Nefarious Alerts Privacy Policy

Controller: Nefarious Digital (Nefarious). Email: Business@nefarious.trading.

The wider site and Discord community are described in the site Privacy Policy. This Policy is only about the Alerts bot.

Server and feature configuration

• Configured channel ids include monitor 1504278715125993512, Zoom/alert 1511418965249888377, Apex 1483674425684529188, slime decisions 1519909922417021019, join log 909379483641987093, remarks schedule 1523132948524564590, plus role ids for pings, slime, and staff gates.
• A site integration publishes the public remarks calendar to nefarious.trading.

Stickies and message ids (alerts_state.json)

Per channel: sticky text, active flag, current Discord message id, a counter, and optional paused text. We also keep lists of processed ticker message ids and already-pinged alert message ids (ids only, capped).

Slime role snapshots

For each open decision we store the Discord message id of the decision post plus target user id, moderator id, guild id, previous_role_ids (the role snapshot used to unslime), optional latest message link, and status (pending / reverted / banned). We do not write the purged message bodies to disk.

Member profiles and impersonation checks

The bot reads member IDs, usernames, global display names, server nicknames, and roles during joins, profile changes, and periodic full-member scans. It compares names with protected staff names. Flagged records store the member ID, combined name signature, matched name, matched field and value, guild ID, and timestamp. A match can trigger automatic role restrictions, recent-message deletion, and a staff review post. Staff can review mistakes and restore permitted roles; deleted messages cannot be recovered by the bot.

Operational logs

Runtime output can include Discord usernames and IDs, invite attribution, moderator identities, matched profile names, message IDs, extracted ticker symbols, and errors. Container or host logging may retain this output separately from the state files; no fixed host-log retention period has been verified for this policy.

Ticker rows

Rolling 24-hour entries of cashtag, source message id, and seen_at. These come from tweet-bot posts in the monitor channel, not from a general member-chat archive.

Join tracking (memory, then a Discord embed)

While the process runs we cache invite code, use count, inviter name/id, and channel id. On join we post a “Member Joined” embed (mention, username, user id, invite, inviter, account age, member count) to the join-log channel. That cache is not the on-disk state file.

Early Supporter file (es_codes.json)

Operator-supplied mapping used by Nefarious Alerts only to look up Discord user id → promo code. The file may also contain Discord username, Whop user id/username, email, and promo id from the export that created it. The bot DMs the code; it does not add new emails itself.

Remarks schedule files

Per-day Discord message ids, event lines, and a content hash so we can edit one schedule message instead of spamming. Speak-alert keys record that we already pinged a role. The payload pushed to the website is the public calendar, not member profiles.

• A server-wide archive of ordinary member chat — we are not a backup bot.
• A general DM archive. Messages sent directly to the bot may still reach its command handler, and a requested Early Supporter code is sent by DM.
• Presence, online status, devices, or streaming activity.
• Payment cards or brokerage credentials. Whop handles VIP checkout.
• Advertising cookies or cross-site tracking tied to this bot.

Privileged intents: Message Content: used; Server Members: used; Presence: not used. Details: Terms, intents and /legal/nefarious-alerts/intents.

Where GDPR or similar law applies, the legal basis is in brackets.

• Keep stickies at the bottom of a channel and avoid double-pinging the same alert [legitimate interest / operating the server].
• Apply, review, revert, or record moderation decisions and detect possible staff impersonation [legitimate interest in moderation].
• Build the 24-hour cashtag digest [legitimate interest].
• Attribute joins to an invite for staff [legitimate interest].
• Send an Early Supporter code you requested with !ThankYouES [contract / your request].
• Respond to deletion or access requests and legal process [legal obligation].

We do not sell this data, do not use Discord message content to train AI or machine-learning models, and do not use it to advertise to you off Discord.

• Ticker rows: pruned against a rolling 24-hour window when message processing or history resynchronization runs. Pruning pauses while the bot is offline.
• Processed / pinged message ids: capped at 5,000 processed IDs and 2,000 pinged IDs. These are count limits, not time-based expiry; low-volume records can remain longer than 30 days.
• Stickies, slime decisions, and impersonation flags: no automatic expiry is implemented. Records remain until manually removed or the relevant state is retired. Resolving a moderation decision or leaving the server does not erase its record. Staff can remove a sticky with !stickremove; personal-data requests use the contact below.
• Early Supporter mapping: until the list is regenerated or we remove your id after a request.
• Schedule / speak state: recent days only (schedule days older than about a week are dropped; speak keys older than 14 days are dropped).
• Invite cache: in memory; refreshed periodically and discarded on process exit. Join posts and runtime logs are separate copies.
• Discord copies (pings, join embeds, stickies, slime posts): until deleted by a moderator or through Discord. No automatic expiry is configured by this bot.

We do not sell sticky text, slime snapshots, impersonation records, cashtags, join-log fields, or Early Supporter records, and we do not share them with data brokers or advertisers.

We disclose information only:

• To Discord as needed to send the messages you already see in the server (and a promo DM).
• To other members in those channels (role pings, slime lines, join embeds, leaderboards of tickers).
• To operators and hosting providers that run the nefarious-alerts process.
• To Whop when you use a promo code at checkout (their checkout, their policy).
• If required by law, or to defend a legal claim, or to stop abuse of the bot.

• Discord. Discord Privacy Policy.
• Whop (Early Supporter checkout only). Their terms and privacy policy apply when you redeem a code.
• Public remarks calendar source used for the Trump schedule. They see our server’s fetch, not your Discord identity.

Email Business@nefarious.trading from an address we can reply to and include your Discord username and user id (Discord → Settings → Advanced → Developer Mode → right-click your name → Copy User ID). Say what you want removed, for example:

• A moderation decision, impersonation flag (including stored names), or a join-log embed we control.
• Sticky text you authored, or a ticker/ping message id tied to you.
• Your Early Supporter mapping (Discord id, and any email/username sitting in that export).

We aim to respond within 30 days and comply with applicable legal deadlines. We may ask for proportionate verification that you control the Discord account; do not send passwords or tokens. We review matching state, bot-controlled Discord posts, and accessible operational logs. If limited information must be retained for a legal obligation or documented security need, we explain why. Deletion cannot restore purged messages or erase independent copies retained by Discord or other members.

If you are in the EEA, UK, or a U.S. state with a comprehensive privacy law, you may also ask for access, correction, or a portable copy of personal data we hold about you in these files. We will not discriminate against you for asking. You may complain to your local supervisory authority.

• In transit. Traffic between the bot and Discord uses TLS.
• At rest. State and code files live on the operator-controlled host for nefarious-alerts. Authorized operators can access them. The application writes JSON state without application-level encryption; host-volume encryption has not been verified in this review.
• Secrets. Bot credentials are operational secrets and are not published with these legal pages.

No system is perfectly secure. If you think data was exposed, contact Business@nefarious.trading promptly.

Nefarious Alerts is part of an adult trading community and is for users 18 or over. Discord’s own minimum age still applies. If a minor appears in our state files, contact Business@nefarious.trading and we will delete what we have.

This application uses Message Content and Server Members. It does not use Presence. Why, and the Discord form answers, are at /legal/nefarious-alerts/intents.

Discord, Whop when you redeem a code, and hosting providers may process information in countries other than yours. The bot source does not establish host location or contractual transfer safeguards. Contact us for information relevant to your request; this policy does not claim that a specific international-transfer mechanism has been verified.

We will post updates at this URL and change the “Last updated” date. If the code starts storing full member chat or Presence, this Policy will say so — we will not leave it describing a smaller store than the bot actually keeps.

Privacy and deletion: Business@nefarious.trading.