Privacy Policy

1. Introduction

Thrella ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Discord bot and web dashboard.

We comply with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable data protection laws.

2. Information We Collect

2.1 Discord Data

When you add Thrella to your Discord server, we collect:

• Server Information: Server ID, name, member count, owner ID
• User Information: User IDs and usernames of users involved in a moderation event, captured at the time of the event so records stay readable (we do not store a full member roster)
• Message Content: Analyzed in real-time to detect scams, phishing, and malicious links. Message content is stored only when it is tied to a moderation event - specifically (a) messages that trigger a security or AI detection, (b) the message that triggers a moderation case, and (c) message edits and deletions in channels where audit logging is enabled, where we record the before/after or deleted content (up to 4,000 characters). We do not archive general message history.
• Profile Picture (Avatar) Data: We analyze member avatars to detect known scam and impersonation images. For avatars that are flagged or blocked, we store an image fingerprint and the avatar's Discord URL. We do not store copies of avatar images.
• Moderation Data: Case details, reasons, evidence URLs, appeal text, timestamps
• Security Logs: Detected scam links, blocked content, timestamps

2.2 Dashboard Authentication

When you log into our dashboard via Discord OAuth:

• Discord user ID, username, avatar
• Your email address - we request the email permission as part of Discord login. If your Discord email is verified, we receive it (used only to send appeal update emails - see Section 2.5)
• List of servers you manage
• Your roles in those servers (for permission checking)

2.3 Subscription and Billing

For paid subscriptions:

• Stripe customer ID and subscription ID (not payment details)
• Subscription tier, billing cycle, and renewal date
• Payment status (success/failure) for enforcement purposes

Note: Payment information (credit card details) is handled entirely by Stripe and never stored on our servers. See Stripe's Privacy Policy for details.

2.4 Technical Data

• IP addresses (from server logs, retained for 7 days)
• Browser user agent (for analytics)
• Error logs and performance metrics

2.5 Appeal Notification Email

We request access to your email address as part of signing in with Discord. When you submit an appeal, we store your (verified) email alongside that appeal so we can notify you by email when a staff member replies or a decision is made. Every email includes a one-click unsubscribe link, so you can stop these emails at any time, and the address is removed if your data is erased (see Section 13). If your Discord account has no verified email, none is stored and you will not receive these emails. We use this address only for appeal notifications and never for marketing.

3. How We Use Your Information

We use collected information to:

• Provide security and moderation services
• Detect and block malicious content
• Process moderation actions and maintain case records
• Authenticate users for dashboard access
• Process subscription payments and enforce tier limits
• Send notifications about moderation actions and enforcement
• Send email notifications about your appeals (you can unsubscribe from these at any time)
• Improve our detection algorithms and service quality
• Comply with legal obligations

4. Data Retention

We retain data as follows:

• Moderation Cases & Appeals: Retained for the lifetime of the case so that bans/mutes remain reviewable and appealable
• Appeal Notification Email: Stored with the appeal and removed when the appeal data is erased or anonymized
• Email Unsubscribe List: If you unsubscribe from appeal emails, we keep a record of your opt-out so we continue to honor it
• Scam / Security Detection Logs: Retained for 180 days, then automatically deleted
• AI Scan Logs: Retained for 90 days, then automatically deleted
• Audit Logs: Retained for 90 days, then automatically deleted
• Blocked Avatar Hashes: Retained while the avatar remains on a server's or the global block list
• Cached Message Content: A short-lived cache used only to reconstruct edited/deleted messages, automatically expiring after 2 to 48 hours depending on plan tier
• Other Cached Data: Seconds to minutes (configuration, AI results), automatically expires
• Server Logs: 7 days (Nginx/application logs)

When the bot is removed from a server, we mark it as inactive but retain data for 30 days to allow re-invitation. After 30 days of inactivity, all data except subscription records (for billing) is deleted.

5. Data Sharing and Disclosure

5.1 Third-Party Services

We share data with the following service providers:

• Discord: Bot operates via Discord API, subject to Discord's Privacy Policy
• Stripe: Payment processing (subscription ID and status only)
• Hetzner: Server hosting (EU-based infrastructure)

5.2 Legal Requirements

We may disclose your information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to prevent harm or illegal activity.

