Privacy Policy

The operator of Nimbus, based in Europe, is the data controller for the personal data processed through the bot and this dashboard. You can reach us at [email protected].

This policy follows the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (personopplysningsloven). Where a server administrator uses Nimbus to process their members' data (for example moderation cases or ticket transcripts), the administrator is the controller for that content and we act as a processor on their documented instructions.

Account data. When you log in with Discord we receive your Discord user ID, username, avatar and the list of servers you can manage. We never receive your Discord password. Sign-in requests the identify and guilds scopes, not the email scope. The bot API stores encrypted Discord access and refresh tokens to check your server permissions.

Server configuration. Settings your administrators save: ticket panels, automod rules and banned-word lists, leveling configuration and role rewards, giveaway and poll definitions, embed templates, log channel routing and module toggles.

Operational content. Data created when the features run: moderation cases and the moderator who filed them, ticket transcripts, giveaway entries and winners, poll votes, XP and level records, and log events the server has chosen to record. The bot also records member join/leave events, including Discord IDs, usernames and timestamps, for the server activity view, even when channel logging is disabled.

Technical data. Standard server logs — IP address, browser type, timestamps and error traces — used to keep the service secure and to debug problems.

We do not use your data for advertising, we do not build marketing profiles, and we do not sell personal data to anyone.

We only use storage that sign-in needs: a session cookie, a short-lived sign-in check cookie and a sign-in token kept in your browser (until you close it, or for up to 30 days if you choose "Stay signed in"). A few preferences are kept locally too. We use no analytics, advertising or tracking cookies. Details are on the cookie policy.

• Discord — the platform the bot runs on. Authentication and all bot actions go through Discord's API under their privacy policy.
• Cloudflare (website hosting on Cloudflare Pages, and network security) and Oracle Cloud (bot server) — they run our infrastructure and process data only on our instructions.
• Supabase — hosts the database that stores bot and dashboard records, under its data processing agreement. Website fonts are served from this site, not from Google.
• Groq (AI provider running open Llama models) — only when a server admin uses the "Help & troubleshooting" helper or an AI moderation summary. We send the problem description you type, your server's prefix and switched-on features, or a summary of recent moderation cases. We do not send passwords or sign-in tokens, and these providers do not use the data to train their models under their API terms. AI suggestions can be wrong; check them before acting.
• top.gg — when you vote there, its webhook sends your Discord user ID to the bot to record the vote and, when configured, grant a temporary reward role.

We disclose data to authorities only where the law requires it. We do not share server content with other servers or third parties.

Some of our providers (including Discord) may process data outside the EEA. Where they do, the transfer relies on an EU adequacy decision (such as the EU–US Data Privacy Framework) or the EU Standard Contractual Clauses offered by that provider. Ask us for details at any time.

• Server configuration is kept while the bot is in the server and deleted or anonymized about 30 days after Nimbus is removed from the server.
• Moderation cases and ticket transcripts are kept until the server's administrators delete them or the server's data is removed.
• XP, giveaway and poll records follow the same rule as server configuration.
• Member join/leave history is deleted after 90 days.
• Your dashboard account (Discord ID, name, avatar and encrypted Discord tokens) is kept until you ask us to delete it. Sign-in sessions end after one day, or 30 days with "Stay signed in"; signing out ends them straight away.
• Backups made by our database host roll over automatically, so deleted data disappears from them as they expire.

Under the GDPR you can, at any time:

• request access to the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict or object to processing based on legitimate interest;
• receive your data in a portable, machine-readable format (portability);
• withdraw consent where processing is based on consent.

Email [email protected] to exercise any of these. We respond without undue delay and normally within one month, with any lawful extension explained to you. You also have the right to complain to the Norwegian Data Protection Authority, Datatilsynet, or to your local supervisory authority in the EEA.

You can have your data deleted at any time:

• Your account: email [email protected] from any address and include your Discord username or user ID. We delete your dashboard account and tokens within 30 days and confirm by email.
• A server's data: remove Nimbus from the server, or have the server owner email us to delete it straight away.
• Data a server holds about you (for example a moderation case): ask that server's admins first; if they don't help, contact us.

We may ask you to confirm you own the Discord account before deleting anything.

All connections use HTTPS. Session cookies are HttpOnly and Secure, Discord tokens are encrypted before they are stored, and the database can only be read by the bot itself. No system is perfectly secure; if something goes wrong we will tell affected users and Datatilsynet as the law requires.

Nimbus is not directed at children under 13, and Discord's own minimum age applies. In Norway the age of digital consent is 13; we do not knowingly collect data from anyone below that threshold and will delete it if we learn we have.

Changes to this policy are posted on this page with an updated date. Material changes are announced through the dashboard before they take effect.

Data protection contact: [email protected].