Plantlog Privacy Policy

Effective date: October 15, 2026 · Last updated: October 19, 2026 (Plantlog 1.3.8) Operator: Logg Bots ("we", "us") Application: Plantlog Discord bot (Application / Client ID 1557511749698326579) Contact: loggbots@pm.me · Support server: https://discord.gg/bwTP6VNuHd

This policy explains what data the Plantlog Discord bot ("Plantlog", "the bot") processes, why, how long it is kept, who can see it, and how you can request access or deletion. It applies to everyone in a Discord server where Plantlog is installed, and to server administrators who configure it.

Plantlog is a security and moderation bot. It is self-hosted by the operator on their own server and stores data in a local SQLite database. Plantlog does not sell data, does not use data for advertising, and does not use message content to train any AI or machine-learning model.

1. Data we process

Plantlog only receives data that Discord sends to bots through its API (Gateway events, audit log entries, and interactions). We sort it into three categories by how it is handled.

1.1 Processed in memory only (not written to our database)

Data	Purpose	How long
Message content of new messages	Spam detection (rate, duplicates, mass mentions), invite/link filter, phishing link detection	Checked when the message arrives. For duplicate detection, a normalized copy of the text is held in memory for the duplicate window (30 seconds by default, configurable) and then dropped.
Discord's message cache (content, author, attachments names)	Lets the event log show the "before" text of edited messages and the text of deleted messages	In memory only, at most the latest 200 messages per channel (library default). Cleared when the bot restarts.
Recent joins (user ID, username, account creation date, whether the account has a custom avatar, join time)	Alt detection and raid detection (join rate, similar names or creation times)	Rolling windows of a few seconds to 2 minutes
Incident buffer (user ID, event type, channel ID, message ID, username on join)	Building incident timelines if an attack is detected	Rolling 10-minute buffer. Only copied to the database if an incident starts (see 1.2).
`/speaktoplantlog` conversation (your last 8 messages and replies, plus a name you choose to tell it)	Lets the chatbot answer follow-up questions	Removed after 30 minutes of inactivity, on `reset`, or when the bot restarts. Never written to the database.
Poll votes (`/poll`)	Counting votes	Until the poll ends or the bot restarts
Command cooldowns	Rate limiting	Seconds to minutes

