Privacy and data
PolarSystems is self-hosted. Whoever runs a component (the operator) is responsible for the data it handles; nothing is sent to the PolarSystems project. This page says exactly what PolarBot processes, what it stores, where, and for how long, so operators can write their own privacy notice and answer their members’ questions. Today it covers PolarBot; the other components will be added as they ship.
PolarBot in short
- Messages are analysed in memory and not stored. A flagged message is shown on a mod card in the server’s log channel; that card, in Discord, is the only record.
- The only personal data kept in the database is punishment history: bans, unbans, kicks, timeouts and warnings, with the user’s and the moderator’s Discord IDs, the reason and the time. Each entry is deleted after 180 days.
- No user URL is ever fetched. Links are judged by their text. PolarBot talks only to Discord and downloads the public domain lists you configure.
- Members can see everything stored about them with
/privacy my-data(also in a DM with the bot);/privacy infosummarises this page.
What is processed in memory
| What | Why | How long |
|---|---|---|
| Message text, attachment names, mentions, the author’s account age and join date | Scanning | While the message is scanned (milliseconds) |
| Per-member fingerprints of recent messages (a 64-bit hash, channel and message ID, time; at most 32 per member and server) | Hacked-account and flood detection | Each entry 2 minutes (swept every minute) |
| The last 200 messages per channel (Discord’s own data, in the bot’s cache) | “Before/after” text of edits and deletes in the log channel | Until pushed out or the bot restarts |
| Members, roles and channels of the servers the bot is in | Permission and hierarchy checks | Until the bot restarts |
What is stored, and for how long
All of it is in one SQLite database on the operator’s machine. The complete list of tables and columns is generated from the code in Database.
| Data | Personal? | Kept |
|---|---|---|
Punishment history (mod_actions, warnings) | Yes: user and moderator IDs, reason, time | 180 days, purged every hour |
Training examples (training_examples) | No: anonymized (mentions, IDs, names, invite codes, e-mail addresses and link paths replaced); no server or user ID; the day only | Until the operator exports them (polarbot export-training), which deletes them |
/perms authorize grant (guild_oauth) | The ID of the admin who authorized; the OAuth refresh token, encrypted | Until replaced, revoked, or the bot leaves the server |
Scanner counters (scan_stats) | No: two numbers per server and day | 30 days |
Server settings, /perms roles, scanner rules, allow/block lists | No | Until the bot leaves the server |
When the bot is removed from a server, every row of that server is deleted at once, including its punishment history.
What goes to Discord
- Log channel posts. Depending on the server’s log level, PolarBot posts events (from scanner punishments at level 1 up to every message at level 10) in the server’s own log channel. They are stored by Discord like any message, under the server’s control. PolarBot does not keep them.
- Mod cards contain the flagged message’s text and its domains, so moderators can decide.
- Audit log reasons for actions the scanner takes (
PolarBot scanner: score 97).
What the operator’s system logs
The service logs to the system journal (journalctl -u polarbot). Log lines contain server,
channel and user IDs (for example “scanner flagged a message” with the author’s ID and the
score) but never message text, tokens or secrets. How long the journal keeps them is the
operator’s choice (/etc/systemd/journald.conf, MaxRetentionSec=). nginx keeps no access log
for the OAuth callback.
Outbound connections
| To | Why |
|---|---|
discord.com, gateway.discord.gg | The Discord API and gateway |
The configured threat lists and adult-site lists (by default raw.githubusercontent.com) | Downloading the domain lists, every 24 hours |
discord.com/api/oauth2/token | Only when a server uses /perms authorize |
For operators
- Point your members to
/privacy infoand/privacy my-data, and name a contact for data questions. Requests to delete an entry before 180 days go to the server’s staff, who can remove it by hand (see Database); a bot that leaves a server deletes everything of that server. - If you change retention or add logging, update your own privacy notice.