Privacy Policy
Effective 10 November 2026
This policy explains what the NukeBack Discord bot (including its Echo moderation features) and the NukeBack dashboard collect, why, how long it is kept and how to have it deleted. "We" means the operator of NukeBack. "Server" means a Discord server (guild) where the bot has been added.
What we collect and why
| Data | Why | How long |
|---|---|---|
| Text of messages posted in channels the bot can read, with message, channel and author IDs and timestamps | Comparing new messages with past moderator decisions, and search by meaning (/ask) | Deleted automatically after 90 days |
| Numerical representations ("embeddings") of those messages | Measuring how similar two messages are | Deleted with the message after 90 days |
| Messages that moderators acted on, with the action taken (deleted, timed out, kicked, banned, or marked fine) and the moderator's ID | Training examples that Echo's flags are based on | Until a server admin removes them or deletes all Echo data |
| Flags Echo raised and how moderators reviewed them | The review queue and accuracy statistics | Until a server admin deletes all Echo data |
| Writing-style summaries for members with enough messages (aggregate statistics such as punctuation and capitalisation habits, and an average topic vector), and Alt Radar alerts | Alt Radar, which helps moderators spot possible ban evasion | Until a server admin deletes all Echo data |
| Server structure snapshots: channels, roles, permission settings and pinned messages, plus a log of bans, kicks and channel or role changes | Raid rollback (/nukeback) | Until the server asks us to delete them |
| Dashboard sign-in: your Discord user ID, username, avatar, and the list of servers you are in with your permission level there | Signing you in and showing only servers you are allowed to manage | 7 days, or until you sign out |
We do not collect email addresses, passwords, payment details, direct messages, or voice data. We do not use analytics, advertising or tracking cookies.
How messages are processed
All language processing runs on the server that hosts the bot, using an open-source model. Message content is not sent to any external AI service. Echo only suggests actions to human moderators; it never kicks, bans or times out anyone. A server can optionally allow Echo to delete messages it is at least 90% confident about.
Cookies
The dashboard sets one cookie, nb_session, which keeps you signed in, and a short-lived nb_oauth_state cookie during sign-in to protect against forged login requests. Both are strictly necessary. The public website sets no cookies.
Sharing
We do not sell or rent personal data and do not share it with third parties, except where required by law. Data shown in the dashboard is visible only to members of that server who have the Manage Messages or Manage Server permission. Search results only include messages from channels the person searching can already read.
Your choices
- Server admins can delete individual training examples, or all Echo data for their server, from the dashboard settings at any time.
- Removing the bot from a server stops all collection there. Stored messages then expire under the 90-day rule.
- Individual members can ask for their data to be deleted or exported by contacting the bot operator on Discord. Please include your Discord user ID and the server.
Security
Data is stored in a database on the bot's host. Dashboard sessions are stored as one-way hashes, cookies are HTTP-only, and requests that change data must come from the dashboard itself.
Children
NukeBack is a Discord bot and follows Discord's minimum age requirements. We do not knowingly collect data from anyone under the minimum age in their country.
Changes
If this policy changes in a way that affects what we collect or how long we keep it, we will update the date above and announce the change before it takes effect.
Contact
Questions or requests: the bot operator on Discord.