1. Who this policy covers
This policy explains how the Spock Discord bot and Spock OS staff dashboard handle information for Cassienka’s NerdHQ2.0 community. The community operator is the server owner and the administrators they authorise. Contact them through the community’s existing Discord staff or support channels.
A feature processes the information described below only when it is used or enabled. The interactive preview stores its settings locally in your browser and does not access the real server.
2. Information Spock processes
| Information | Purpose |
|---|---|
| Discord user ID, display name and avatar | Identify a staff session, display the account and associate community features with a member. |
| Server membership, permission flags and, where needed, role IDs | Check dashboard clearance and apply configured server features. |
| Encrypted OAuth access/refresh tokens, session identifiers and security tokens | Maintain staff sign-in and recheck access with Discord. |
| Moderation cases, actor/target IDs, reasons, timestamps and settings history | Operate moderation and let authorised staff review decisions. |
| XP, numerical levels, imported progress, earned badges, activity counters, fictional balances, inventory, votes, giveaway entries, quotes, reminders, suggestions and invite attribution | Run the particular community feature that uses the record. |
| Birthday day and month, if you opt in | Send an annual birthday announcement. Spock does not ask for a birth year for this feature. |
| Relevant message content and attachments | Run enabled filters, commands and community features, and generate requested logs or transcripts. |
| Public Twitch stream/clip details and subscribed feed entries | Prepare the notifications configured by the server operator. |
For staff sign-in, Discord supplies basic server information so Spock can locate NerdHQ2.0 and check access. Spock does not keep a separate archive of your complete server list. The sign-in flow does not request your email, password, personal account token or permission to join servers for you.
Optional Twitch follower/subscriber totals require separate broadcaster authorisation. Spock’s counter feature uses aggregate totals; it does not provide automatic subscriber-to-Discord role linking.
3. Message content and support tickets
Achievement tracking stores counts, eligible channel IDs, local activity dates, streaks and event identifiers used to prevent duplicate credit. It does not store a copy of chat text for achievements. Reactions on messages older than 89 days are excluded; reaction deduplication records expire after 90 days. Voice progress counts eligible active minutes and maximum eligible party size, not voice audio. Spock does not make a permanent archive of every chat message. While staff logging is enabled, a rolling local cache can retain public message excerpts across restarts, for up to seven days and approximately 10,000 recent messages. Private channels, threads and age-restricted text are omitted from this cache. Enabled AutoMod, text commands, XP checks and other features inspect the content they need to operate.
If staff enable logging, observed message edits/deletions, member and role changes, moderation, channel changes, voice-state changes and other supported events are stored in the staff activity archive. Available public message excerpts can also be posted in the configured Discord log channel. Missing content is reported as unavailable. Private-channel, thread and age-restricted message text is omitted. No voice audio is recorded. Authorised staff can search retained records and export the current filtered page as CSV; access to Discord log channels depends on the server’s permissions.
Support tickets use private Discord threads. The ticket owner and authorised support staff can request a transcript covering up to the latest 500 messages. Spock generates the file for that request; it does not maintain an automatic separate transcript archive. Discord retains the original messages and any exported attachment according to its own service rules.
Suggestions, quotes, starboard highlights, giveaway results and similar community outputs can be visible to people who can access their destination channel. Do not include information in those features that you do not want shared with that audience.
Discord audit records
When the server grants View Audit Log, Spock can retain Discord audit entries, including the actor and target IDs, action, supplied reason and available changes. Administrators can request an import of the history Discord still exposes, up to 45 days. Expired records, uncaptured deleted message text and another bot’s private database cannot be recovered through this feature. Actors that Discord does not identify remain unknown. Sensitive change values are omitted and record sizes are bounded. Spock’s own command metadata and sanitised operational errors may also appear in the archive, with command arguments omitted.
4. How information is used
Information is used to provide the features you choose, verify staff access, prevent abuse, troubleshoot failures and recover bot state. Spock does not sell personal information, use community message content to train AI models, or include advertising pixels in its application code.
Server administrators decide which modules run, which existing channels receive messages and which permitted roles are used. Staff should handle any records they export in line with the community’s rules and applicable responsibilities.
