Privacy Policy

This Privacy Policy describes what information the Vör Discord bot (“the Bot”) collects, how it is used, how long it is retained, and your choices regarding that information. The Bot is operated by the project maintainers and is installed in Discord servers by server owners. This policy applies only to data the Bot collects and stores; it does not cover data handled by Discord itself or by third-party services the Bot integrates with.

  1. Data Controller and Contact
  • Data controller: the project maintainers (see the repository for maintainers and contact details).
  • If you have privacy questions or requests, open an issue in the repository or contact the server moderation team where the Bot is installed.
  1. Data Collected

The Bot may collect and store the following categories of data, depending on which features are enabled and how the server configures the Bot:

  • User Identifiers
    • Discord user IDs (numeric IDs) and usernames/nicknames. These are stored to identify users for features like moderation logs, notes, reminders, votes, and role assignments.
  • Moderation and Audit Data
    • Moderation actions (warnings, mutes, bans, case logs), modlog entries, and related metadata (reason, moderator ID, timestamps).
    • Notes and staff comments attached to users.
  • Files and Attachments
    • Files uploaded for VirusTotal scanning: when a file is flagged for VirusTotal scanning, a copy of the file may be uploaded to VirusTotal (subject to VirusTotal’s policies). The Bot may temporarily store a copy of the file locally for the purpose of uploading and matching results.
    • Images and attachments used for scam detection (pHash, OCR): the Bot may store image thumbnails, perceptual hashes (pHash), or full images temporarily to run OCR or compute hashes. These are used to detect duplicate/known scam images and assist automod decisions.
  • Activity and Usage Data
    • Basic usage telemetry such as command usage counts, tag usage counts, timestamps of actions, and other non-personal aggregated metrics to help maintain and improve the Bot.
  1. Purpose and Legal Basis
  • The Bot processes this information to provide and maintain features, handle moderation, perform security scans (VirusTotal, pHash/OCR), and to support server management tools.
  • Retention and processing are necessary for the legitimate interests of server moderation and bot functionality.
  1. Retention Periods

  • Moderation logs, notes, and case history: retained until manually deleted by server moderators or by database maintenance procedures defined by server owners. Server owners may export or delete data via provided commands when supported.

  • VirusTotal files and scan artifacts: the Bot aims to hold local copies only as long as necessary to upload to VirusTotal and fetch the scan report. Local copies should be deleted after uploads complete and results are recorded. VirusTotal may retain files according to their policy; the Bot does not control third-party retention.

  • Images for pHash/OCR scam detection: the Bot may retain derived data such as perceptual hashes and short-lived thumbnails indefinitely to enable matching and detection; full-resolution images are normally retained only temporarily for processing and then removed. Where possible, only non-reversible derived representations (hashes) are stored long-term.

  • Usage metrics and aggregated telemetry: retained for operational and improvement purposes; typically kept for a period defined by the project maintainers (e.g., 12 months) unless otherwise specified.

  1. Access and Sharing

  • Who has access: server moderators and administrators (depending on server config) can view moderation logs, notes, and case history stored for their server. Project maintainers may access logs and data for debugging and maintenance if necessary (for example, when investigating an error or abuse report).

  • Sharing with third parties: the Bot will not proactively share personal data with third parties except where required for operation (e.g., uploading files to VirusTotal for scanning) or when legally required.

  • Law enforcement: the Bot maintainers will comply with lawful requests for data (for example, a valid subpoena) and will disclose data as required by law.

  1. Security
  • The Bot stores data in local aiosqlite databases and may use Piccolo ORM for schema management. Access is limited to the environment where the Bot runs and to authorized maintainers with access to that environment.
  • Maintainers strive to follow reasonable security practices, but cannot guarantee absolute security. Do not send highly sensitive personal data to the Bot.
  1. Deletion and Data Subject Rights
  • Deletion by server moderators: server moderators may have commands to delete or export data for their server; consult the Bot’s commands (for example, moderation and admin cogs) for available tools.
  • Users may request deletion of personal data by contacting server moderators or the project maintainers. The ability to honor deletion requests may depend on the server’s local data and backups.
  1. Third-Party Services
  • VirusTotal and other integrations: files sent to VirusTotal are processed under VirusTotal’s own terms and policies. The Bot’s maintainers do not control VirusTotal’s retention or handling of uploaded files.

  • Any API keys or webhooks used by the Bot are configured by the Bot operator and are not shared by the project maintainers unless explicitly required.

  • Explicit third-party integrations used by the Bot may include (but are not limited to):
    • PCPartPicker (pcpp): queries to PCPartPicker or related scraping services may include product identifiers, product page URLs, and images/metadata required to build a part listing. The Bot may cache or store small amounts of metadata (titles, prices, image thumbnails) to provide features like part lookups, but full third-party content is subject to the third party’s terms. The Bot operator’s API keys or scraping configuration control how and whether data is shared.
    • Drop Reference (drop_reference): when using Drop Reference features, the Bot may query external drop-tracking services and include item identifiers, links, and optionally images. Data exchanged for these queries is controlled by the operator’s integration settings and is processed under the third party’s terms.
    • Currency conversion services/APIs: when converting prices or displaying converted amounts, the Bot may call external currency rate APIs. Those services may log query metadata (such as IP address, request timestamps) according to their own policies. The Bot may temporarily store returned exchange rates for caching and performance.

  • What is shared with third parties: typically the Bot sends only the minimal data required for the integration to function (for example: product IDs, image URLs, file hashes, or a transient file upload for scanning). The Bot’s maintainers and/or operators try to avoid sending unnecessary personal data to these services.

  • Who controls keys and configuration: API keys, tokens, or scraping configuration for external services are supplied and controlled by the Bot operator (the person or team that runs the Bot instance in a server). The project maintainers do not publish or distribute operator keys.

  • Retention and responsibility:
    • Data retention and processing performed by third-party services are governed by those services’ privacy policies and terms of service. The Bot maintainers cannot control or guarantee how third parties handle data after it is transmitted to them.
    • When the Bot merely references external content (for example, a PCPartPicker URL), it may store that reference in server logs or command history; whether those references are retained and for how long depends on server configuration and database retention policies.
  • If you have concerns about a specific integration (for example, PCPartPicker, Drop Reference, or a specific currency API), contact the server moderators or the Bot operator to review how the integration is configured and whether data sharing can be minimized or disabled for your server.
  1. Changes to this Policy
  • This policy may be updated from time to time. Changes will be posted in the repository’s docs and/or README. Continued use of the Bot after updates indicates acceptance.
  1. Contact
  • For questions or data requests, open an issue in the repository or contact the server moderation team where the Bot is installed.