Legal · reviewed 26 September 2026
Privacy, in
operational terms.
What Guardy Bot processes, why it is needed, how long it stays, and which controls remain in the hands of members and server administrators.
Privacy policy effective .
Who is responsible
Pixelheads B.V., established in the Netherlands and trading as Guardy, operates Guardy Bot and acts as an independent controller for the personal data it processes to provide, secure, bill for, and improve the service. A Discord server administrator separately decides why and how their community uses Guardy Bot's guild settings.
| Registered name | Pixelheads B.V. |
|---|---|
| Trade name | Guardy |
| Physical address | De Nieuwe Erven 3, 5431 NV Cuijk, Netherlands |
| KVK | 69959447 |
| VAT ID | NL858081301B01 |
| Privacy contact | support@guardybot.com |
Current service processing
Depending on configuration and use, Guardy Bot processes:
- Discord user, server, channel, role, and application identifiers;
- usernames and avatars where needed for dashboard accounts, rank cards, or leaderboards;
- XP, levels, message-award counts, eligible voice time, activity windows, rewards, and rank-card preferences;
- import job metadata and staged user ID, XP, and source-level rows until an import is applied;
- guild settings, bot lifecycle, command, security, rate-limit, and privacy-operation records;
- when a server administrator configures Creator Alerts, public creator identifiers and refreshed display identity from YouTube API Services, Twitch or Kick, or a public RSS feed URL and display name, the selected Discord channel and role, event identifiers, content-free delivery status, and operating timestamps;
- when a server administrator turns on Invite Tracker, the joining member's and the inviter's Discord identifiers, the invite code, the join source (an invite, the vanity URL, a bot join, or unknown), and the join and leave times;
- when a server administrator turns on Suggestions, each forum post's title and author, its state, the reason staff gave, who decided, and each member's vote;
- when a server administrator turns on Temp Voice, the hub settings, and for each open voice room its channel identifier and the room owner's Discord identifier;
- when a server administrator sets up Server Counters, the counter settings: each counter's type, channel, name, number format, goal step or chosen role, and the last number shown. No member data is stored: to count humans, bots or members with a role, Guardy reads the member list in memory and keeps only the count;
- when a member sets a reminder, the reminder text or the linked message, the member's Discord identifier, the channel where it was set, and when it is due;
- when a server administrator turns on Economy, each member's coin balance, daily streak and whether staff froze their account, every change to their coins (with the staff member and reason for a staff change), their shop purchases and how each was delivered, and coin drops staff posted;
- when first-party homepage install attribution is enabled, a necessary sign-in session carrying the fixed route label
homepagefor up to 15 minutes, plus the server identifier and the time Discord returned a successful guild-bound authorization; - a minimal Founding Member claim record containing a keyed, unreadable claimant-identity digest and the claimed server identifier, when that campaign is used;
- message content and up to ten attachment URLs when a server administrator explicitly enables deep moderation logging;
- ticket messages and internal staff notes, ticket intake answers, participant and staff identifiers, status, priority, assignment, and lifecycle events;
- ticket attachments, including filenames, file metadata, scanner outcomes, and stored file objects when an administrator enables attachment intake;
- ticket transcripts rendered when a ticket closes, together with bounded delivery and access records;
- Discord OAuth account data and encrypted access or refresh tokens for dashboard access; and
- subscription, entitlement, invoice, and payment references. Guardy Bot does not store payment-card details.
Guardy Bot requests Discord's Message Content privileged intent because shipped automod rules must evaluate what was said. Automod normally handles that content transiently. Message text is stored only when a server administrator explicitly enables deep logging, for the configured period shown below. The leveling system needs only the eligible message event, and Guardy Bot never records voice audio.
Creator Alerts and provider APIs
This website uses YouTube API Services for Creator Alerts. It uses public YouTube channel and video information to identify a configured creator and deliver a qualifying alert. Guardy Bot stores only the public creator identity and the content-free configuration, event, and delivery records described above. It does not request personal Google account access, store video titles, descriptions, thumbnails, viewer analytics, or Google sign-in data in those records. Public YouTube identity information is refreshed or removed within 30 days when it is no longer needed.
Creator Alerts also uses Twitch developer services for public creator and stream information. Guardy Bot does not ask users to connect a personal Twitch account for this feature. Use of YouTube API Services is subject to the YouTube Terms of Service and the Google Privacy Policy.
Creator Alerts uses Kick developer services to check public channels and live status. It does not ask users to connect a personal Kick account. Guardy Bot stores public channel identity, stream identifiers and timestamps needed to avoid duplicate alerts. It does not store Kick stream titles, categories, thumbnails or avatars.
For RSS and Atom feeds, Guardy Bot saves the public feed URL and display name, plus hashed entry identifiers and timestamps to prevent duplicate alerts. Entry titles and links are cached for 30 seconds to prepare delivery. Raw feed documents and article bodies are not retained. Entry identifiers remain while the feed is referenced and are removed with the unused feed after the existing 30-day cleanup window.
Support tickets
Ticket content is visible to the requester, any participants added to that ticket, and the server's authorized ticket staff. Internal staff notes are withheld from requesters. A server administrator configures the intake questions, purpose, staff teams, retention period, and whether attachments are accepted. Guardy Bot shows the configured purpose, audience, and retention warning before a ticket form opens, so a member can decide whether to submit it.
Guardy Bot captures messages sent in the ticket surface so the conversation can be operated, audited, and rendered as a transcript when the ticket closes. A configured webhook receives only bounded lifecycle identifiers and states, never a message, answer, filename, username, or transcript. Requester transcript links expire within seven days and administrator links within one day; both are revoked by reopening, erasure, permission loss, or removal of Guardy Bot from the server.
AI features
Guardy Bot's AI features are off unless a server's administrators turn them on for that server. They include the AI Shield, which checks selected messages for scams, spam, phishing and harassment; AI Setup and Audit, which suggest channels, roles, permissions and which modules to switch on; a tool that turns a server's written rules into suggested settings; and, on Premium, Mod Assistant, which writes briefs and drafts for moderators, and Ticket AI, which answers, drafts replies and summarises in support tickets.
What is sent to an AI model. The AI Shield does not send every message. Guardy Bot first scores each message on the server itself, and only messages that look risky (for example links, invites, scam wording, mass mentions, very new accounts, or a member report), plus a small random sample while a server is in its first "watch only" week, are sent for a check. That sample comes only from channels everyone in the server can see, never from private channels or private threads. For those messages, the model receives the message text and the server's written policy, not usernames, avatars or account IDs. AI Setup and Audit send the owner's description and the server's channel, role and permission layout. Rules-to-settings sends the rules text the owner pasted. Mod Assistant sends one member's moderation records from that server only (cases, moderator notes, reports, appeals and AI Shield checks, including text the member wrote in them), without names or Discord profile data. Ticket AI sends the ticket's messages together with that panel's FAQ answers and saved replies.
What the AI can do. Depending on the mode the server chooses, the AI Shield only records what it would have done, removes a message and keeps a copy for a moderator to review, or removes a message and adds a strike to the server's own escalation ladder. Kicks and bans that follow from an AI strike wait for a moderator unless the server explicitly allows otherwise. Every AI action is labelled as AI, shows its reason, and can be appealed like any other moderation action. A moderator can undo a removal, strike, timeout or ban with Wrong call; a kick that has already happened cannot be undone that way. AI Setup shows every change for approval first and never deletes existing channels, roles or settings; undoing a setup removes only what that setup created. Mod Assistant and Ticket AI drafts go only to staff. The one AI output members see is a Ticket AI answer in a ticket, which only appears on panels where the server turned it on, is labelled as AI and offers a Talk to a human button.
What Guardy Bot keeps. For each Shield check Guardy Bot stores the category, a confidence level, a short reason, the provider and model used, and a copy of the checked message as evidence. These records follow the server's message-log retention and are deleted with other server data and on erasure requests. AI Setup runs keep the proposed plan, what was applied, and what can be undone, and follow the normal lifecycle for server product data. Mod Assistant answers are returned to the moderator who asked and are not stored. A Ticket AI close summary is stored on the ticket transcript it summarises and is deleted with that transcript, or earlier when the ticket expires or an erasure request starts. AI usage is recorded as credit ledger entries without message content.
Legal basis. Guardy Bot processes this data on the basis of the legitimate interest of the server and its members in a safe community, and to provide a feature the server's administrators asked for. Message content from Discord is never used to train AI models.
Forms and applications
Forms and Applications lets a server ask members up to ten questions in native Discord modals. Before a member starts a form, Guardy Bot shows the purpose the server configured and who reviews the answers. Unfinished first-page drafts are deleted within 24 hours; pending submissions and answers after 30 days; approved or declined submissions and answers after 90 days. Answers stay in the permission-scoped dashboard review queue. Discord notifications carry metadata and a dashboard link, never answers.
Why data is processed
Processing supports the requested service, imports, leveling and rewards, privacy controls, subscriptions, security, abuse prevention, support, and legal duties. Depending on the activity, the legal basis may be contract performance, legitimate interests in operating and securing Guardy Bot, legal obligation, or consent where applicable.
Homepage install attribution, when enabled, helps Guardy Bot understand whether that entry path reaches Discord authorization. During sign-in, Guardy Bot keeps the fixed homepage route label in the necessary sign-in session for up to 15 minutes, then clears it after success, cancellation, an error, or expiry. The record stays in Guardy Bot's own database and is kept separate from confirmed bot joins. No analytics, advertising, or visitor-identification cookie is added for attribution. Its stored record contains no member or dashboard-account identifier, IP address, device identifier, raw referrer, user agent, or free text, and it is not sent to PostHog.
When exception monitoring is enabled, Guardy Bot sends PostHog EU Cloud only a minimized error envelope for reliability and security diagnosis: exception type, safe application-file and line locations, handled state, service, environment, release identifier, timestamp, and a fresh random identifier for that one event. Error messages and surrounding source context are redacted. Guardy Bot does not intentionally include Discord, guild, member, account, ticket, message, email, token, or secret identifiers. The HTTPS request necessarily exposes its source IP address to PostHog's EU ingestion edge; Guardy Bot disables geolocation and requires PostHog's project-level IP anonymization so the address is dropped rather than retained. This processing supports Guardy Bot's legitimate interest in diagnosing failures. These events are kept for as long as Guardy Bot's PostHog plan retains them, currently seven years; that period follows the provider's retention policy and changes with it. Because the envelope carries no identifier tying an event to a member, a server, or an account, and the ingestion edge drops the source IP address, Guardy Bot cannot single out one person's exception events to produce or erase them on request.
Data received during an import
A member normally does not provide imported leaderboard data directly to Guardy Bot. A server administrator either asks Guardy Bot to read that server's public MEE6 leaderboard or uploads an authorized export from MEE6, Lurkr, Polaris, AmariBot, or a CSV source. The imported categories are Discord user identifiers and XP; a supported source may also supply a source level or reward-role definitions for the administrator's separate review.
Guardy Bot processes those records to perform the administrator-requested migration and preserve community progress. The intended basis is the controller's legitimate interest in providing a portable leveling service, balanced by source authorization, a preview before apply, member privacy controls, and objection and erasure routes. After a successful apply, Guardy Bot posts one server notice naming the source and linking members to this policy, public-leaderboard opt-out, and deletion controls. This section supplies the controller, categories, source, purpose, basis, retention, rights, and contact information required when the data was obtained indirectly.