5. Storage, providers and access
Administrator-authorised migrations can import Discord member IDs, exact XP, levels, message totals, achievement definitions, explicit member awards and retained source log entries. Original source metadata is retained for review. A source file that lacks member awards cannot establish who earned those awards. Import previews expire after one hour and are excluded from cloud snapshots. A database backup is created before an applied import; the operator controls separately retained migration exports and backups.
The backend uses Railway with a persistent local database. Configuration, progress, moderation cases, staff settings audits and scheduled jobs are copied to a private Supabase recovery snapshot. The full searchable activity archive and rolling message excerpt cache remain on the Railway volume and in separately created SQLite backups; they are excluded from the size-limited Supabase snapshot. Staff OAuth sessions and their tokens are also excluded from those cloud snapshots. Authorised server staff can access records through the controls their clearance permits.
The website is hosted on Cloudflare Pages. The bot and API are hosted on Railway, with private recovery storage in Supabase. Discord supplies account and server information; Twitch and configured public feeds supply their integration data. These providers may process connection metadata and maintain operational logs under their own policies. Information may be processed outside your country; the selected Supabase project is hosted in Japan.
Spock uses encrypted storage for staff OAuth tokens, HttpOnly session cookies and a separate authenticated server-to-server persistence connection. Browser database access to bot snapshots is denied. These measures reduce risk but cannot make any online service completely secure.
Read the providers’ policies where relevant: Discord, Twitch, Railway, Supabase, Cloudflare.
6. Retention and deletion
A staff dashboard session expires after seven days unless a new session is created. Expired session and temporary OAuth state records are cleared by routine maintenance. Signing out removes that local session. Your separate Discord application authorisation remains until you revoke it in Discord or it otherwise expires.
Spock’s settings audit records and searchable activity archive are pruned after 90 days by default. Administrators can choose activity retention from 7 to 365 days; routine cleanup runs hourly. The rolling message excerpt cache expires after seven days or when its recent-message limit is reached. Successful scheduled-job records are pruned after 30 days; cloud recovery copies include a shorter set of recent completed jobs. Moderation cases and feature records, such as XP, inventory, suggestions and saved birthdays, remain until the operator or the relevant feature removes them. Leaving the Discord server does not by itself erase all those records.
Birthday information can be removed with /birthday forget. Other information can be the subject of a deletion request to the operator. Copies already exported by staff, messages posted in Discord, provider logs and separately retained backups may require separate removal or expire on their own schedules. The operator may retain limited information needed to handle abuse, a dispute or an applicable legal obligation.
7. Cookies and local browser storage
The live staff dashboard uses a session cookie to keep you signed in and a short-lived cookie to protect the Discord login flow. Security tokens help prevent forged settings requests.
The preview uses browser local storage for its simulated configuration and preview activity. Use “Reset this preview” in System settings, or clear this site’s browser storage, to remove it. This preview data is not a real Discord configuration. Hosting providers may use their own security or access-control mechanisms independently of Spock’s application code.
8. Your choices and privacy requests
You can sign out, stop using optional features, remove your saved birthday, clear preview storage and revoke Spock’s authorisation in Discord’s account settings. Disabling a server module stops that feature from operating; it does not automatically erase every past record.
To ask for access, correction or deletion of information held by Spock, contact Cassienka or the NerdHQ2.0 administrators through Discord. Server members can use the community’s existing support channel. Identify your Discord account and the information or feature involved; do not send passwords or personal account tokens.
The operator may verify your identity and authority before acting. A request can be limited where it would expose another person’s private information, undermine an active abuse investigation, or conflict with a legal obligation. If you are concerned about how a request is handled, raise the concern with the server owner. Applicable privacy rights and complaint options depend on your location and the circumstances.
9. Age and sensitive information
You must meet Discord’s eligibility rules and the server’s own age restrictions. Spock’s birthday feature is not age verification. Avoid sending sensitive personal information, identification documents, financial information or private credentials to the bot or through community features.
10. Changes to this policy
The operator should update this policy when Spock’s information handling changes materially. The date at the top shows the latest version. Privacy questions and concerns can be raised with Cassienka or the NerdHQ2.0 administrators through the existing Discord staff/support channels.