Privacy Policy
Overview
Ninth Bot ("the bot", "we", "us") is a Discord bot built for Ninth's community and operated by zVapor. It runs tickets, moderation, welcome messages and stream alerts inside the Discord servers that add it, and offers a dashboard at dash.ninthbot.site so server admins and staff can manage it from a browser. This website and the documentation at docs.ninthbot.site are part of the same service. This policy explains what data the bot stores, why, who can see it, how long it is kept and how to get it removed.
The bot is not a Discord product. Discord's own handling of your account and messages is covered by the Discord Privacy Policy.
What we store
The bot keeps only what its features need. Concretely:
- Discord identifiers. User ids and usernames of people who interact with the bot (opening a ticket, being moderated, signing in to the dashboard), plus server, channel and role ids. The dashboard stores your Discord id, username, display name and avatar hash in a signed session cookie for seven days; it does not store Discord access tokens.
- Moderation cases. For each warn, timeout, kick, ban, unban, note, purge or report: the case type, the reason entered by the moderator, the moderator's id, the target's id, the duration and expiry where applicable, whether the case is active, and the full edit history of the reason (old text, new text, who edited it and when).
- Tickets. The ticket number, category, status, priority, the opener's and claimer's ids, the answers given in the ticket form, the close reason, the rating the opener gave, and timestamps. When a ticket is closed the bot renders an HTML transcript of the ticket channel and posts it to a staff-only channel configured by the server; the bot keeps a link to that message, not the transcript file itself.
- Server configuration. Everything a server admin sets up: log and transcript channels, staff and admin roles, ticket categories and panels, welcome templates, auto-roles, stream alert defaults and appeal settings, together with a history of who changed which setting and when (from the bot or from the dashboard).
- Bot event log. A log of things the bot did or saw in a server (a case was created, a ticket was closed, a member joined, a setting changed and so on) with the ids of the users and channels involved, so staff can review activity on the dashboard.
- Message edit and delete log. When a server enables message logging, the bot records that a message was edited or deleted, by whom and where. The message text itself is kept for 14 days and then deleted automatically. Server admins can turn text storage off entirely (the "store message content" setting), in which case only the fact that a message was edited or deleted is kept.
- Ban appeals. The text a banned user submits through the dashboard, the server and case it relates to, its status (pending, accepted, denied) and the reviewing staff member's id and note.
- Stream alert subscriptions. The Twitch or YouTube channel handles a server follows, the public channel id, title and avatar of that creator, and when the last stream or video was announced. These describe creators, not Discord users.
The bot does not read or store the content of ordinary messages, direct messages, voice activity, email addresses, phone numbers or payment information.
Why we store it
- To run tickets, moderation, appeals, welcome messages and alerts as configured.
- To let server staff review past cases, tickets and logs and act consistently.
- To keep an audit trail of configuration changes and reason edits.
- To secure the bot and the dashboard (for example, checking who may see a server).
The legal basis under the GDPR is our legitimate interest in running a safe community service (Art. 6(1)(f)) and, for data you submit yourself such as ticket answers and appeals, the steps you ask us to take (Art. 6(1)(b)).
Who can see it
- Admins and staff of a server can see that server's cases, tickets, logs, appeals and configuration on the dashboard and through the bot's commands. Access is decided live by the bot from your roles and permissions in that server; nothing from one server is visible in another.
- The bot operator (zVapor) can access all stored data to run, debug and secure the service.
- You can see the servers you are banned from and the appeals you filed on the dashboard.
We do not sell data and we do not share it with advertisers.
Processors
| Processor | Purpose | Location |
|---|---|---|
| Hosting provider of the bot, dashboard and database | Runs the bot process and stores the database and backups | European Union |
| Discord Inc. | Delivers the bot's messages and the sign-in (OAuth2) for the dashboard | United States, under Discord's own policies |
| Vercel Inc. | Hosts this website and the docs; its servers see your IP address and browser details in short-lived request logs | Served from the EU where possible; United States company |
| Cloudflare Inc. | DNS for all three sites and the network proxy in front of the dashboard | Global network; United States company |
This website and the docs set no cookies, run no analytics and store nothing about you. Stream alerts query the public Twitch and YouTube APIs for creator information; no data about Discord users is sent to those services.
Retention and deletion
- Cases, tickets, appeals, logs and configuration are kept for as long as the server uses the bot. When the bot is removed from a server, its data can be deleted on request.
- Message text in the edit/delete log is deleted automatically after 14 days.
- Dashboard sessions expire after 7 days; signing out removes the cookie immediately.
- Transcripts posted to a server's staff channel are Discord messages owned by that server and are removed when the server deletes them.
To have your data removed, email contact@ninthbot.site from an address you can be reached at and include your Discord id. Some records cannot be erased while they are needed for moderation of a server you are banned from, but we will tell you what we kept and why.
Your rights (GDPR)
If you are in the EU/EEA or the UK you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have data erased, subject to the moderation exception above;
- restrict or object to processing based on legitimate interest;
- receive the data you provided in a portable format;
- lodge a complaint with your local data protection authority.
Use the contact below for any of these. We answer within one month. There is no automated decision-making: moderation decisions and appeal outcomes are always made by people.
Security
The dashboard never talks to the database directly; every request goes through the bot, which checks your permissions live. Requests between the dashboard and the bot are signed, sessions use signed, HTTP-only cookies, and the database is reachable only from the hosting network. No system is perfectly secure; if you find a problem, please report it to the contact below.
Children
Discord requires its users to be at least 13 (older in some countries). The bot is not aimed at children and we do not knowingly store data about anyone below Discord's minimum age.
Changes
We may update this policy as the bot gains features. The current version is always at https://ninthbot.site/privacy; the effective date at the top changes when it does. Until 19 October 2026 this page lived at dash.ninthbot.site/privacy, which now redirects here.
Contact
Operator: zVapor. Privacy questions and requests: contact@ninthbot.site. See also the Terms of Service.