ModMailBot is intended for users and servers in the United States. It is not directed to or marketed to individuals in the EU/EEA, the United Kingdom, or Switzerland.
What we store
We follow data minimization. When ModMailBot is added to a Discord server, we store:
- Server configuration: ticket types, role and channel IDs, staff ranks, and text your administrators write: panel text, welcome messages and form questions.
- Ticket records: numeric IDs, status, and when each ticket was opened, closed and archived, and by whom (Discord user IDs).
- A block list: the Discord user IDs your moderators blocked, who blocked each, and when.
- Who added the bot: the Discord user ID of the person who added it to the server. On some servers that added the bot before version 1.3.0, it may instead name an administrator who ran one of its commands.
- Refused tickets: daily counts of why a ticket couldn't be opened, such as the member being blocked or already having one open. They hold no user IDs, and help us troubleshoot pain points for future bug fixes.
- Feature entitlements for the server.
- An audit log of what staff and admins do with the bot, and of feedback sent (below): action names, IDs, times and small details such as a count or a changed setting, never message text.
All of it is stored in Cloudflare D1, which encrypts data at rest.
The bot also keeps operational logs, which help us keep it running and fix problems: what it did and when, with server, channel and ticket IDs, and for a few actions, such as a refused command, the Discord user ID of who took it. They never hold message content, form answers or files, and they're deleted automatically within 7 days.
What we never store
We do not store the content of any Discord message. We do not store intake-form answers; they are posted into your ticket channel and exist only there. When a ticket is archived, the bot reads its messages and files in memory to build the transcript, uploads it to the archive channel in your own server, and keeps nothing on our side. We do not log message content, form text, or files.
Install links
For each install link, we keep daily counts of clicks, installs and cancelled installs, with no IP address, cookie, user ID or server ID. To credit an install to its link, we note the new server's ID with the link. Once the install is counted, we delete the note and keep only a mark that it was counted, not which link it came from. If the install is never counted, the note is deleted after an hour.
Feedback
If you use /feedback or /bugreport, the text you type (along with your Discord username, user ID, and server ID) is sent to our private support channel. It's one way: we can't reply through the bot, so if you'd like a reply, ask in our support server. The form tells you it goes with your username and ID before you send. The bot doesn't store or log what you typed. Its audit log (above) records your user ID, whether you sent feedback or a bug report, how long it was, and when. That record limits you to one every five minutes in that server, and is deleted after 180 days, or sooner with the rest of the server's data.
If you email us, your message and address stay in our mailbox at Proton so we can answer you.
Where it runs
ModMailBot and its website run on Cloudflare's infrastructure (hosting and managed databases), Discord delivers all interactions, and Proton handles our email and keeps our encrypted backups. See the subprocessor list. Data may be processed in the United States and other countries where these providers operate.
Like any website, our host Cloudflare sees your IP address and uses it to deliver and protect the site. Our code never reads or stores it. The site sets no cookies and runs no analytics or tracking scripts, so nothing follows you to other sites, and a browser's Do Not Track setting has nothing to turn off.
Retention and deletion
If the bot is removed from your server, all of that server's data is deleted from our databases after a 30-day grace period (so an accidental kick doesn't destroy your configuration). Server administrators can delete the server's data from our databases immediately with /data delete, which also deletes the bot’s panel messages in that server; operational logs (above) are deleted on their own within 7 days. Backup copies take longer to go, as the next paragraph explains.
Backups follow the 3-2-1 rule: three copies of the data, on two kinds of storage, one of them off-site. Cloudflare keeps point-in-time copies of our databases for 30 days. Every four weeks we also export the databases, encrypt the export with a key only we hold, and keep it in Proton Drive, outside our Cloudflare account. We keep the three newest exports and delete the rest, so deleted data is gone from every backup within 90 days. A backup holds only what our databases hold, so it never contains message content, intake answers or files.
While the bot stays in a server, its audit log entries are deleted after 180 days. The website deletes a server's ID and install link within about an hour (above). The daily install-link totals hold no server ID or user ID, and we keep them.
Your rights
You can ask us to show, correct or delete the data we hold about your Discord account (for this bot, that is essentially the Discord user IDs listed above) by emailing privacy@modmailbot.com, and we'll do it promptly. Server administrators can delete a server's data at once with /data delete.
Children
Discord requires users to be at least 13 (or older where local law says so). ModMailBot is not directed at children and stores no profile information.
Changes
When what we collect or how we use it changes, we'll post the change here with a new effective date. Material changes will be announced through the bot's release notes.