Privacy Policy

Scope and responsibility

This policy describes the Veto Discord bot and website at vetobot.app. The operator identified above is responsible for Veto's processing. Discord, individual server administrators, and our service providers also process information under their own policies and responsibilities. Joining a server is not blanket consent to unrelated processing. Where applicable law requires a particular lawful basis or consent, the operator must establish it before that processing takes place.

Discord and server information

Veto processes Discord user, server, channel, role, message, and audit-entry identifiers; display names and server names; permissions; relevant membership and role information; account creation time derived from Discord identifiers; and server configuration. This allows the bot to respond to commands, check permissions, operate moderation and security features, and assign verification roles. Settings and trusted or authorised users, roles, bots, and webhooks may be stored in PostgreSQL.

Australian operator and privacy framework

Veto is currently operated by an individual based in Western Australia, Australia, rather than an incorporated company. This describes the operator's location, not a promise that all information is hosted in Australia. The operator's identity must be confirmed above before final publication. Whether the Privacy Act 1988 (Cth) and Australian Privacy Principles apply depends on the operator's activities and circumstances, including any applicable small-business exceptions. Operating personally, providing a free service, or having low turnover does not by itself establish an exemption. This draft does not assert that Veto is exempt, registered with the OAIC, or certified as compliant. The operator must complete that assessment before finalising this policy. Discord's contractual data-protection requirements continue to apply regardless of any statutory exemption.

Australian privacy complaints

You can raise a privacy concern through the contact address above. Describe the issue and the outcome you seek, without including passwords or unrelated sensitive information. The operator should investigate and respond within the applicable legal timeframes. Where the Privacy Act applies, you may be able to complain to the Office of the Australian Information Commissioner after first giving the operator an opportunity to resolve the issue. OAIC jurisdiction and complaint requirements apply; this policy does not represent that every complaint falls within that jurisdiction.

Moderation and security records

Stored records may include affected users, acting moderators, incident descriptions, reasons, timestamps, detection counts, evidence metadata, responses, case history, previous roles needed to restore quarantine, and channel permission snapshots needed to end lockdowns. Relevant records and alerts may also be sent to server channels configured by administrators. The bot can process message text, links, and mentions for spam detection. The current spam detector uses a bounded in-memory history and does not save ordinary message bodies to its incident database. Its approximately 65-second detection window is not a guarantee that all inactive cached text is physically erased after 65 seconds; entries can remain until replaced, evicted, or the process stops.

Reports, appeals, and direct messages

Reports can include reporter and target identifiers, categories, descriptions, case status, reviewer identifiers, decision reasons, and attachment names and links. When staff request further evidence, matching direct-message replies and attachment metadata may be forwarded to the private investigation channel and recorded in the database. Veto does not intentionally archive every unrelated direct message. Investigation channels can be exported to HTML transcripts containing message text, author details, timestamps, attachments, and embeds. In the updated implementation, full transcripts are saved in the configured staff log channel with an expiry record; assigned reviewers receive a notification rather than an additional full transcript in a direct message. Older versions may have sent full copies to reviewers. Reporters receive a case summary rather than the internal transcript. Do not send unnecessary sensitive information.

Member verification

Veto stores a server and user identifier, a hashed verification token, expiry time, authorisation state, challenge status, account-age risk score and reasons, and related review, audit, and role-assignment records. The link expires after 15 minutes. Expiry stops use of the link; it does not automatically erase the underlying record. Verification can result in automatic approval or moderator review. Contact the server's moderators to challenge access decisions and contact Veto about its own processing.

Website sign-in and cookies

Dashboard sign-in requests Discord's identify and guilds scopes. Veto uses your identity and server permissions to list servers you can manage and authorise changes. The website stores a hashed session identifier, basic Discord profile information, an encrypted access token, a request-protection token, and an expiry time. Login sessions last at most one hour and use HttpOnly session cookies. Separate cookies hold short-lived authorisation state and member-verification sessions. Signing out deletes the active dashboard session. Expired dashboard records are cleaned up on subsequent logins, rather than necessarily at the instant they expire. Dashboard changes are recorded with the responsible user's identifier. No advertising or analytics script has been added by the current website code.

