What the bot sees, what it keeps,
and what it never does.

The short version

• Nobody is watching your server. No person reads your channels. The bot records events so that your own moderators can look back at them.
• The operator is told when a server adds or removes the bot. That is the one thing that reaches a human automatically, and it is the same signal every Discord bot developer receives. Details below.
• Messages are archived from the moment the bot joins. Text is kept; files are kept for a short window. This is what makes "who deleted that, and what did it say" answerable. Details below.
• Nothing is sold, shared for advertising, or used to train anything.
• Any member can have their identity records erased, and any server owner can have their whole server's data purged. Details below.

When a server adds or removes the bot

Discord notifies a bot the instant it is added to or removed from a server. The bot writes that event down and sends one email to the operator (the person who runs Torvex). The email contains:

• the server's name and ID, its member count, and when it was created;
• the server owner's username and ID;
• whether the bot was added, removed, or left because the server is blocked (see Blocklist).

That is the whole message. It does not include channels, members, or any message content, and nothing is posted inside your server. It exists so the operator knows where the bot is running and can respond if a server misuses it. So if the operator ever says "I saw you added the bot" — that email is how, and it is all they saw.

The message archive

Every message sent in a server the bot is in is archived as it arrives, in every server, from the day the bot joins. This is on by default and is the foundation of the moderation log: Discord tells a bot that a message was deleted, but not what it said, so the only way to show your moderators the deleted text is to already have it.

What a message row holds: the text, the author's ID and name, the channel, the time, what it replied to, and metadata about attachments, stickers, polls and forwards (file name, size, type, and Discord's URL).

Files (attachments and stickers) are cached on disk so a deleted image can be re-posted to your log channel. By default a file is kept for 24 hours and then swept, with a size cap per server. Servers with Logging Pro keep files for 30 days; the operator's own servers keep them longer. A file's hash and metadata stay on record after the bytes are gone, so "has this exact image been posted here before" stays answerable. Your server can turn file caching off, route deleted-media re-posts to a staff-only channel, or exclude channels from being logged (excluded channels are still archived).

Edits are kept as before/after pairs. Message text is not aged out. It stays until a member asks to be forgotten, a server owner asks for a purge, or the operator removes it. Leaving the server does not purge the archive on its own, because a wiped channel is exactly the case the log exists for.

Direct messages are never archived. The bot does not read DMs; the only DMs it sends are things like verification links and race notices.

Other records the bot keeps

• Identity events — username, display-name, nickname and avatar changes; joins, leaves, kicks, bans, unbans, timeouts and role changes, with who did it and the stated reason when Discord's audit log says. Avatar images are stored so a deleted account's picture is still on file for your moderators.
• Who was mentioned in each message, so a member can find pings that were later deleted (/mentions shows a member only their own).
• Slash-command use — which command, who ran it, which options, and whether it succeeded.
• Conduct record — warnings and notes written by your moderators, and any evidence files they attach. A member can always read their own record with /warnings.
• Activity counts — one number per day, per channel, per member, and voice-channel session times. Counts only; this table never holds text. On by default; the Stats card can turn it off or exclude channels.
• Levels and economy — XP, level and message counts for leveling; balances and inventories for the games. Keyed to your Discord user ID and synced with the torvex.app games account if you link one.
• Invite attribution — which invite code each join came through.
• Security hits — when LinkGuard, the scam-image filter, the honeypot channel, AutoMod or anti-nuke acts on something: who, where, what tripped it. These are moderation events and land in your log channel too.
• Member roster snapshots (nuke recovery) and AltGuard verification — only in servers where the operator has enabled them. The verification page has its own policy describing the IP and device data it collects.
• Dashboard — logging in here uses Discord's login with the identify and guilds permissions, so the dashboard can show you the servers you manage. It keeps your ID, name and avatar in your session cookie and nothing else about you. Settings you change are stored per server.

The AI feature

When someone asks the bot's AI a question, the question, any picture the asker attached to it, and the last few messages from that channel only are sent to the model provider (OpenRouter) to produce the answer. If the question is about the conversation itself (what someone meant, a summary of the chat), the model can ask for more of that channel's recent history, up to about sixty messages. When it does, the bot first posts a "Reading the last N messages in this channel" line, so the pull is visible to everyone there. This reads Discord's own channel history, never the archive, so deleted messages and other channels are never part of it. Pictures are passed along for that one request and never stored. Other people's pictures in the channel are only noted as "an image was posted"; if the question is about one of them, the model can ask for it, the bot posts a "Looking at N pictures from this channel" line, and that picture is passed along for that one request only. Members who have opted out with /ai-privacy are never part of this, pictures included. The model never sees other channels, the archive, or any database, and the answer is posted back where the question was asked, so context can only reach people who could already read it. Any member can run /ai-privacy to be excluded from that context entirely. The bot records the cost of each request for metering; it does not keep a transcript of the conversation.

Who can see what

• Your moderators see your server's records, through the log channel and the moderation commands — and only your server's. Every record is keyed by server and every read is filtered by it, so one server's staff cannot read another server's data.
• Members can read their own warnings and their own mentions, and nothing about anyone else beyond what Discord already shows.
• The operator administers the host the data lives on and can read it for abuse investigation, support you ask for, or a purge you request. There is no routine review of any server's content.

Third parties

• Discord — the platform itself; everything the bot sees comes from Discord's API.
• OpenRouter — receives AI questions and channel context, as above.
• Resend — delivers the add/remove email to the operator.
• IPQualityScore — receives an IP address during AltGuard verification only, in servers that run the gate.
• Stripe — handles payment if a server buys an add-on, on torvex.app.

No data is sold, rented, or shared with anyone for advertising.

Blocklist

A server that uses the bot to harm people can be blocked by the operator. The bot then leaves, and that server's archived content and identity records are purged. A short operations record (that the server was blocked, and why) is kept so the block holds if the bot is re-added.

Erasure and your choices

• A member can ask a server administrator to run /msglog forget with their user ID. It deletes their identity events, stored avatars, command history and conduct record (including evidence files) in that server, or everywhere if the administrator asks for it. Their archived message text stays with the server's log, the same way a message stays in a channel after its author leaves; a server owner can request a full purge for that.
• A server owner can ask the operator to purge everything the bot holds about their server — messages, files, ledgers, settings. Reach the operator through the support server or by email (below).
• Opting out of the AI context is /ai-privacy, available to every member, no staff needed.
• Turning features off — file caching, log embeds, activity counts and every security sensor are per-server switches on this dashboard.
• Removing the bot stops all collection immediately. Existing records are not purged automatically; ask and they will be.

Changes and contact

When this page changes materially, the date at the top changes with it. Questions, data requests, or a purge:

• the support server;
• email admin@torvex.app.