Privacy Policy

This Privacy Policy applies only to the blackwall.observer website and the Blackwall Discord application (App ID: 1519986517185921136), as both are operated on self-hosted infrastructure.

1. Introduction

This Privacy Policy describes how Blackwall ("the Service") collects, uses, and protects information when the bot is present in your Discord server and when you use the web dashboard. We are committed to transparency and minimizing data collection.

2. Data We Collect

The Service ingests the following categories of data:

2.1 Discord User IDs

When you log in via Discord OAuth2, your Discord User ID and username are stored to authenticate you and display your identity in the dashboard. User IDs are also processed in real time during spam detection (e.g., per-user rate limiting and duplicate tracking).

2.2 Discord Server (Guild) IDs

For each Discord server where the bot is present, the Service stores the Guild ID, guild name, and icon hash. This allows the dashboard to list and identify your servers.

2.3 Discord Channel IDs

Channel IDs are used in two ways: (a) the ID of a configured log channel is stored in the database so the bot knows where to send infraction summaries, and (b) channel IDs are used transiently during duplicate detection to determine whether cross-channel duplicate checking is enabled.

2.4 Message Content

Message content is read in-memory by the bot in real time to evaluate it against spam filters (rate limiting, duplicate detection, mention limits, invite link blocking, and suspicious link detection). Message content is never written to the database. See Section 3 for a detailed explanation of how message data is processed versus stored.

2.5 Configuration Data

Settings you define through the dashboard (spam thresholds, enforcement actions, log channel, anti-raid parameters, etc.) are stored in the database and associated with the corresponding guild.

2.6 Technical Data

The Service may generate standard application logs including IP addresses (for the web dashboard), request timestamps, and error messages for the purpose of security, debugging, and service stability. These logs do not contain message content.

3. Data Processing vs. Data Storage

It is important to distinguish between data that is processed ephemerally (in transit) and data that is persisted (at rest).

3.1 Data in Transit (In-Memory & Redis)

When a message is received, the bot reads its content in-memory to run spam checks. Specifically:

• Rate limiting: a per-user, per-guild message counter is stored in Redis with a time-to-live (TTL) equal to the configured rate-limit window. This counter contains no message content and expires automatically.
• Duplicate detection: an MD5 hash of the message content (not the content itself) is stored in Redis with a short TTL. The original message content cannot be reconstructed from this hash. The hash expires automatically after the configured duplicate window.
• Mention limits, invite links, suspicious links: these checks are performed entirely in-memory. Nothing is stored.

Once the message has been evaluated, the in-memory copy is discarded. No message content is written to Redis or to the database at any point.

3.2 Data at Rest (Database)

The following data is persisted in the database (PostgreSQL):

• User accounts: Discord User ID and username (for dashboard authentication).
• Guild records: Discord Guild ID, guild name, icon hash, and owner reference.
• Guild managers: Discord Role ID, User ID, and admin flag (for permission management).
• Spam configuration: all moderation settings and the configured log Channel ID.

Message content is never stored in the database. When a spam violation is detected, the bot sends an infraction summary embed — which includes the message content truncated to 1024 characters — to the configured Discord log channel. This embed is delivered through Discord's API and is subject to Discord's own retention. It is not stored in Blackwall's database.

4. Self-Hosted Infrastructure

Blackwall is a self-hosted application. The bot, the web dashboard, the API, the PostgreSQL database, and the Redis cache all run on infrastructure controlled by the person or organization that deployed this instance (the "host").

All collected data remains on the host's personal servers or VPS. No data is transmitted back to the original Blackwall developers or to any central database. The original developers do not have access to your instance's database, logs, or Redis cache. Each deployment is an independent, isolated instance.

This means that the host of the instance you are using is the data controller for your personal data, not the original Blackwall developers. Any data-related requests should be directed to the host of the specific instance (see Section 7).

5. How We Use Your Data

• To authenticate users and manage dashboard access.
• To store and apply per-guild moderation configuration.
• To detect and respond to spam, raids, and malicious activity in real time.
• To send infraction summaries to the configured Discord log channel.
• To monitor and improve the reliability and performance of the Service.

We do not sell or rent your data. We do not use your data for advertising. We do not maintain a permanent archive of messages from your server.

6. Data Sharing

Because Blackwall is self-hosted, data is not shared with any third party by the Service itself. The only external transmission is infraction summary embeds sent to Discord's API for delivery to your configured log channel, which is subject to Discord's own privacy policy and data practices.

The host of the instance may use third-party infrastructure providers (e.g., a VPS provider, a managed database service) that have access to the underlying servers. The host is responsible for ensuring appropriate agreements are in place with such providers.

7. Data Retention and Deletion

7.1 Retention

• Configuration data: retained for as long as the bot remains in your server.
• User accounts: retained for as long as your Discord account is linked. If you remove the bot from all servers and request deletion, your account data can be removed.
• Redis ephemeral data: rate-limit counters and duplicate hashes expire automatically based on their configured TTL (typically seconds to minutes).
• Application logs: retained at the discretion of the host. The Service does not impose a fixed retention period on application logs.
• Infraction embeds in Discord: subject to Discord's own message retention. The Service has no control over how long Discord retains these messages.

7.2 Deletion

When the bot is removed from a Discord server, the associated guild record and spam configuration can be deleted. To request deletion of your personal data (e.g., your Discord User ID and username stored in the database), you should contact the owner of the server hosting this specific instance, not the original Blackwall developers. Since each instance is independent and self-hosted, the original developers cannot access or delete data on instances they do not control.

To identify the host of this instance, refer to the server owner or administrator who invited the bot to your Discord server or who provided you with access to the web dashboard.

8. Data Security

The Service uses encrypted connections (TLS) for the web dashboard and API. Access to the dashboard is protected by JWT-based authentication. Discord OAuth tokens, where applicable, are encrypted at rest using AES. However, no system is perfectly secure, and the security of the data ultimately depends on the measures implemented by the host of this instance.

9. Your Rights

Depending on your jurisdiction (e.g., GDPR, CCPA), you may have the right to:

• Access the personal data stored about you.
• Request correction or deletion of your personal data.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.

To exercise these rights, contact the host of this specific instance — that is, the server owner or administrator who deployed Blackwall on their infrastructure. The original Blackwall developers cannot process data requests for instances they do not operate.

10. Children's Privacy

The Service is not directed to individuals under the minimum age required to use Discord. We do not knowingly collect data from such individuals. If you believe data has been collected inadvertently, contact the host of this instance.

11. Changes to This Policy

This Privacy Policy may be updated by the host of this instance from time to time. The date of the latest revision is shown above. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact

Questions or requests regarding this Privacy Policy or your personal data should be directed to the host of this specific instance — the person or organization that deployed Blackwall on their own infrastructure. They are the data controller for this instance.