Nefarious Backup privileged intents

• Message Content: required. Required to read ordinary source-channel message text, embeds and attachments for history backup and webhook mirroring, and to parse ?backup commands. Slash commands would replace operator commands but would not supply the historical community messages being backed up.
• Server Members: optional, currently off. Currently disabled in the deployed configuration. Request Server Members only to enable complete member-state snapshots through fetch_members. That feature records IDs, usernames, nicknames and role assignments for members with a nickname or extra roles. The current fallback records message authors with no role assignments; role definitions and bans alone do not require this intent.
• Presence: no. Online status, activities and streaming presence are not used by the backup workflow.

What does your application do?

Nefarious Backup is an internal disaster-recovery application for the Nefarious Discord. Only allow-listed operators can run its ?backup commands.

It reads configured text-channel history into a durable archive on operator storage and mirrors the content to a backup Discord server through webhooks, preserving author display names and avatar URLs. Scheduled daily jobs save snapshots before continuing the mirror. Stored fields include message IDs, timestamps, content, embeds, author ID/name/display name/avatar, image attachment metadata and downloaded images. Non-image attachment filenames are recorded, but those files are not downloaded by this serializer. Snapshots also contain role definitions and ban records.

Complete member nickname and role snapshots are optional and currently disabled. Without Server Members, member rows are inferred from message authors and contain no role assignments. Operators can restore saved messages and supported guild metadata to the backup server; it is not an exact server clone. Configured categories are excluded and selected high-volume channels keep the latest 250 messages in the active archive. Historical snapshots may contain earlier data.

Privacy Policy

https://www.nefarious.trading/legal/nefarious-backup/privacy

Terms of Service

https://www.nefarious.trading/legal/nefarious-backup/terms

Add the public policy URLs to the application’s Developer Portal settings. A live website policy does not establish that the profile fields have been updated.

Why is Message Content required?

The application's disaster-recovery function needs ordinary message content from configured Nefarious text channels. It reads channel history, stores message text, embeds and image attachment metadata in a local archive, downloads supported images for snapshots, and reposts backed-up content through webhooks into the backup guild.

Members do not invoke the bot when posting those messages. Slash commands, context menus and mention-only access cannot provide the historical or unmentioned messages required for this workflow. Prefix commands such as ?backup status and ?backup snapshot also use message content, but command parsing is not the principal justification.

Without Message Content access, ordinary messages outside Discord's exceptions omit content-bearing fields, preventing faithful text and attachment backup. The application does not use this content for AI training, advertising or resale. It does not back up DM history.

Can users opt out?

No automated per-user opt-out. There is no in-bot per-user exclusion. Contact Business@nefarious.trading to request deletion or a collection restriction. Operators can exclude channels or categories from future collection. Leaving the server does not erase historical copies or prevent accessible old posts from appearing in a later history scan. Requests require manual handling across the archive, snapshots, images and backup Discord copies.

Do you store message content off-platform?

Yes.

Yes. A durable SQLite archive and JSON exports on operator storage contain message text, embeds, message and author IDs, usernames, display names, avatar URLs, timestamps and attachment metadata. Snapshot folders also contain downloaded images, role definitions, ban records and available member rows. The backup Discord guild holds a separate mirrored copy. Snapshot rotation does not expire the durable archive.

Is message content used for AI training?

No.

Request this only if complete member nickname and role backup is a feature being enabled and demonstrated. The deployed configuration currently disables enumeration; do not describe it as active.

Use this answer only if applying to enable the currently disabled complete member-state backup feature.

With ENABLE_MEMBERS_INTENT enabled, snapshot_guild_metadata enumerates guild members through fetch_members and records Discord user ID, username, nickname and role IDs for members with a nickname or non-default roles. Restore uses these records to attempt nickname and role restoration for users present in the destination guild.

The currently deployed setting is false. The current fallback creates rows from message authors, with display-name-derived nicknames and empty role lists. It cannot preserve every member or their assigned roles. Reading role definitions and bans alone does not justify Server Members. We do not use Presence.

Member-data opt-out

Complete member enumeration is currently disabled. There is no automated per-member exclusion if it is enabled. Privacy requests go to Business@nefarious.trading and require manual handling of retained copies. Leaving does not automatically remove earlier records.

After approval, enabling this feature requires a deployment change and a demonstration of the resulting member snapshot and supported restore. This audit did not change the bot configuration.

Do you store API Data off-platform?

Yes.

Is all stored API Data retained for 30 days or less?

No. The historical archive has no automated age-based expiry and can retain content older than 30 days. The configured rotation retains four successful snapshot folders, counted by completed runs rather than weeks or message age. Partial snapshots and legacy migration copies are outside that rotation. Backup Discord messages and runtime mappings can remain until operator removal. A recent snapshot can contain years-old messages.

Encryption at rest

Checked September 19, 2026: the primary archive dataset is encrypted, but legacy storage and container logs remain unencrypted. Container JSON logs have no configured rotation limits. Do not select Yes for encryption of all stored API data until storage and log remediation is verified.

Deletion requests

Business@nefarious.trading. Requests require manual processing across all retained copies.

Open the source Nefarious server. Discord links require the reviewer to have access. A server link alone is navigation and does not prove a successful backup.

• History collection: configured text-channel history is serialized into a durable message archive. Saved fields include content, embeds, author display data and image attachment metadata.
• Backup output: webhook mirror jobs read the archive and repost supported content in the destination server. Display names and avatar URLs come from the archived author data; mentions are disabled.
• Daily snapshots: scheduled runs save channel JSON and image files before mirroring. Successful snapshots rotate by count; the historical archive and legacy copies have separate retention behavior.
• Operator controls: deployed commands include ?backup status, ?backup list, ?backup snapshot, ?backup mirror and ?backup load. These require an allow-listed user ID.

The Evidence page includes inspected snapshot manifests and an operator workflow example. For an end-to-end delivery demonstration, pair a permitted source message with its real destination copy and capture an actual operator status or snapshot result. Include message links and the capture date. Any HTML rendering must be identified as a reconstruction; it is not a Discord screenshot. This page does not claim that a completed member enumeration was observed.

Verify destination access controls, encryption for each retained storage copy and a working deletion process. Confirm the scope and retention of historical collection with Discord where necessary. Publishing legal wording does not by itself establish compliance or guarantee intent approval.

Reference: Discord’s privileged intent documentation and Developer Policy.