Nefarious Congress Tracker Privacy Policy

Controller: Nefarious Digital (Nefarious). Email: Business@nefarious.trading.

The wider site and Discord community are described in the site Privacy Policy. This Policy is only about the congress tracker bot and the public-filing dataset it maintains.

Operator configuration

• Discord bot token (secret), destination guild id 909011353342181426, and channel id 1517787034574655518.
• A site-ingest secret used only to authenticate pushes to /api/congress-trading/sync. That secret is not Discord member data.

Public filing database (congress.db)

SQLite tables of public congressional trading records, not Discord user profiles:

• Politicians — name, party, state, chamber, yearly-return figure, leaderboard rank, and the source row used to compute them.
• Trades — a fingerprint or source trade id, politician name, ticker, buy/sell, trade date, filing date, disclosed size range, the source row, when we first saw it, and whether it has already been posted to Discord.

Scrape state (congress_state.json)

Operator flags and timestamps: whether the historical import finished, last leaderboard sync, last trade sync, backlog-flush markers. This is process state so we do not flood the channel. It is not a member roster.

Website copy

The same public politician and trade records are pushed to the Nefarious site database so /congress-trading can render a leaderboard and filing list for approved members. Site sign-in (Discord OAuth) is described in the site Privacy Policy and is separate from this bot — the bot itself does not run that OAuth flow.

Discord also keeps a copy of each embed we send, under Discord’s retention rules and your server’s channel history.

• Member conversations, command text, or DMs — the filing feature has no message reader and does not persist those conversations.
• Persistent Discord member profiles or role membership for congress-tracker purposes.
• Presence or online status for congress-tracker purposes.
• Payment cards, government ids of Discord members, or health data.
• Advertising cookies or cross-site tracking tied to this bot.

The application has no incoming-message handler. Its current Discord library defaults still subscribe to ordinary events and can temporarily cache message metadata, author information, voice state, and content Discord supplies without privileged access, such as direct messages or messages mentioning the bot. The filing database does not store that cache. Do not send private information to the bot; direct messages are not a support channel.

Privileged intents are off. Message Content: not used; Server Members: not used; Presence: not used. Details: Terms, intents and /legal/intents.

• Post each new public filing once to the configured Discord channel.
• Update the Nefarious Congress Trading pages with the same public dataset.
• Avoid duplicate embeds after restarts (posted flag + trade fingerprint).
• Debug missed sends, rate limits, and source outages.
• Respond to deletion or takedown requests.

We do not use this dataset to profile Discord members, to train a public recommendation engine, or to give personalized investment advice.

• Filing database: kept for as long as the tracker runs so we can de-duplicate posts and show history on the site. There is no automatic 30-day expiry in the process today.
• Scrape state and configuration: retained while the service runs. The reviewed code has no automatic expiry or retirement cleanup; removal requires an operator.
• Discord copies: until a moderator deletes the message or the platform expires it. We do not control every client cache.
• Operational logs: stdout from the container may record scrape counts and errors, the bot identity, and destination channel ID. The application does not configure a log expiry or backup deletion schedule. Those periods depend on host settings and have not been verified in this source review.

The service uses authenticated Discord and website connections. Operators and service providers who maintain it may access its configuration and stored records. The reviewed database code does not itself encrypt stored records; storage-volume encryption and backup protections require separate host verification. We do not represent those controls as verified merely because this policy is published. Report suspected unauthorized access to Business@nefarious.trading.

We do not sell filing records, channel ids, or scrape state, and we do not share them with data brokers or advertisers.

We disclose information only:

• To Discord, as needed to deliver the public-filing embeds you already see in the channel.
• To the Nefarious website host and database, so approved members can view the same public tracker.
• To the public-data sources as ordinary HTTPS clients fetching filings and legislator metadata.
• To operators and hosting providers that run the bot.
• If required by law, or to defend a legal claim, or to stop abuse of the bot.

• Discord. Discord Privacy Policy.
• Public filing aggregators (currently the congress-trading feeds the scraper calls) and public legislator datasets. They see our server’s requests, not your Discord identity.
• Nefarious website host (Vercel / our database provider) for the VIP-gated Congress Trading pages.

This bot does not keep a Discord profile of you. If a posted embed or a stored filing still concerns you (for example you are the filer named in a public report, or a post should come down), email Business@nefarious.trading with:

• The Discord channel and approximate time, or a message link.
• The politician name and ticker if you have them.
• Whether you want the Discord message deleted, the stored filing dropped, or both.

We review requests, verify the requester where necessary, and correct or delete data we control where required by applicable law. Include whether the request covers Discord, the tracker database, or the website copy. The scraper has no built-in suppression list, so removing a database row alone can allow it to be imported again; operators must address that before confirming permanent removal. We explain any lawful reason for retaining a record. We cannot erase original government filings or independent copies held by others.

If you are in the EEA, UK, or a U.S. state with a comprehensive privacy law, you may also ask for access, correction, or a portable copy of any personal data we hold about you in this dataset. For most Discord members that is none. Public official names in STOCK Act filings are not treated as secret Discord-user data. We will not discriminate against you for asking. You may complain to your local supervisory authority.

Discord requires users to meet its minimum age (generally 13+). Nefarious Congress Tracker is a trading-community tool and is not directed at children under 13. If you believe we logged data about a child, contact Business@nefarious.trading and we will delete what we have.

We will post updates at this URL and change the “Last updated” date. Material changes to what we store (for example if we later added commands that read message content) will be described here honestly — we will not leave this Policy saying we do not read messages if the code starts doing that.