Nefarious Backup Privacy Policy

Controller: Nefarious Digital (Nefarious). Email: Business@nefarious.trading.

The wider site and community are described in the site Privacy Policy. This Policy is only about the backup bot.

This Policy applies when:

• you post in a Nefarious Discord text channel the bot is configured to copy;
• you are a member whose nickname or roles are included in a weekly guild snapshot;
• you are on the operator allow-list and run a ?backup command;
• your Discord user id appears on the source guild’s ban list (ban reason is stored).

The bot does not read DMs, voice, or servers it is not configured for. Some categories are excluded from copy. Some channels keep only the latest 250 messages.

A. Message content — off-platform weekly snapshots

Yes, we store message content outside Discord. Each weekly run writes per-channel JSON under the stack’s data directory (data/snapshots/…/channels/) with:

• message id, created time, edited time, pinned flag;
• author Discord id, username, display name, bot flag, and avatar URL;
• the message text (content);
• embed payloads (titles, descriptions, fields, URLs);
• image attachment filenames, Discord CDN URLs, and — when enabled — the downloaded image file;
• filenames of non-image attachments that were skipped (not the files themselves).

A sibling guild.json stores role definitions (name, color, permissions), the ban list (user id, username, reason), and a members list (id, username, nickname, role ids) — either from fetch_members when Server Members is enabled, or inferred from message authors when it is not.

{
  "channel": { "id": "9094…", "name": "general-chat" },
  "message_count": 1842,
  "messages": [{
    "id": "123…",
    "created_at": "2026-09-12T21:04:00+00:00",
    "author": { "id": "196…", "name": "alex", "display_name": "Alex" },
    "content": "anyone else watching the open? volume looks thin",
    "embeds": [],
    "images": [{ "filename": "chart.png", "file": "images/9094…/123…_chart.png" }]
  }]
}

B. Live copy on the backup Discord server

The daily (and weekly full) mirror reposts those same fields through a webhook into a private backup guild. That copy lives on Discord under Discord’s retention and the operators’ purge/restore actions. Mentions are stripped on send. This is still a copy of your message; it is not “we don’t store messages.”

C. Runtime state (not message bodies)

backup_state.json holds source↔backup channel and category maps, webhook ids, last-copied message ids, timestamps of the last daily/weekly run, a list of weekly snapshot folders, and simple counts. It does not store message text.

D. Operator secrets

The Discord bot token and config (guild ids, excluded channels, allow-listed operator ids) live on the host. Those secrets are not published here.

• Direct messages or group DMs.
• Presence, online status, devices, or streaming activity.
• Voice audio or voice-channel membership as a backup feature.
• Payment cards, government ids, or health data.
• Message text for advertising, resale, or AI/ML training.

• Message Content: used. The bot copies ordinary message text, embeds, and image attachments from the source guild into a backup guild and into weekly JSON snapshots. Operators also use prefix commands (?backup). Discord strips content, embeds, and attachments without this intent.
• Server Members: used. Complete weekly snapshots list members (id, username, nickname, role ids) via fetch_members so a restore can recreate nicknames and role assignments. Role definitions and bans are also snapshotted. The running stack can leave this intent off (ENABLE_MEMBERS_INTENT); without it, member rows fall back to authors seen in messages only.
• Presence: not used. The bot never reads online, idle, DND, device, or streaming status.

Paste-ready Discord form answers: /legal/nefarious-backup/intents. Server-wide matrix: /legal/intents.

• Disaster recovery: rebuild the backup guild after loss, wipe, or operator error.
• Operator diagnostics (?backup status, ?backup list).
• Respond to deletion, takedown, or legal requests.

We do not use snapshot text to profile members for ads, to train a public model, or to sell a data product.

• Weekly snapshots (off-platform): the last 4 weekly folders are kept on the NAS volume. Older folders are deleted by the bot. That is about four weeks of JSON + images — more than 30 days if weeks align that way. Answer Discord’s “30 days or less?” question No.
• Limited channels: only the latest 250 messages from those channels are mirrored or snapshotted.
• Backup Discord server: mirrored messages stay until operators purge a channel, load an older snapshot (which wipes and reposts), or delete the guild. There is no automatic 30-day wipe of the live mirror.
• Runtime state: while the bot is operated, then removed when the stack is retired.

Access is limited to operators — the Discord user ids on the command allow-list and people who can reach the host volume (NAS / Docker) that mounts nefarious-backup data. Ordinary members cannot list snapshots, open the backup guild, or run ?backup.

Hosting staff who administer that machine can technically read snapshot files. We do not share those files with advertisers, data brokers, or other Discord communities.

We do not sell message content, member lists, or snapshot files, and we do not share them with data brokers or advertisers.

We disclose information only:

• To Discord, as needed to read the source guild and write the backup guild.
• To operators and hosting providers that run the process.
• If required by law, to defend a legal claim, or to stop abuse.

Snapshots sit on operator-controlled disk. We do not claim encryption at rest unless the NAS dataset is actually encrypted. Discord’s privileged-intent form should say “Yes” to encryption only if that is true on the host. Tokens are stored in environment files on that host, not in this website.

No security measure is perfect. A host compromise or an operator mistake could expose snapshot JSON. That is one reason this bot is not a public product.

Email Business@nefarious.trading with “Nefarious Backup deletion” in the subject and include:

• your Discord user id and username;
• the channel and approximate time, or a message link, if you want specific messages removed;
• whether you want snapshots, the backup-guild copies, or both cleared.

We will delete or redact what we control (matching rows in retained weekly folders, and messages we can still reach on the backup guild) unless we must keep a record of the request or of unlawful content. We cannot erase the original message on Discord if you still posted it there, copies other members screenshotted, or snapshot folders already pruned.

There is no in-bot opt-out that leaves your messages in a backed-up channel but out of the copy. Practical opt-out: leave the server, ask operators to exclude a channel, or use this email.

If you are in the EEA, UK, or a U.S. state with a comprehensive privacy law, you may also ask for access, correction, or a portable copy of personal data we hold about you in this bot’s files. We will not discriminate against you for asking. You may complain to your local supervisory authority.

Discord requires users to meet its minimum age (generally 13+). Nefarious Backup is not directed at children under 13. If you believe we stored a child’s messages, contact Business@nefarious.trading and we will delete what we have.

We will post updates at this URL and change the “Last updated” date. If retention, access, or what we store changes, we will say so here honestly — including if we ever stopped storing message bodies.