Infrastructure and Cloudflare Turnstile

Railway provides hosting and PostgreSQL storage. The reviewed database containing Veto's tables has its volume in US West (California, USA), so this storage is outside Australia. Its Railway backup page showed no volume backups at the time of review; this does not establish the absence of all infrastructure or independently created copies. Cloudflare provides domain infrastructure and Turnstile challenges. These providers and Discord receive information necessary to deliver their services. Network infrastructure may process IP addresses, request metadata, browser information, and operational logs even where the Veto application does not store IP addresses in its database. Turnstile processes browser and device signals to distinguish people from automated traffic under Cloudflare's Turnstile Privacy Addendum. Veto sends the challenge response to Cloudflare for validation. We do not claim that these providers collect no information.

Uses and recipients

Information is used to provide the requested features, authenticate users, prevent abuse, support moderation and investigations, restore temporary restrictions, troubleshoot failures, and handle support and privacy requests. Recipients may include authorised Veto operators and reviewers, the server staff or members who can access configured channels, the reporter receiving a summary, the assigned reviewer receiving a transcript, and necessary service providers. Channel access settings matter: Veto cannot guarantee that a server administrator has made every log channel private. Veto's current code does not sell personal information, use it for advertising, or send it to an AI training service. Disclosure may also be required by law. Providers may process information in other countries; actual deployment locations and applicable transfer requirements must be confirmed before final publication.

Retention and deletion

The intended policy is to keep server moderation and configuration records while Veto serves that server, and delete the server-scoped database records when Veto is removed. The updated code handles confirmed removal and checks again at startup and hourly; temporary server outages must not be treated as removal. Independent reports submitted to Veto's investigation service are separate from a server's own moderation records and are not deleted merely because the bot leaves that server. Leaving a server as an individual does not automatically delete every record about that individual.

For newly tracked investigation transcript exports, the retention target is up to two calendar years from export, with deletion at the next successful hourly cleanup after expiry. Outages or access failures may delay cleanup and require operator intervention. This is a maximum policy target, not a reason to retain information that must be deleted sooner. Valid user or Discord deletion requests and information no longer needed for permitted functionality require prompt deletion unless retention is required by law. These code changes must be deployed and tested before the operator presents this as live behaviour. Older untracked transcripts and reviewer copies need manual inventory and cleanup. The two-year export rule does not automatically delete underlying report rows or evidence events; their necessary retention still requires review.

Deleting database records does not delete messages already posted in independently managed server channels, screenshots, user downloads, support mail, provider logs, or backups. After removal, Veto may lack access to remove messages from a server. Copies controlled by Veto must also be considered when handling a deletion request. Any legally required retention and backup limitations should be explained in the response to a request.

Requests and choices

Email the contact address above with the subject “Veto privacy request” and explain whether you want access, correction, deletion, or information about processing. Include only the Discord user identifier and relevant server or case identifiers needed to locate the records. We may ask you to demonstrate control of the relevant Discord account or server; never send your password, token, or identity document. Requests must be handled promptly and within applicable legal deadlines, with any legally permitted refusal or limitation explained. Rights vary by location and can include objection, restriction, portability, withdrawal of consent where consent applies, and complaints to a privacy regulator. A separate request to Discord or a server administrator may be needed for information they independently control. Necessary security processing can recur if you keep using the bot or remain in a server using it.

Security and younger users

The website uses HTTPS in production, access checks, request-forgery protection, hashed session tokens, and encrypted dashboard access tokens. These measures do not guarantee absolute security or establish that every database, backup, or exported transcript is encrypted. The operator must verify provider storage encryption, access controls, and incident procedures. Veto is intended for people eligible to use Discord in their location and is not intended to bypass Discord's age rules. Contact us if you believe information has been processed contrary to those requirements.

Changes

We will keep this policy accessible, publish its effective date, and provide notice or seek consent for changes where required. Contact the operator above with questions or complaints.