Privacy Policy

This is written from the code, not from a template. Every claim below corresponds to something that actually happens in the software — which is also why it is longer and less flattering than the usual privacy page.

1. The short version

• This website sets no cookies. None. No analytics, no tracking pixels, no external fonts, no embedded widgets, and no form to fill in. That is why you were never shown a cookie banner: there is nothing to consent to.
• The AI runs on our own machine. Messages are not sent to OpenAI, Anthropic, Google or anyone else. The model is local, and it stays local.
• We do not sell anything to anyone, and we do not use your community’s messages to train models for third parties.
• The bot does store things — levels, moderation records, and in some cases the text of a flagged message. Section 4 is the honest list.

2. Who is responsible

The data controller is Danijel Balcakovic, an individual based in Switzerland. Privacy questions go to info@acev.net — a real address, read by a person, not a form that goes nowhere.

There is a split worth understanding. For your Discord server, you are the one in charge. You decide to add the bot, which features to switch on and which channels it can see; we process that data on your instructions. For the things the bot does for itself — keeping the spam and phishing detectors working, keeping the service running — we are the controller.

3. This website

When you load a page, our server writes a line to a log file: your IP address, the page you asked for, the time, the result, and your browser’s user-agent string. That is used to keep the site working and to see when someone is attacking it. It is deleted after 14 days.

Nothing else happens. There is no cookie, no local storage, no session, no login, no analytics script, no font loaded from Google, no embedded video or map, and no route on this site that accepts anything you type. The player counter on the home page asks our own Minecraft proxy on the same machine and tells it nothing about you.

4. What the bot stores

The bot only sees a server after someone with the right to do so adds it. What it keeps depends on which features that server has switched on.

Identifiers, always

Your Discord user ID and username, plus the IDs of the server, channel and message involved. Discord IDs are public numbers, but they identify you, so they count.

Activity, if the relevant feature is on

Experience points and levels, message and voice-time counters, economy balances, warnings and moderation history, tickets you opened.

Message content, in four specific cases

• A message flagged as spam: the text is stored so a human can later confirm or reject the verdict.
• A message flagged as phishing: the text and the suspicious link.
• A message removed by AI moderation: the text, with the reason.
• A ticket you opened, including what you wrote in it.

Tickets have one extra step worth knowing about: when a ticket is closed, the whole conversation is saved as a transcript file and posted back into Discord — once into the staff channel, and once as a direct message to whoever opened it. Both copies then live in Discord, under Discord’s rules, and section 6 applies to them.

Ordinary conversation is not stored. If nothing flags your message, no copy of it is written anywhere by us.

Things the AI works out about you

If your server runs the AI chat companion and you talk to it, it remembers a handful of facts so the next conversation is not from zero: the name you prefer, games you play, roughly where you are from, your rank in a game, and sometimes your age if you have mentioned it. You can see and erase this at any time — see section 10.

5. The AI, and where it runs

This is the part most bots are vague about, so to be exact: the language model runs on the same machine as the bot, reachable only on that machine’s own loopback address. No message, no image and no username is sent to an external AI provider. There is no API key to OpenAI, Anthropic or Google anywhere in the code, because there is no call to make.

While a conversation is running, the AI is given your message, up to three recent messages from the channel for context, and the message you replied to. That context lives in memory only and is dropped ten minutes after the channel goes quiet. If you post an image and the AI is asked to look at it, the image is fetched, described, and thrown away — only the short description is kept in the running process.

The spam, phishing and moderation detectors learn from corrections. When a moderator marks a verdict as wrong, the example feeds back into the detector so it does better next time. That improves the system for everyone using the bot, which is a real benefit and also a real trade-off: it means a corrected example is not confined to the server it came from. Section 8 says how long any of it lasts.

6. Moderation log channels

If a server switches on moderation logging, the bot posts what it did into the log channel that server chose — and for a deleted message, that post includes the text of the message.

