Steve

Privacy Policy

Effective: 2026-07-06

This policy describes what data the Steve Discord bot and the stevebot.net website (together, "the Service") process, why, and for how long. The short version: Steve processes the minimum it needs to do moderation, keeps most of it briefly, and sells none of it.

1. Data from signing in to the website

When you sign in with Discord, we receive and store:

  • your Discord user ID, username, avatar, and email address (used to create your account and session);
  • a session cookie (used to keep you signed in — the only cookie the site sets);
  • OAuth tokens from Discord (used server-side to list the servers you manage; never exposed to the browser).

The list of servers you manage is fetched from Discord when needed and cached briefly in memory; it is not stored in our database.

2. Data the bot processes in servers

For each server where Steve is installed and configured, we store:

  • Server configuration — server ID, chosen channels and roles, thresholds, and module settings, kept while Steve is in the server;
  • Message counts — a per-member count of messages seen (no content), used to judge whether an account is established; retained 180 days from last activity;
  • Recent-activity signals — channel IDs, timestamps, and a normalized copy of recent message text used solely to detect rapid multi-channel posting and duplicate spam; retained for minutes, then deleted;
  • Pending moderation state — active warnings and moderator-approval requests, deleted when resolved or expired;
  • Moderation log — actions Steve took or would have taken (user ID and tag, action, reason, threat score), retained so server staff can review history.

Steve does not store full message archives, does not read channels beyond what Discord delivers to bots with its configured permissions, and does not use any of this data for advertising or profiling beyond the moderation decisions described here.

3. Why this data is processed

Solely to operate the Service: detecting spam/bot activity in the configured bait channel, applying the server's configured moderation rules, showing server staff what happened and why, and keeping you signed in to the dashboard.

4. Sharing

We do not sell personal data. Data is shared only with the infrastructure required to run the Service: the Discord platform itself, our hosting provider (where the bot, website, and database run), and Cloudflare (which proxies website traffic). If you choose to support the project financially, payment is handled entirely by Stripe on Stripe's site under Stripe's privacy policy — we never receive your card details. No third-party advertising or analytics services receive your data.

For aggregate site-usage statistics we run Umami, a cookie-free analytics tool, self-hosted on our own infrastructure — nothing is sent to an outside analytics company. A small sample of visits (~15%) may additionally record an anonymized session replay to help us find usability problems; replays mask typed input, are capped at five minutes, and stay on our infrastructure.

5. Retention and deletion

  • Recent-activity signals: minutes.
  • Pending warnings/approvals: until resolved or expired.
  • Message counts: 180 days from last activity.
  • Server configuration and moderation log: while Steve is in the server.
  • Website account and session: while your account exists.

Removing Steve from a server deactivates it immediately. To request deletion of a server's stored data or your website account, contact us (below) from an account that can verify ownership.

6. Security

Access to production systems is restricted; secrets (bot token, database credentials, OAuth secrets) are stored in server-side configuration, and traffic to the website is encrypted in transit. No system is perfectly secure — don't reuse sensitive information in Discord messages.

7. Children

The Service is not directed at children and requires a Discord account; Discord's minimum age requirements apply.

8. Changes

This policy may be updated. The effective date above reflects the latest revision. Continued use after an update means acceptance of the revised policy.

9. Contact

Privacy questions or deletion requests: the SteveBot Official Discord.