This policy describes the data collected by TookBot ("the bot"), a Discord bot operated by Axhel in a personal capacity, hosted on a VPS in Europe. We commit to using this data only to run the bot, with no resale and no advertising.
1. Data collected
1.1 Data automatically collected through Discord
When you use TookBot in a server where it is present, the bot collects:
- Discord identifiers (user ID, server ID, channel ID)
- Discord username and avatar (public URL)
- Message content only in the following cases:
- Messaging XP calculation (the content is not stored, only the XP increment is)
- Administrative logs: the content is saved when you delete or edit a message (visible only to the bot administrator and to the moderators of the server concerned)
- Voice events: join, leave, move between voice channels (no audio recording)
- Server events: members joining and leaving
- Slash commands you run: the command name and the arguments provided
1.2 Data via OAuth (web dashboard)
If you sign in to the dashboard through Discord OAuth, the bot receives, via the identify and guilds scopes:
- Your Discord user ID, global username, avatar URL
- The list of Discord servers you are in (along with your permissions on each)
No email address, no Discord password and no user Discord token is sent to us or stored.
1.3 Direct messages (DM)
Direct messages you send to the bot are not stored and cannot be read from the dashboard. The bot can technically receive a DM (Discord delivers the message to it), but no copy is kept and no interface lets the administrator read them back. By Discord's design, the bot also cannot access DMs exchanged between two users.
2. Purposes
The data above is used only to:
- Run the bot's commands (music, duels, XP, auto-reactions, moderation)
- Show statistics and leaderboards to server administrators
- Keep an audit trail of moderation actions and server events
- Allow secure sign-in to the admin dashboard
No data is resold, shared with third parties, or used for advertising or profiling.
3. Hosting and security
- Storage: local SQLite database on a Hetzner Cloud VPS (Falkenstein, Germany — EU).
- Backups: encrypted daily snapshots, kept 14 days locally + 30 days offsite.
- Access: restricted to the bot owner and the moderators of the servers concerned (via Discord OAuth and server permissions).
- Transport: HTTPS (Let's Encrypt) across the whole dashboard.
4. Data retention
- Event logs: 90 days maximum, or 5000 entries per server (whichever is stricter).
- XP / level: kept as long as your account is active on a server where the bot is present.
- Duel profile (sabers, wins): kept globally, with no expiry.
- Direct messages to the bot: not kept (the DM read/send feature was removed from the dashboard).
5. Your rights (GDPR)
You have the rights of access, rectification, erasure, portability and objection over your data. To exercise these rights:
- Send a direct message to the bot containing the word "GDPR" along with your request, OR
- Contact the administrator of the server you are in directly.
To erase all your data: simply leave the servers where the bot is present and send a "DELETE ME" DM to the bot. Your entries will be purged within 7 days.
6. Cookies (web dashboard)
The dashboard uses a single session cookie (session) to keep you signed in. It is HTTP-only, SameSite=Lax, Secure (HTTPS) and expires after 24 hours. No third-party cookie, no analytics tracker, no advertising.
7. Minors
TookBot is used as part of normal Discord usage, whose minimum age is 13 (16 in the EU depending on the country). If you are under the required age, do not use this service.
8. Changes
This policy may change. The last update date is shown at the top of the page. Substantial changes will be announced through a message in the servers hosting the bot.
9. Contact
For any question: DM the bot or contact the administrator directly on Discord.