anvilyx.

Privacy Policy

Effective OWNER: date  ·  Last updated OWNER: date

1 Who is responsible

anvilyx (“the Service”) is operated by OWNER: legal name (“the operator”, “we”), a sole developer.

Contact for any question or request in this policy: OWNER: contact email

OWNER: postal address, or a decision not to publish one

For personal data of people in the EU or UK, the operator acts as a controller: the operator, not Discord, decides why and how the data described here is stored. Discord Inc. is a separate controller for everything it holds itself.

OWNER: whether an EU representative under GDPR Art. 27 has been designated, and their details

2 Who this covers, and where the data comes from

Two different groups.

Server members. If you are a member of a Discord server that has installed anvilyx, data about you may be stored. You did not give it to us — Discord did, through its gateway, when you sent a message, joined, left, or a moderator acted on you. The source of your personal data is Discord.

Console operators. If you sign in at app.anvilyx.com to configure a server, we handle a small amount of data about you directly.

Nothing here changes Discord’s own privacy policy, which governs everything Discord holds.

3 What is stored, and why

3.1 Message content — read this first

When automatic moderation acts on a message, the first 400 characters of that message are copied and stored, verbatim, alongside the channel id and message id. An ellipsis is appended if the message was longer, so the stored string can be 401 characters.

This is on by default for every server. The copy is taken before the bot deletes the message, which means the stored excerpt is frequently the only remaining copy of that message anywhere.

It is kept so that the moderation record a member can appeal against does not describe evidence that no longer exists. A server can switch it off, in which case no excerpt is stored for future cases in that server; existing excerpts are unaffected.

The same 400-character excerpt is also stored when a member files a report by right-clicking a message.

Discord’s privileged Message Content intent is requested only when content filtering is enabled on at least one server the bot is connected to. Because intents are a single connection-wide decision, one server enabling content filtering means message text is available to the bot for all servers on the same connection.

Separately, when message logging is enabled, edits are mirrored into a Discord channel your server chose, including up to 900 characters of the new text. That content is stored by Discord in your channel, not by us. Pre-edit text is never shown, and deleted-message content is never recorded — Discord does not send it.

3.2 Moderation records

Each case stores: a per-server case number, the subject’s Discord user id, the moderator’s Discord user id (or none, for automatic actions), the action, the rule, a free-text reason written by a moderator, the time it was issued, an optional expiry, and the optional message excerpt described above.

3.3 Other data about members

• Experience and level: Discord user id, XP, level, and the time of the last award.
• Sticky role memory: the Discord user id of a member who left the server, and the role ids they held.
• Members who passed the verification gate: a list of Discord user ids.
• Current boosters: Discord user ids.
• Temporary role grants: user id, role id, the moderator’s written reason, and the expiry.
• Per-member role assignments, named console managers, join-guard exempt users, log-ignore lists: Discord user ids.
• Legacy warning records carried over from an earlier version: user id, rule, detail.
• Reports filed by members: the reporter’s Discord user id, the target’s Discord user id, up to 600 characters of reporter-written text, the channel it was filed from, and the message excerpt where one applies. The reporter’s identity is stored even when the report card is configured to show reports anonymously — that setting controls display only.

Usernames, nicknames and avatars are not stored. Records hold Discord ids, because an id survives a rename. The console resolves ids to names by asking Discord live, at most 50 at a time, and shows the raw id for members who have left.

3.4 Data from integrations

If a server configures an inbound webhook, the content of that webhook is staged in the server’s configuration document until it has been delivered to Discord (up to 256 pending items per hook):

• Notion audit-log hooks extract an actor’s email address from the incoming payload, where the payload contains one, and store it in the pending item. That email may belong to a third party who has no relationship with this Service.
• GitHub hooks store GitHub usernames and up to 3,500 characters of commit messages and pull-request titles.

