CortexGuard keeps as little as it can, sells nothing and stores no message history. This page explains what is processed, why, for how long, and how to exercise your rights under the GDPR.
1. Who is responsible
The service is operated by YaKuカaa (the “Operator”, “we”). Contact for any privacy matter: My Discord: yakuzaa.x (Please state the reason for your request when adding me as a friend.)
Roles differ by data. For the moderation data of a server (warnings, sanctions, captcha, settings), the server owner and administrators decide why and how it is used and are the controller; the Operator acts as their processor under the Data Processing Terms. For everything the Operator decides itself (capacity management, waitlist, saved profiles, abuse prevention, bug reports, website logs, security), the Operator is the controller.
2. What we process, why and for how long
Nothing is processed for advertising, profiling, analytics or sale.
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Server configuration — server ID and module settings (sensitive values encrypted) | Run the modules the server administrators enabled | Art. 6(1)(b) contract with the server administrator; 6(1)(f) | Until 30 days after the bot leaves the server |
| Moderation records — user ID, server ID, type, date, reason and moderator ID (both encrypted) | Warnings, sanctions and /history on behalf of the server | Art. 6(1)(f) legitimate interest in keeping communities safe | Warnings: until cleared, or auto-deleted after the delay chosen by the server if Warn Expiry is on (default 90 days). Sanctions: until cleared on request. Maximum 1,000 of each per member per server. Deleted 30 days after the bot leaves |
| Captcha session — server ID, user ID, code (encrypted), attempt count | Verify a new member | Art. 6(1)(f) | Deleted on success, timeout or when the member leaves |
| Request statistics — server ID, server name, member count and, for each hour, how many messages were scanned, commands or buttons used and members joined (no user IDs, no message content) | Spot servers that overload the bot, plan capacity and detect abuse | Art. 6(1)(f) | 7 days, purged automatically; deleted 30 days after the bot leaves |
| Shared-ban entry — banned user ID, reason (encrypted), origin server ID, moderator ID (encrypted), date | Mirror bans between servers of the same group | Art. 6(1)(f) protection of communities against abusive accounts | Until unbanned, removed on request, or the group is deleted |
| Saved profile — owner user ID and a copy of the portable settings (encrypted) | /save and /restore | Art. 6(1)(b), at the owner's request | Deleted after 365 days without use, or on request |
| Structure snapshot — server ID, server name and icon, roles (name, permissions, position, member IDs) and channels (permission overwrites, categories). Encrypted | /snapshot and recovery after an attack, on behalf of the server administrators | Art. 6(1)(b) contract with the server administrator; 6(1)(f) | 4 most recent versions kept (one about every 3 hours while enabled; replaced as new ones are taken); up to 40,000 member IDs each. Deleted 30 days after the bot leaves |
| Raid sanction journal — server ID, user ID, action taken (ban, timeout…), raid batch, date | /undo-raid | Art. 6(1)(f) | 7 days, purged automatically; deleted 30 days after the bot leaves |
| Waitlist — server ID, server name, owner ID | Queue when the bot is at capacity | Art. 6(1)(f) | Until activation or removal of the bot |
| Departure marker — server ID and date | 30-day grace period before deletion | Art. 6(1)(f) | 30 days |
| Report cooldown — user ID and timestamp | Limit /report abuse | Art. 6(1)(f) | Purged automatically, within about a day after the cooldown |
/report message — your text, Discord name and ID, server name and ID, channel | Handle the bug or abuse report | Art. 6(1)(f); you choose to send it | Sent by direct message to the developer, not stored in the database. Kept up to 12 months, then deleted |
| Website server logs — IP address, browser, date, page requested | Deliver and secure the website | Art. 6(1)(f) | Set by the hosting provider, maximum 30 days |
Message content is read in memory to detect spam, links, banned words and similar abuse, then discarded. It is never written to our database. Two exceptions sit on Discord, not with us: the server’s moderation log channel, and the preview shown in the staff channel when a member uses “Report to Staff”. Both belong to the server and are governed by its administrators and by Discord.
Encryption. Sensitive fields are encrypted at rest with AES-256-GCM. Identifiers needed to look records up (server ID, user ID) are stored in clear. The database is copied daily, each copy is integrity-checked, and the 7 most recent copies are kept, so deleted data leaves backups within about a week.
3. What we do not collect
- Usernames, display names, avatars or email addresses (except what you write in
/report) - Message history, voice or video data
- Bot users’ IP addresses or device information
- Analytics, advertising identifiers or telemetry of any kind
4. Who receives data
- Discord Inc. — the platform itself delivers events to the bot and receives its actions. Discord is an independent controller under its own privacy policy.
- Hosting provider — hosts the bot and this website as our processor.
- Servers of a shared-ban group — receive the banned user ID and origin server when a ban is mirrored; the reason is stored for the group.
- Authorities — only where the law legally compels disclosure.
We never sell, rent or share data with advertisers, data brokers or analytics providers.
5. International transfers
Discord Inc. is based in the United States and relies on recognised transfer mechanisms (such as the EU–US Data Privacy Framework or Standard Contractual Clauses). Our hosting provider is located in France. Where data leaves the European Economic Area, we rely on an adequacy decision or Standard Contractual Clauses.
6. Automated decisions
Modules such as Anti-Raid, Anti-Spam, Automod, Anti-Nuke and Captcha can warn, time out, kick or ban automatically. Server administrators choose which modules run, their thresholds and their actions. Such sanctions are decisions of the server, not of the Operator. To contest one, contact the server’s staff: they can review, unban or clear records. We can assist administrators in doing so.
7. Your rights
Under the GDPR (and the UK GDPR where applicable) you have the right to access your data, have it rectified or erased, restrict or object to its processing on legitimate-interest grounds, and receive it in a portable format.
How. Write via the support server with your Discord user ID, so we can find your records. We may ask you to prove you control the account. We answer within one month (extendable by two months for complex requests, with notice). Requests are free unless manifestly abusive.
Server members. Because the server is the controller of its moderation data, you may also address your request to its administrators. If you send it to us, we will act on it or forward it.
Complaints. You may lodge a complaint with your data protection authority, for example the CNIL in France (cnil.fr); the full list is at edpb.europa.eu. We would appreciate the chance to fix the issue first.
8. Minors
The service is not directed at children under 13, and you must meet Discord’s minimum age in your country to use Discord. We do not knowingly collect data for profiling minors. To request deletion of a minor’s records, contact us.
9. Security and breaches
Measures include AES-256-GCM encryption of sensitive fields, no externally exposed database interface, write-ahead logging for integrity, and least-privilege access. No system is perfectly secure. If a breach is likely to put your rights at risk, we will notify the competent authority within 72 hours where required (Art. 33) and affected server owners without undue delay.
10. Cookies and similar technologies
This website uses no cookies, no local or session storage, no tracking pixels, no analytics and no advertising. It loads no third-party resources: fonts, scripts and images are served from this site, so your browser contacts no one else when you read these pages. Because nothing non-essential is stored or read on your device, no consent banner is required (ePrivacy Directive, Art. 5(3)). If this ever changes, we will ask for your consent first and update this section.
Links to Discord, top.gg, Discord Bot List and other sites open third-party services with their own cookies and policies; they are outside our control.
11. Changes
We will update this policy when the service or the law changes and change the date above. Material changes are announced in the support server and in the bot’s update notes.
12. Contact
My Discord: yakuzaa.x (Please state the reason for your request when adding me as a friend.).