1.2 Stored in our database (SQLite, hosted by the operator)

Data	What is stored	Purpose	Retention (current behavior)
Server configuration	Server ID, module settings, configured channel and role IDs, welcome/goodbye templates	Running the bot as configured	Kept while the configuration exists. Deleted on request.
Whitelist	Server ID, trusted user ID, who added them, when	Exempting trusted staff from anti-nuke and spam filters	Until removed with `/whitelist remove`
Structure snapshots and backups	Server name and settings; roles (name, color, permissions, position); channels (name, type, category, topic, slowmode, permission overwrites, which can contain user or role IDs). No messages and no role memberships.	Anti-nuke restore and `/backup`	Snapshots: kept for the current structure so deleted items can be restored. Automatic daily backups: only the newest N are kept (default 7, max 30). Manual backups (max 25 per server): until deleted with `/backup delete`.
Incident log	Server ID, incident type, user ID, short detail, timestamp. Details include detected domains, risk scores, moderator-entered reasons, and, for removed Discord invites, only the invite code(s) (for example `discord.gg/abc123`). Message text is not stored.	`/audit`, weekly security reports, statistics	Deleted automatically after 90 days
Incident timelines (replay)	Server ID, attacker user IDs, event types and times, target IDs, channel and message IDs of attacker messages, usernames at join, names of affected channels/roles, Plantlog's own responses. Message text is not stored.	Showing what happened during a raid, nuke, or spam wave, and the "Undo attacker changes" function (which can delete those messages by ID)	Timelines and their events are deleted automatically after 90 days. The "Undo" data for a timeline is deleted after 7 days.
Warnings	Server ID, user ID, moderator ID, reason, timestamp	`/warn`, `/warnings`	Deleted automatically after 365 days, or earlier when a moderator removes them with `/clearwarns`
Temporary bans	Server ID, user ID, unban time, reason	Lifting tempbans automatically	Deleted when the ban is lifted
Quarantine role store	Server ID, user ID, list of role IDs taken away, timestamp	Giving roles back on `/unquarantine`	Deleted when the member is released
Cross-server threat network	User ID, server ID where the action happened, source (automatic, manual ban, or report), severity (1–3), reason (up to 300 characters), timestamp	Warning other servers about accounts that raided, nuked, or posted phishing links (see Section 3)	Permanently deleted after 365 days. Before that they count for less over time (half weight after 60 days, one quarter after 180 days). They can be removed earlier through an appeal (Section 5).
Captcha verification state	Server ID, user ID, expected answer, expiry (10 minutes), attempt count	Button captcha verification gate	Deleted when the challenge is passed or after 3 failed attempts. A challenge you leave unanswered is deleted by the daily cleanup once it has expired.
Garden activity	Server ID, user ID, number of active days, last active UTC date, wilt count	`/garden` plant growth and leaderboard (based only on whether you sent a message that day, not on what it said)	Kept while the server uses Plantlog. You can delete your own progress at any time with `/privacy delete-my-data`.
Security score history	Server ID, score, timestamp	Trend in weekly reports	Deleted automatically after 365 days
Panic and undo state	Server ID, role IDs and their earlier permissions, affected user and role IDs	`/panic` → `/recover`, and "Undo" buttons on dangerous-permission alerts	Panic state: until `/recover`. Undo data: until the button is used.
Raid and lockdown state	Server ID, raid mode flag, which channels were locked and their earlier settings	Lifting lockdowns, including after a restart	Until the lockdown ends
Support tickets (only if a server runs `/ticket setup`)	Server ID; panel channel, staff role and category IDs; a ticket counter; for each open ticket: number, channel ID, opener's user ID, the topic they typed (up to 500 characters, with token- or password-shaped text removed), who claimed it, users added, open time; the time each user last opened a ticket (for the 5-minute cooldown)	Running tickets	An open ticket's entry is deleted when it is closed. Settings and last-open times stay while the server uses Plantlog.
Simplify button text	The plain text of the long Plantlog message the button is attached to, its title and type	Producing the short "Simplify" version when the button is pressed. It is worked out on our server and is not sent to any AI or other service.	The button works for 7 days. The stored text is not cleared automatically after that; it is deleted with the rest of the server's data (for example 30 days after Plantlog leaves the server).
Welcome card flag	Server ID and the time Plantlog posted its welcome card	Posting the welcome card only once per server per 24 hours	Overwritten if Plantlog joins the server again

1.3 Posted to Discord (inside your server, not stored by us)

When enabled by server administrators, Plantlog posts embeds into the server's mod log / event log channel. These can include: message content of edited and deleted messages (when cached), short previews of bulk-deleted messages, content of removed phishing or invite messages, member join/leave details (username, ID, avatar, account age, roles), role and nickname changes, voice activity, bans and moderation actions. Plantlog also sends the server owner a direct message when someone is given dangerous permissions.

Plantlog also posts a one-time welcome card when it joins a server: what Plantlog is, the server's current security score and its top 3 issues. It goes in the system channel or another channel Plantlog can post in (never a honeypot channel), or to the server owner by DM if no channel works.

Ticket transcripts. When a ticket is closed, Plantlog builds a plain-text transcript of the ticket channel (up to the latest 500 messages: author name and ID, time, message text, embed titles and attachment file names). Token- or password-shaped text is removed. The transcript is attached as a .txt file to the server's mod log (or sent to the server owner by DM if the server has no mod log) and sent by DM to the person who opened the ticket. Then the ticket channel is deleted. Plantlog does not keep its own copy of the transcript.

Plantlog does not keep its own copy of these log posts. They live in Discord, and the server's administrators control who can see them and how long they stay (they can delete them at any time). Plantlog never logs activity from inside the log channels themselves, and by default ignores bots.

1.4 Data we do not collect

Plantlog does not collect email addresses, IP addresses, passwords, payment information, direct messages sent to other users, voice or audio content, or files. We do not read the content of messages in servers where Plantlog is not installed.

2. Why we process data (purposes and legal bases)

We process the data above only to provide the bot's features: protecting servers from alt accounts, raids, spam, phishing, and "nukes" (mass destructive actions); providing moderation tools, backups, logs, and reports; and optional fun features. Where laws such as the GDPR apply, our legal bases are:

legitimate interests, ours and the server community's, in keeping servers safe, preventing abuse, and moderating them; and
performance of the service that server administrators asked for when they added and configured Plantlog.