3.5 Console operators

• Sign-in uses Discord OAuth with exactly two scopes: identify and guilds. Not email. No email address is obtained from Discord.
• The Discord access token and refresh token are never written to the database or to the cookie. They are used twice during sign-in — to fetch your user record and your server list — and then discarded.
• The session cookie (anvilyx_session) contains your Discord user id, your Discord username, the time it was issued, and a CSRF token. It is signed with HMAC-SHA256 but not encrypted, so its contents are readable by anyone holding the cookie. There is no server-side session table. It is HttpOnly, SameSite=Lax, scoped to the whole site, and Secure unless the operator explicitly disables that.
• Operator actions are recorded server-side: your Discord user id, a correlation id, the server id, the source, the action name, the target, the outcome and a timestamp.
• Responses to POST requests you make in the console are cached for replay protection, keyed by a string containing your Discord user id and the server id. The cached value is the complete response body — which, for a request that files a case, includes that case and its message excerpt.

3.6 Operational records

• Failure diagnostics for events that could not be processed. For member and message events these include a key of the form member:<server id>:<user id>, and an error string capped at 4,096 characters.
• Processed-event records: an event id, server id, event type, outcome and error. No Discord user id.
• Queued and sent work: message bodies destined for Discord channels, and Discord user ids for pending role revocations.
• Change notices: server id, topic, timestamp, and a process identifier. No Discord identity.
• Configuration backups: twelve per server. These deliberately exclude cases, XP, reports, verified members, sticky roles, temporary roles and boosters, but they do retain per-member role assignments, the named-manager list, join-guard exempt users, log-ignore lists, and integration credentials.

3.7 IP addresses

Visitor IP addresses are never written to the database. They are held in memory only, as rate-limiting keys and as a per-address cap on status-page streams, and are discarded once idle for 600 seconds or when the connection closes.

The application writes IP addresses to its process log only at debug level, which is off under the default configuration. The Discord user id and username of every successful console sign-in are written to the process log at info level, which is on by default. Refused sign-ins log the user id.

OWNER: whether the reverse proxy keeps access logs containing IP addresses, and for how long

OWNER: whether the application process log is persisted, where, and for how long

4 Why, and on what legal basis

Data is stored to provide the features a server operator switched on: keeping a moderation history that escalation decisions and appeals can be read against; ranking members by activity; returning roles to members who come back; delivering the messages and feed items a server configured; and letting the people a server has authorised administer it.

Where the GDPR applies, the legal basis for member data is legitimate interests (Art. 6(1)(f)) — the interest of a Discord server’s operators in moderating their community and of this operator in providing that capability. Consent is not used and is not available: nothing asks a member for permission and nothing records one, and a member is not party to any contract with the operator.

This characterisation has not been reviewed by a lawyer and is the item in this policy most likely to change on review.

For console operators, data is used to authenticate you, to decide what you may change, and to keep a record of changes.

5 How long it is kept

Stated exactly. Where something is kept indefinitely, it says so.

Automatic strike expiry does not delete anything. When a server sets a strike-expiry window, old cases are filtered out at read time; the record stays in the database.

These are cleared in batches of 500 rows, triggered by the next write to the same table rather than by a timer. Deletion is therefore prompt in ordinary use but not instantaneous, and a table that stops being written to stops being swept.

OWNER: whether database-level backups exist outside the application, and how long they are kept

6 Removing the bot does not delete anything

If the bot is removed from a Discord server, no data is deleted. The server is marked as removed and every record — cases with message excerpts, XP, sticky role memory, reports, the verified-member list and the entire configuration document — is retained indefinitely, deliberately, so that a re-invite restores the server’s settings. No code path deletes a server’s data.

To have a removed server’s data erased, ask (§9). It is done by hand.

7 Who can see it

• The operator, who has direct database access.
• Anyone a server has authorised to use the console for that server. Access is coarse: every authorised person — the server owner, anyone with Discord’s Administrator or Manage Server permission, and anyone named as a delegate — can read that server’s full case ledger including message excerpts, the report queue, the XP leaderboard and the member directory. There is no per-page or per-record tier. The only narrower gate is on editing the manager list itself, which is restricted to the server owner and Discord managers.
• Operator action records are read by nobody. Nothing in the console or the command line reads them back; they are visible only to whoever has direct database access.

Public pages — the health checks, the status page and its feeds, the incident list, the invite redirect and the sign-in routes — expose no personal data. Operational metrics carry no server or user identifiers.

