Legal

Privacy Policy

1. Who this covers

Graffiti is a Discord bot and a web dashboard, operated by [[OPERATOR]]. This policy covers both, and two groups of people:

• Members of a server Graffiti is in. You didn't sign up for anything. An administrator of that server added Graffiti and chose which features to switch on, and what is recorded about you depends on those choices.
• People who sign in to the dashboard to configure a server they administer.

2. What is collected

Most of what Graffiti stores is Discord IDs: which user, which server, which channel, which role. The list below is complete.

When you sign in to the dashboard

• Your Discord user ID, display name and avatar URL, and your plan.
• A sign-in session: a random identifier (stored only as a one-way hash), your Discord access and refresh tokens (encrypted), and when it expires. Sessions last 14 days or until you sign out, and expired ones are deleted automatically.
• The list of servers you're in, fetched from Discord and held in memory only, for at most 60 seconds at a time. It is never written to disk.

In a server Graffiti is in

• Moderation records. For a ban, kick, timeout, warning or removed message: who it applied to and their name at the time, the moderator, the reason, the length, whether the member was told, and — for automatic actions — what triggered it, such as the link or image that matched.
• Activity counts. If activity tracking is on: a running count of your messages and seconds in voice, per server. Counts only, nothing about what you said. The server's public leaderboard shows the top members' names and avatars next to those counts; Graffiti keeps a copy of the name and avatar URL so the page can show them.
• Hall of Fame. The IDs of a starred message, its channel and author, and who starred it. References, not a copy.
• Tickets. Which channel is a ticket, who opened it, its type and number, its status, who claimed it, a closing reason if staff typed one, and when it was opened and closed. Separately, anyone a server has blocked from opening tickets, with the reason.
• Voice rooms. Which Join-to-Create room belongs to whom, and your saved preferences for rooms you create.
• Counting. The current number, who counted last, and the server's record.
• Flagged images. When a server's staff add an image to its image database: the image's fingerprints, a copy of the image file so staff can see what was added, who added it and why.
• Server configuration and its history. The channels, roles and options administrators chose, and a log of each change: who made it, when, and what changed.

If you run a custom bot

• Your user ID as its owner, the application and bot IDs, the name and status, and which servers it's installed on.
• Your bot token, encrypted before it is stored. It is never shown back, never logged and never included in an error message. Removing the bot from the last server it serves deletes the token.

3. Why it is collected

Every item exists to run a feature someone switched on. None of it is used to build a profile of you, none of it is used for advertising, and none of it is sold. There's no tracking across servers and no tracking across the web.

4. Discord sign-in

The dashboard asks Discord for two permissions and no others: identify (your ID, name and avatar) and guilds (which servers you're in, and which you administer). Graffiti can't read your direct messages, can't see your email address, and can't act or post as you. Signing in doesn't add the bot anywhere.

5. Message content

Message content is not stored. The protection features read messages in memory to check them, and the content is discarded as soon as the check finishes. Two features deliberately write content back into your own server, because that's what they're for:

• Ticket transcripts are rendered as a file and uploaded to the transcript channel the server chose. Graffiti doesn't keep a copy.
• Hall of Fame reposts a starred message into the server's Hall of Fame channel.

A mod-log entry may include a flagged image so staff can see what was removed. That entry is posted in your server.

6. Cookies and local storage

No analytics, advertising or third-party cookies. Everything stored in your browser is first-party:

• graffiti_session — your sign-in. Without it you can't stay signed in.
• graffiti_oauth — set for up to ten minutes while you sign in, to protect the sign-in from forgery.
• graffiti_flash — the confirmation message after you save something, kept for up to two minutes.
• graffiti_fallback_dismissed — only if you dismiss the "no fallback" notice: the ids of the servers you dismissed it for, kept for a year.
• graffiti-theme in local storage — only when you use the light/dark toggle.

The site's fonts are served from Graffiti's own server, so loading a page sends nothing to a font provider. Server and member avatars are loaded from Discord's image servers.

7. How long it is kept

Removing Graffiti from a server doesn't delete that server's configuration, because re-inviting is common and losing a setup to a misclick would be worse. The same goes for moderation records and activity counts. There's no automatic deletion schedule beyond these:

• Expired dashboard sessions are deleted automatically.
• Deleting a ticket deletes its record.
• Deleting a flagged image deletes its fingerprints and file; the record that it existed stays in the server's change history.
• Link-intelligence entries no public feed has listed for 30 days expire.
• Operational logs on the machine Graffiti runs on record server IDs and, where a failure involved one person, a user ID. They rotate as they grow.

Everything else is kept until it's deleted on request.

8. Who it is shared with

Nothing is sold or shared for advertising. Graffiti relies on Discord, the platform it runs on, and [[HOSTING_PROVIDER]], which runs the server its database lives on.

Graffiti downloads public threat-intelligence lists from security projects such as URLhaus and OpenPhish. These are one-way downloads: nothing about you, your messages or your server is sent to them.

Information may also be disclosed where the law requires it.

9. Your choices, and asking for deletion

If you administer a server, you can switch off any feature from the dashboard and remove Graffiti at any time. If you're a member of someone else's server, its administrators decide what's enabled there, so ask them first.

To have your data deleted, contact [[CONTACT]] with your Discord user ID. Graffiti can delete its own records, but not what has already been posted into a Discord server: transcripts, Hall of Fame posts and mod-log entries live there, and only that server's staff can remove them.

10. Children

Discord requires users to be at least 13, older in some countries. Graffiti isn't directed at children and doesn't knowingly collect anything from anyone below Discord's minimum age.

11. Changes

If this policy changes, the date at the top changes with it. Material changes will be announced in the support server.

12. Contact

Questions, or a deletion request: [[CONTACT]].

See also the Terms of Service.