5.3 No Selling of Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

6. Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for stored data and database backups
• Secure authentication (Discord OAuth 2.0)
• Private, access-controlled infrastructure
• Role-based access control (RBAC)
• Regular security audits and updates
• Input validation and SQL injection prevention

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

7. Your Rights (GDPR)

Under GDPR and similar laws, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten"). On request, we run a tool that anonymizes and removes your personal data across all records - moderation cases, appeals, audit logs, security and AI scan logs, and case evidence - in a single transaction, scoped to a single server or applied across all servers (see Section 13)
• Portability: Request your data in a machine-readable format
• Restriction: Request limitation of processing
• Objection: Object to certain processing activities
• Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us via our support server or by email at [email protected]. We will respond within 30 days.

8. Data Processing Basis

We process your data under the following legal bases:

• Contractual Necessity: To provide bot services and execute subscriptions
• Legitimate Interests: To improve security, prevent fraud, and maintain service quality
• Legal Obligation: To comply with applicable laws and regulations
• Consent: For optional features like advanced logging (where applicable)

9. Cookies and Tracking

Our dashboard uses essential cookies for:

• Authentication sessions (NextAuth.js)
• Security (CSRF protection)
• Preferences (theme, language)

We do not use tracking cookies for advertising or analytics. You can clear cookies via your browser settings.

10. Children's Privacy

Thrella does not knowingly collect information from children under 13 (or 16 in the EU). Discord's Terms of Service require users to be at least 13 years old. If we become aware that we have collected data from a child under the minimum age, we will delete it promptly.

11. International Data Transfers

Your data is stored on servers located in the European Union (Hetzner, Germany). If you access Thrella from outside the EU, your data may be transferred to and processed in the EU. We ensure appropriate safeguards are in place for such transfers.

12. Data We Do NOT Collect

For transparency, we explicitly do NOT collect or do:

• Payment card information (handled by Stripe)
• A general archive of all messages (we store message content only when it is tied to a moderation event - see Section 2.1)
• Private/direct messages, except messages you send directly to the bot for support purposes
• Presence data (online status, activities)
• Voice chat data
• Precise geolocation data
• Biometric data
• We do not use your message content to train machine learning or AI models

13. How to Delete Your Data

You can request data deletion by:

• Remove the bot: Removing Thrella from your server marks it for deletion after 30 days
• Request erasure by Discord ID: Contact us via our support server or by email at [email protected] and provide your Discord user ID. We will anonymize and remove your personal data across all records - moderation cases, appeals (including any appeal notification email), audit logs, security and AI scan logs, and case evidence - scoped to a single server or applied across all servers
• Dashboard: Server owners can request data export or deletion from the dashboard

We will action your request within 30 days, except where retention is required by law or for legitimate business purposes (e.g., active subscriptions, fraud prevention). Note that erasing your data does not by itself lift an active moderation action (such as a ban); the underlying decision stands.

14. Changes to Privacy Policy

We may update this Privacy Policy periodically. We will notify you of material changes via:

• Dashboard announcement banner
• Discord DM to server owners (for significant changes)
• Support server announcements

Continued use after changes constitutes acceptance. The "Last Updated" date at the top indicates the most recent revision.

15. Your Choices and Controls

You can control your data by:

• Disable features: Turn off logging, appeals, or other data-collecting features via dashboard
• Limit retention: Request shorter log retention periods (contact support)
• Access your data: View all cases, logs, and settings in the dashboard
• Remove the bot: Complete data deletion after 30-day grace period

16. Contact & Data Protection Officer

For privacy-related questions, data requests, or to exercise your rights, contact us via our support server or by email:

discord.gg/uRSU3eKsdz

Email: [email protected]

17. Discord's Privacy Policy

Thrella operates as a Discord bot and is subject to Discord's Privacy Policy and Terms of Service. Discord may collect additional data through their platform. Please review Discord's privacy practices at:discord.com/privacy

18. Supervisory Authority

If you are located in the EU/EEA and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority.