Nefarious Copytrading privileged intents

• Message Content — YES (limited). The REST poller reads trade embed titles and descriptions from one configured signal channel. These contain pair, order, entry, stop and target values needed for the connected operator account. Message Content restrictions apply to REST responses, including embeds, subject to Discord’s documented exceptions. It does not poll other channels or DMs. All messages in the watched channel are examined; unmatched messages can leave a 200-character diagnostic excerpt.
• Server Members — NO. The process never lists members, assigns roles, welcomes joins, or reads nicknames. It does not open a Gateway connection with Server Members.
• Presence — NO. The process never reads online, idle, DND, device, or streaming status.

What Discord is used for

• Message Content — read embed title/description on one signal channel (NEW TRADE / REENTRY / UPDATE)
• REST GET /channels/{id} — baseline last_message_id on startup
• REST POST /channels/{log}/messages — operator execution and error embeds
• No Guild Members, no Presence, no slash commands, no prefix commands

What does your application do?

Nefarious Copytrading is an internal, admin-only operations tool. It is not a public consumer product, not listed for other communities to install, and not an offer of a trading service to the public.

The Discord application polls one operator-configured analyst signal channel over the Discord REST API (GET /channels/{id}/messages) about every five seconds. It looks for existing rich embeds titled NEW TRADE ALERT / NEW TRADE IDEA / REENTRY / TRADE UPDATE. When the embed text matches a pair / order / entry / stop / take-profit card, the process may place orders on a cTrader account that the live-account operators already connected via Spotware’s Open API. It posts execution and error logs to a private operator Discord channel. There are no slash commands and no prefix commands. Ordinary members cannot attach a broker, cannot run the bot, and are not end users.

The bot does not welcome members, assign roles, level users, track invites, read presence, scan DMs, or read the rest of the server. It examines all messages in the configured signal channel, not just posts from a particular author. Unmatched posts can be recorded as a short diagnostic excerpt.

Do you have a public Privacy Policy?

Yes

Where is your Privacy Policy available?

Publicly accessible on the official Nefarious website at the Privacy Policy URL below. Set that URL in the application's Developer Portal settings.

Privacy Policy URL

https://www.nefarious.trading/legal/nefarious-copytrading/privacy

Terms of Service URL

https://www.nefarious.trading/legal/nefarious-copytrading/terms

Install URL (operators only; not a public listing): https://discord.com/oauth2/authorize?client_id=1523859110016188536&scope=bot

Why do you need the Message Content intent?

Message Content is required, and only for a limited job: reading the embed text of analyst trade cards in one configured channel.

The process does not use a Discord Gateway client. It calls GET /channels/{channel.id}/messages on a single signal channel. Message Content restrictions apply to REST too. Existing analyst cards from another app do not ordinarily fall within the exceptions for our own messages, DMs, mentions or context-menu interactions. Without access to their embeds, the parser cannot read Pair, Order, Entry, SL or TP values. It also cannot parse TRADE UPDATE embeds that move stops or cancel pending orders.

There are no prefix or slash commands. The workflow processes existing analyst cards automatically; replacing it with commands would require changing that source workflow. It reads only the configured channel, but it examines every message there and can store a short excerpt of unmatched content. Source-channel permissions determine who can supply messages. Message text is not used to train machine-learning or AI models.

Proof links

• https://www.nefarious.trading/legal/nefarious-copytrading/intents#proof
• https://www.nefarious.trading/legal/nefarious-copytrading/privacy
• https://discord.com/channels/909011353342181426/1081025463654297640

Can users opt-out of having their message content data tracked?

No — no automated per-user opt-out.

The current implementation has no per-author exclusion or in-bot opt-out. It reads all messages in one configured signal channel. Contact Business@nefarious.trading for deletion or to request that operators stop collection or change the watched channel. Operators can stop the process or remove channel access. Not posting in that channel avoids new collection but does not delete existing records.

Are you storing message content data off-platform?

Yes.

Yes, limited operational copies for the operators — not a public member archive.

On the operator host (nefarious-copytrading data volume) we keep: (1) trades.json — parsed signal fields (pair, side, entry, SL, TPs), update text, execution metadata, and Discord message ids; unmatched messages may log the first ~200 characters plus embed titles; (2) state.json — last_message_id, a rolling list of processed message ids, and open-signal fields. This is so the process does not re-enter the same card after a restart.

We do not store a general chat log of the Discord, DMs, or public member profiles. cTrader OAuth tokens and broker client credentials are stored as operator secrets for the live account they already operate. Those are not Discord end-user credentials and are not published.

Will the message content data be used to train machine learning or AI models?

No.

• Storing API Data off-platform? Yes (parsed signal fields, message ids, operator event log). Broker tokens are separate operator account data, not Discord API Data.
• 30 days or less? No. trades.json appends events without an automatic age limit in the reviewed code. state.json retains up to 2000 processed Discord message IDs plus open-signal fields. Both can retain Discord data beyond 30 days. Hosting-log and backup retention must also be checked. Broker tokens are separate account data and persist until rotated or removed.
• Deletion contact: Business@nefarious.trading (Business@nefarious.trading).
• Encrypting at rest? Checked September 19, 2026: the deployed persistent storage is on an unencrypted apps dataset. Container JSON logs have no configured rotation limits. Do not select Yes for encryption of all stored API data until storage and log remediation is verified.

Leave those boxes unchecked. If Discord asks why you do not need them:

Server Members: The process never lists members, assigns roles, welcomes joins, or reads nicknames. It does not open a Gateway connection with Server Members.

Presence: The process never reads online, idle, DND, device, or streaming status.

N/A — we are not applying for Presence
No — we do not collect presence

Signal channel (Nefarious / Czarfx cards): https://discord.com/channels/909011353342181426/1081025463654297640. The operator log channel is private. Privacy: /legal/nefarious-copytrading/privacy.

1. Source-message parsing verified

Source message 1550085736546566217 in the configured CzarFX channel contains the GBPNZD SELL signal. The deployed parser extracts its pair, side, entry, stop and targets. An offline run of that pure parser reproduced the fields in the bot event. The runtime configuration and source-message ID were checked read-only; no order was triggered by this audit. Message Content restrictions also apply to these REST reads.

2. Matching operator result

Log message 1550085761125322774 identifies the same source signal in its footer and reports cTrader (live). The matching bot event reports one order. Account risk settings and position sizes are redacted from the public excerpt. These records verify processing and reported execution, not an independently confirmed broker fill.

Reference: Discord Message Content documentation. A source-channel link requires membership and is not a substitute for an accessible demonstration.