Retention schedule
| Record | Free | Premium | Notes |
|---|---|---|---|
| Case and audit metadata | 90 days | Unlimited while the guild remains active | Legal, dispute, and abuse evidence may follow a separate lawful hold. |
| Member reports | 90 days | Unlimited while the guild remains active | Who reported whom, the reason chosen, the reporter's own note, and a short quote of the reported message. Follows the case window above, and a report that produced a case is kept as long as that case is. |
| Message-content logs | 30 days | 90 days | Shipped but off by default; each guild must opt in and can configure a shorter period. |
| Privacy-minimized exception monitoring | PostHog paid-plan event retention (currently seven years) when enabled | PostHog EU Cloud receives only the minimized diagnostic envelope described above, using a fresh random identifier per event and provider-side IP anonymization. No identifier ties an event to a member, server, or account, so a single person's events cannot be produced or erased on request. | |
| Ticket conversation, intake answers, attachments, and transcripts | 30 days after closure | Administrator-selected 30, 90, 180, or 365 days after closure | The exact effective period is shown before intake. Reopening resumes the same ticket lifecycle; a downgrade can shorten an existing Premium deadline to the Free limit. |
| Ticket lifecycle and replay-safety evidence | Bounded operational schedule | Content-free operations and effects may outlive conversation content briefly to prevent duplicate actions; ordered event evidence can remain for one year after the ticket retention deadline. | |
| Forms and Applications | Draft: 24 hours; pending: 30 days; approved or declined: 90 days | The member sees the configured purpose and reviewer audience before intake. Discord notifications contain metadata and a dashboard link only. | |
| Appeals | 30 days after a decision | 90 days after a decision | What a member wrote when they asked for a second look, the messages exchanged with your team, and the decision itself. Kept for the same period as message-content logs. An appeal nobody has answered yet is kept until it is answered. |
join_gate_checks | 90 days | Shipped verification and raid-response evidence. | |
ai_verdicts | Same window as message logs: 30 days on Free, 90 days on Premium, or shorter if the server sets it | The whole record is deleted, including the message copy. | |
| Monthly AI allowance and ordinary usage records | Normal guild-product deletion lifecycle | Each plan's monthly allowance expires at the end of its period without rollover; records are removed with ordinary departed-guild product data unless narrower evidence must be retained. | |
| Bought AI credits, invoice, refund, and dispute evidence | Up to 7 years where required for billing and tax evidence | Guild departure minimizes or pseudonymizes identifiers while retaining the provider references needed for replay safety and legal records. | |
| Name history | 30 days | 90 days | Off unless a server turns it on. What a member used to be called on that server, the name they changed to, and when: the nickname, the Discord username and the display name, never the avatar. Kept for the same period as message-content logs, and shown only to that server's moderators on that member's cases. |
| Invite attribution | 30 days | 90 days | Off unless a server turns on Invite Tracker. Which invite likely brought a member in, who created that invite, the invite code, the join source, and when the member joined and left. Kept for the same period as message-content logs. A member's data export includes rows where they joined or invited someone; erasure deletes their own join rows and removes their identifier from joins they invited. |
| Suggestions | Kept while the forum post exists | Off unless a server turns on Suggestions. The post title, its state, the reason staff gave, who decided, and the votes. Deleted with the post or with departed-server data; a member's erasure deletes their suggestions and their votes. | |
| Temp voice rooms | Kept while the room exists | Off unless a server turns on Temp Voice. For each open room, its channel and the room owner's Discord identifier; hub settings are server configuration and name no member. A room's record is deleted with the room when the last person leaves, or with departed-server data; a member's erasure removes them as room owner. | |
| Server counters | Kept while the server uses Guardy Bot | Counter settings and the last number each counter showed. This is server configuration and names no member: the member list is read in memory to count, never stored. Deleted when a counter is removed. | |
| Reminders | 30 days after the reminder fires or is cancelled | Off unless a server turns on Reminders. What the member asked to be reminded about (or the message link), their Discord identifier, the channel, and when it is due. Server admins see only counts, never the text. A member's data export includes their reminders, and erasure deletes them. | |
| Economy | Kept while the server uses Guardy Bot | Off unless a server turns on Economy. Each member's coin balance, streak, coin history and shop purchases. Coins have no real-money value and cannot be bought. A member's data export includes their balance, history and purchases, and erasure deletes them; the other member on a transfer keeps their own row without the erased person's identifier. Deleted with departed-server data. | |
| Blocked members | Kept while the server keeps the block | Which member a server has stopped taking reports or appeals from, which of the two it covers, the moderator who imposed it and the sentence they wrote. This is server configuration rather than a record of an event, so it has no expiry of its own: it ends when a moderator removes it, when the member asks to be erased, or with the departed server. | |