8 Third parties

No data is sold, licensed, shared with data brokers, shared with advertising networks, or used to train machine-learning or AI models.

There is no analytics service, no error-reporting service, no advertising SDK and no third-party CDN for data anywhere in the software.

• Discord — the platform the Service runs on, and the source of member data. Content the logging feature mirrors is posted into a channel your own server owns, and is then held by Discord under Discord’s policies.
• The hosting provider — OWNER: hosting provider and country
• The network in front of anvilyx.com and app.anvilyx.com sees requests to them. OWNER: name the provider and describe what it retains
• Feed sources a server configures — GitHub, YouTube, and any RSS or Atom URL entered. These requests are plain GETs carrying an Accept header and the user agent anvilyx/0.1. They carry no cookies, no credentials, no referrer and no user identifier, so nothing about your members is disclosed to them.
• Discord’s icon CDN — the console loads member and server avatars from it, which reveals the browsing operator’s IP address to Discord. No other external host may be contacted by the console.

9 Your rights

Where the GDPR or UK GDPR applies you have the right to ask for access to your data, correction of it, erasure of it, restriction of processing, and portability, and the right to complain to your data protection authority.

There is no self-service way to exercise these. No page, slash command or command-line tool exports or erases a person’s data. The only automated deletion that exists is operated by a server’s own managers, from the console: removing a single case, or removing every case belonging to one member in that server. Neither touches XP, sticky role memory, reports, the verified-member list, backups or the operator action record.

Everything else is done by hand. Email OWNER: contact email. Say which Discord server and give your Discord user id, so the right records can be found — ids are what the Service stores, not usernames.

We will respond within one month. If a request is complex that may be extended by up to two further months, and we will tell you within the first month if that happens.

10 Your right to object

Set out separately, as required by GDPR Art. 21(4).

Where your data is processed on the basis of legitimate interests, you have the right to object to that processing at any time, on grounds relating to your particular situation.

If you object, processing stops unless the operator can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the data is needed for legal claims. This right is not absolute, and a moderation record that a server relies on may be one the operator declines to erase — in which case you will be told why, and you may complain to your data protection authority.

To object, email OWNER: contact email.

11 Automated decision-making

Automatic moderation acts on messages without a human reviewing each one: a matching message may be deleted and a case filed, and repeated cases escalate to a timeout, kick or ban according to a ladder the server configured.

Those settings are chosen by the server’s own operators, and a server’s moderators can reverse any action and remove any case. If an automatic action affected you, raise it with that server’s moderators first; they hold the controls. You may also contact us under §9.

12 Children

Discord requires its users to be at least 13, and older in some countries. The Service has no age signal of any kind and does not knowingly store data about anyone below Discord’s minimum age. If you believe it holds data about a child who should not be on Discord, email OWNER: contact email and it will be removed.

13 Security, stated honestly

The session cookie is signed, HttpOnly, SameSite=Lax and Secure. Outbound fetches are protected against server-side request forgery, redirect chains and oversized responses. The console sends a strict Content-Security-Policy that permits no third-party scripts, styles or network calls. Access to a server’s configuration is re-checked on every request and while a live console stream is open.

Two things you should know rather than discover:

1. Integration credentials — webhook endpoint tokens, signing secrets and verification tokens — are stored in plain text inside a server’s configuration document, and copies persist in up to twelve configuration backups. Anyone with database access, and anyone authorised to use the console for that server, can read them. Rotate them if you believe they are exposed.
2. The session cookie is signed but not encrypted. Anyone who obtains it can read the Discord user id and username inside it.

OWNER: whether the database volume is encrypted at rest

No system is perfectly secure. If you find a vulnerability, email OWNER: contact email.

14 Where data is held

OWNER: hosting provider and country

Data is held in a single PostgreSQL database. There is no second copy in another region, and no third-party data processor beyond the hosting provider.

15 Changes

This policy will change as the software does. The version in force is the one at anvilyx.com/privacy, with the date at the top. Material changes will be noted on that page.

16 Contact

OWNER: contact email

If you are in the EEA or UK you may complain to your national data protection authority.