator sets a window.
• Member history and command-usage analytics each have their own operator retention windows (MEMBER_HISTORY_RETENTION_DAYS, COMMAND_USAGE_RETENTION_DAYS); a daily task ages out data older than the configured window.
• When the bot is removed from a server, all of that server's stored data is deleted automatically.

Your rights & deletion

• Per server: removing the bot from a server erases that server's stored data.
• Per user: a server moderator can run .modlog forget @user to erase a user's stored data in that server: containment records, captured evidence, warnings, dehoist and case data. This is per server, so a user present in several servers must request it in each.
• Tamper-evident audit-log entries are retained for integrity by default; an operator can erase those too on request (a full purge including the audit chain).

To request deletion of your data, contact the moderators of the server in question, or the bot operator at the address below.

Website & dashboard

The website and management dashboard are separate from the bot's in-server data above. Signing in with Discord uses the identify and guilds scopes and stores a single signed, httpOnly session cookie. That cookie holds your Discord user ID, display name, avatar hash, and a Discord access token used only to read your list of servers (so the dashboard can show the ones you manage). The cookie is kept for up to 7 days, or until the access token expires (whichever comes first), and is cleared when you log out. No other website storage, profile, or analytics record is created.

Sharing

Clankwarden does not sell data and does not send Discord user data to third-party analytics or advertising services. Data lives in the operator's own database. If an operator enables the optional AI bridge, any content sent to it is governed by that operator's configuration.

Cross-server signal (optional, off by default). Clankwarden can maintain an anonymous cross-server risk signal so a serial scammer contained in many independent communities can be flagged for a new one. It is opt-in in both directions -- a server chooses whether to contribute and whether to consume -- and is off by default. A contribution stores only the contained user's ID and a keyed hash of the contributing server; it never shares usernames, message content, evidence, or the server's identity in plaintext. It is k-anonymous (a signal appears only once a user has been independently contained in several distinct servers, so one server can never brand a user), advisory only (a moderator sees a count and a decayed score -- never which servers, who, or why -- and it never auto-contains anyone), and deletable (a per-user forget erases that user's contributions, and removing the bot erases a server's). With no signing secret configured for the deployment, the whole network is inert -- nothing is written or read.

Contact