| Timed role grants | 30 days after the role comes off | Which role a member was given for a while, who gave it, when it was given, and what happened when it came off. A role that has not come off yet is kept until it does, at most 365 days. | |
| Saved, scheduled, auto-reply and sticky messages | Kept while the server uses Guardy Bot | The wording an administrator wrote, the channel it goes to, and when it should go out. This is server configuration and names no member: an auto-reply records how many times it fired, never who typed the words that set it off. | |
| Plan-limit usage events | 30 days | Which plan limit a server reached and whether the plans page was opened from it, with the server id and the plan in force. No member, message, channel or free-text data. Kept in Guardy Bot's own database and never sent to a third party. | |
| Homepage Discord authorization without a matching server record | 30 days | When attribution is enabled: the server ID, fixed source homepage, and authorization time only. This is not counted as a confirmed bot join and is never sent to PostHog. | |
| Homepage source for an installed server | While Guardy Bot remains installed, plus the normal 30-day departure grace period | Removed with ordinary departed-server data. A reinstall starts a new attributable lifecycle only after the previous record has been purged. | |
| Staged import rows awaiting review | Up to 30 days | A staged job expires after the administrator's review window. Active reads transition to staged or failed first. | |
| Failed import rows | Up to 7 days | Short recovery window for a failed read or apply. | |
| Successfully applied import rows | Deleted immediately | The completed job keeps aggregate counts, not staged member rows. | |
| Departed guild service data | Auto-purged 30 days after the bot leaves | Applies to ordinary XP, configuration, role-state, and import data. Narrow billing, security/audit, deletion, lifecycle, or legal evidence follows its own disclosed lifecycle and is minimized or pseudonymized where possible. | |
| Founding Member claim registry | For the life of the entitlement, including minimal anti-abuse evidence after revocation | Keeps a keyed, unreadable claimant-identity digest, claimed server identifier, claim status, and audit timestamps needed to enforce one claim per Discord identity and restore the permanent benefit after reinstall. Readable dashboard-account attribution is removed if that account is deleted. | |
Short-lived XP flush deduplication records are normally removed after 24 hours. Raw import files are discarded after parsing, and staged import rows are deleted once an apply succeeds. Billing or legally required records may follow statutory retention. Backups and in-flight queues may need a limited period to converge after deletion. Removing Guardy Bot deletes ordinary departed-server data on the schedule above, but does not delete an active Founding Member claim; otherwise Guardy Bot could not restore that promised benefit after reinstall.
Service providers and transfers
Guardy Bot uses the following provider set:
- Discord for identity, commands, events, and community interactions;
- YouTube API Services for public Creator Alerts channel and video information;
- Twitch developer services for public Creator Alerts creator and stream information;
- Kick developer services for public Creator Alerts channel identity and live status;
- Supabase for managed PostgreSQL services;
- Railway for the bot service and Redis;
- Laravel Forge on DigitalOcean (Amsterdam) for dashboard hosting;
- Cloudflare for DNS, edge security, and caching;
- PostHog EU Cloud as processor for the privacy-minimized exception monitoring described above when enabled;
- Stripe and/or Discord for paid-plan processing; and
- TypeSafe AI, OpenAI and Anthropic as AI model processors, only for servers that turn on AI features. Each processes the content described under AI features under a data processing agreement, does not use it to train models, and may keep it for a limited period (up to 30 days) for abuse monitoring under its own terms;
Primary production data region: European Union (eu-west-1, Amsterdam). International-transfer safeguards: EU-only processing; no transfers outside the EEA. Guardy Bot does not sell personal data or use it for third-party advertising.
Member rights and controls
Subject to applicable law, members may request access, correction, portability, restriction, objection, or erasure and may complain to a competent data-protection authority.
/privacy leaderboard offremoves the member's name and avatar from public web leaderboards while preserving in-server rank./data-exportprovides the supported machine-readable export, including ticket records associated with the requesting member but excluding other participants' content and internal staff notes./data-delete current-serveror/data-delete all-serversstarts an erasure workflow that removes or redacts the member's ticket content and attachment objects without deleting another participant's records.- Email support@guardybot.com for requests that self-service commands do not cover.
Security, children, and changes
Guardy Bot uses encrypted transport, encrypted OAuth tokens, restricted access to internal systems, rate limiting, default-deny database protections, secret redaction, and monitoring. Guardy Bot is not intended for anyone below Discord's minimum age or the applicable digital age. Material policy changes will update the effective date and be communicated through an appropriate Guardy Bot surface.