GuildGuard01Who we are
GuildGuard ("we", "us") runs the GuildGuard Discord bot and the website at guildguardbot.com, including the dashboard, the plans page and the verification pages. We are responsible for the personal data described here.
GuildGuard is not affiliated with or endorsed by Discord Inc. Your use of Discord itself is covered by Discord's privacy policy.
02What we collect
When you sign in to the website
Sign-in uses Discord OAuth2 with the identify and guilds scopes. We never see your Discord password or email address.
| Data | Details |
|---|---|
| Account | Discord user ID, username, display name and avatar, plus when you first and last signed in and how many times. |
| Server list | The servers you are in and your permissions there, read from Discord to decide which servers you may manage. Held only briefly in memory and in your login cookie (server IDs only). Not stored in our database. |
| Access token | The Discord access token is kept only inside your login cookie, encrypted with AES-256-GCM. It is not stored in our database and can't be read by anyone who copies the cookie. |
| Settings changes | When you change a server's settings: your user ID, username, what changed and when. This is shown in the server's change history. |
| Payments | Order ID, server ID, your user ID and username, plan, period, price, crypto currency chosen, payment status and payment IDs from NOWPayments. We never see or store card numbers or wallet keys. |
| Web verification | Which server you verified for, plus a keyed hash of the captcha answer and the number of attempts. The captcha answer itself is never stored. |
| Contact form | Your name, email, topic, message, and the server or order ID if you add them. If you are signed in, your Discord ID and username are attached. Your IP address is kept only as a keyed hash to stop spam. Used only to answer you. |
| Network data | Your IP address is used in memory for rate limiting and is passed to Cloudflare Turnstile for the human check. We do not store it. |
When the bot is in a server
| Data | Details |
|---|---|
| Server info | Server ID, name, icon, member count, owner ID, and the names and IDs of channels and roles. Used to show the dashboard and to restore deleted channels and roles. |
| Settings | Everything configured for GuildGuard in that server, including the whitelist (user IDs). |
| Security events | When GuildGuard acts (for example a raid, a nuke attempt, spam or a scam link): the type, time, the member's ID and tag, and a short description. For blocked messages this can include up to 300 characters of the message or the blocked link. |
| Warnings | Warnings given with /warn: member ID and name, reason, moderator ID and name, and time. |
| Tickets | While a ticket is open: its number and type, who opened and claimed it, and when. When it closes, a transcript of the ticket channel is sent only to your server's chosen channel and to the person who opened it. GuildGuard keeps no copy of ticket messages. |
| Backups | Plan feature: the structure of the server (roles, channels, permissions and settings). Backups never contain messages. |
| Member names for display | Names and avatars of people who appear in the settings or event log, so the dashboard can show names instead of raw IDs. |
Messages
To catch spam, scam links and banned words, the bot reads new messages as they arrive. This happens in memory and the text is then discarded. Message text is stored only in the short excerpts described above, when a message was blocked. Edited and deleted messages are reported to the log channel your server chose, inside Discord. We don't keep a copy.
03What we don't collect
- Your Discord password, email address or phone number.
- Direct messages between members. The bot only sees DMs sent to the bot itself, such as captcha answers, and doesn't store them.
- Card numbers, bank details or crypto wallet keys.
- Advertising IDs, tracking pixels or analytics cookies. The website has no third-party analytics.
04Why we use it
- To provide the service you asked for, which is protecting your server, showing the dashboard and verifying members. This is necessary to run the service (a contract with you).
- To process payments and activate the plan you bought (contract), and to keep payment records as the law requires (legal obligation).
- To keep the service safe: rate limits, the human check and audit trails that stop abuse (legitimate interest).
We never sell personal data, use it for advertising or use it to train AI models.
06How long we keep it
| Data | Kept for |
|---|---|
| Security events | 90 days, then deleted automatically. Your plan decides how far back the dashboard shows: 7, 30 or 90 days. |
| Settings history | 90 days, then deleted automatically. |
| Contact messages | 365 days, then deleted automatically. |
| Captcha attempts | 1 hour. |
| Login cookie | Up to 7 days, or until you log out. |
| Server data | While GuildGuard is in the server. Once it has been removed for 30 days, the server's settings, events, warnings and backups are deleted automatically. |
| Warnings & backups | Until a server admin removes them, or 30 days after the bot leaves the server. |
| Account profile | Until you ask us to delete it. |
| Payment records | As long as tax and accounting law requires. |
07Security
- All traffic is HTTPS only (HSTS), and a strict Content-Security-Policy blocks third-party scripts.
- The database is locked with Row Level Security. Only our servers hold the key.
- Login cookies are signed, HTTP-only and bound to this site, and the Discord token inside is encrypted.
- Every dashboard request re-checks your Discord permissions, and every change needs an anti-forgery token.
- Payments are activated only after a signed callback from NOWPayments, checked again with their API.
- The bot token never leaves the bot's own server.
No system is perfect. If you find a security problem, please tell us (see Contact) before sharing it publicly.
08Your rights
Depending on where you live (for example under the GDPR, UK GDPR or CCPA), you can ask us to:
- give you a copy of the data we hold about you;
- correct it;
- delete it, unless we must keep it, as with payment records;
- restrict or object to how we use it;
- send it to you in a portable format.
Server owners can remove all data for their server by removing the bot. It is deleted automatically after 30 days, or straight away if you ask. You can also complain to your local data protection authority.
We answer requests within 30 days. To protect your account we may ask you to prove the request comes from you, for example by messaging us from the same Discord account.
10Children
GuildGuard follows Discord's minimum age (13, or older where your country requires it). We don't knowingly collect data from anyone younger. If you believe a child has given us data, contact us and we will delete it.
11Changes
If we change this policy we will update the date at the top. For important changes we will also post a notice on the website or in the dashboard before they apply.
12Contact
For privacy requests, data deletion or security reports, use the contact form and pick “Privacy / data request” or “Security report”. Include your Discord user ID and, for server requests, the server ID. Signing in first lets us confirm the request comes from you.