Once that post exists it is an ordinary Discord message in someone else’s server. It is visible to whoever can read that channel, it stays there until a moderator deletes it, and we cannot remove it for you. If you want that copy gone, ask the server’s moderators, or Discord.

7. Who else sees any of it

This is the complete list. Two of them are involved always; the other two only if your server switches on the feature that needs them.

Discord Inc. — United States

The platform the bot runs on. Every message, id and username reaches us through Discord. Their privacy policy.

Hetzner Online GmbH — Germany

The dedicated server that runs the bot, the database and this website. Their privacy policy.

Valve Corporation (Steam) — United States, only if the CS2 tracker is switched on

Only if a server uses the CS2 tracker, and only for the person who links their own account: the Steam name or ID they typed is sent to Steam to look up their profile and stats. Their privacy policy.

Twitch Interactive (Amazon) — United States, only if stream notifications are switched on

Only if a server uses stream notifications: the Twitch channel names an admin added are sent to Twitch to check whether they are live. No member data is sent. Their privacy policy.

Discord is unavoidable: it is the platform, and everything reaches us through it, under their privacy policy, which covers far more than we ever see.

When paid plans open, Paddle.com Market Ltd will be added to this list as the payment provider. They will hold your billing details; we will only ever see which server has which plan.

We do not use an advertising network, a data broker, an analytics company, or an external AI provider. If that ever changes, this list changes first.

8. How long we keep things

What	How long
Website access logs (IP, page, browser)	14 days
Bot server logs	14 days
Text of flagged spam, phishing and moderation incidents	90 days
What the AI chat remembers about you	90 days from the last time it was confirmed
Ticket transcripts	90 days after the ticket is closed
Levels, economy, counters, server settings	While the bot is in the server
Everything belonging to a server, after the bot is removed	30 days, then deleted
Detector accuracy figures with no message text in them	Kept — they are counters, not content

The 30-day window after removal exists so that kicking the bot by accident, or during a server reshuffle, does not wipe a year of levels. Ask us and we will delete it sooner.

9. Why we are allowed to

• To provide what was asked for. A server admin turned a feature on; running it is the whole point.
• Legitimate interest for keeping the service up, stopping spam and phishing, and defending against attacks. Protecting a community from scam links is exactly the kind of interest the rule was written for.
• Contract, for anything to do with a paid plan.
• Consent, where a feature is genuinely optional and you switched it on yourself.

10. Your rights

If the GDPR, the UK GDPR or the Swiss FADP applies to you — and between them they cover most people reading this — you can ask for a copy of what we hold, ask for it to be corrected, ask for it to be deleted, ask us to stop, and object to processing based on legitimate interest.

Write to info@acev.net with your Discord user ID (right-click your name, Copy User ID) and, if it concerns one server in particular, that server’s ID. We answer within 30 days. We do not charge for it, and we do not ask you to explain why.

One honest limit: we identify you by your Discord ID, so we will act on a request that comes from the account that owns it. We are not going to demand a passport scan — asking for more identity documents than we hold would make things worse, not safer.

If we get it wrong you can complain to a supervisory authority: in Switzerland the FDPIC, in the EU or the UK the authority where you live.

11. Children

Discord requires its users to be at least 13, and more in some countries. We rely on that and do not run our own age check. We do not knowingly build profiles of children, and we do not advertise to anyone.

If you are a parent and believe we hold something about your child, write to info@acev.net and we will delete it without arguing about whether we had to.

12. If you run a server

Adding the bot makes you responsible for your members’ data in your community. Two things follow, and they are not difficult:

• Tell your members the bot is there and what it does — a line in your rules channel linking to this page is enough.
• Only switch on what you need. Every feature you leave off is data that is never collected, which is the one form of data protection that cannot fail.

If one of your members asks you to delete their data, you can do it yourself with the bot’s own commands, or send them — or us — to the address above.

13. Changes

When this page changes, the date at the top changes with it. If a change means we start doing something materially new with your data, we will say so in the support server rather than hoping you re-read the page.

Companion documents: the Terms of Service and the Refund Policy.