3. Sharing and disclosure

Within a server. Moderators and administrators of a server can see that server's data through Plantlog commands (for example /audit, /warnings, /replay, /backup) and through the log channel.
Cross-server threat network. When Plantlog automatically bans or kicks an account for a raid, alt, or nuke, or removes a phishing link, a network record is created. If a server enables it, a manual ban with a reason or a /network report also creates one, and these carry low weight. When that user later joins another server that uses Plantlog, or a moderator there runs /network lookup, that server's moderators can see: the record source, severity, reason text, date, a risk level, and how many servers took action. The name and ID of the server where a record came from are not shown to other servers. For people, network records only ever produce an alert to staff. Plantlog never automatically bans, kicks or quarantines a person because of another server's record. Staff decide what to do. Network records also lower Plantlog's advisory staff-only trust score (/inspect trust) by up to 20 points. Plantlog takes no action from that score.
Bad-bot list. Bot accounts that Plantlog caught nuking or raiding are put on a shared list (bot ID, name, where and when first caught, reason). When a listed bot is added to another server that uses Plantlog, Plantlog bans or kicks it automatically unless that server has whitelisted it, in which case staff are only alerted.
Review and unflag. If you think you were flagged by mistake, open a ticket in https://discord.gg/bwTP6VNuHd. The operator can review everything Plantlog holds about the account and clear it with /admin unflag. That removes all of the account's network records and any bad-bot entry (which also removes the trust-score penalty), and records the review in an audit log (see "Operator tools" below). Each server that had a record gets a notice in its own mod log that the flag was cleared after review, with the reason. Bans inside a server are not lifted; that server's staff decide. The operator may also send you a DM saying you were unflagged.
Operator tools. The operator (the Plantlog owner only) has an /admin command, available only in the official Plantlog server, that can look up Plantlog's own stored records for any server Plantlog is in: cases and incident log entries, ban reasons (from Plantlog's records, or from that server's ban list or audit log if Plantlog can read them), and the incident notes Plantlog keeps (counts and content hashes; no message text). Replies can be shown in a channel of the official server, for example inside a support ticket. When they are, token-shaped text is removed and user IDs not related to the lookup are hidden. /admin talk adds a message (ID, time, server, text with token-shaped text removed) to a queue file on our server (data/admin-queue.json, newest 500 kept) for the operator. Unflag reviews are recorded in data/admin-audit.json (time, who, user ID, reason, how many records were removed, affected server IDs; newest 1,000 kept).
Discord. All interaction happens through Discord's platform, under Discord's Privacy Policy.
Phishing domain list. Plantlog regularly downloads a public list of phishing domains. No user data is sent when it does.
Optional AI chat provider. If the operator configures a third-party AI provider (OpenAI or xAI), messages you send to /speaktoplantlog, the last few turns of that conversation, and your display name (or a name you told the bot) are sent to that provider to generate a reply, subject to that provider's own terms and privacy policy. This is currently not enabled. Plantlog uses a built-in responder that runs entirely on our server. We will update this policy before turning on a provider. Moderation and security features never send data to an AI provider.
Legal. We may disclose data if required by law or to protect the safety of users, or to respond to valid requests from Discord's Trust & Safety team.

We do not sell, rent, or trade personal data.

4. Retention summary

In-memory data is lost when the bot restarts or after the short windows listed in 1.1.
Message content is not stored in our database. When the invite filter removes a message, only the invite code(s) are logged.
Data tied to a feature (tempbans, quarantine roles, captcha) is deleted once it has been used. Expired captcha challenges are deleted by the daily cleanup. Panic-mode and undo data is deleted after 7 days. After that, /recover and the replay "Undo" button are no longer available for that event.
A cleanup job runs once a day and deletes data older than these limits:
- Incident log: 90 days
- Incident timelines and their events: 90 days
- Panic and undo data: 7 days
- Warnings: 365 days
- Security score history: 365 days
- Threat network records: 365 days (permanently deleted)
Automatic backups keep only the latest N (default 7).
Simplify button text: usable for 7 days, deleted with the server's data. Open-ticket entries: until the ticket is closed. Ticket transcripts are not kept by us; they live in Discord as described in 1.3.
Operator files: the /admin talk queue keeps the newest 500 entries, and the unflag audit log keeps the newest 1,000.
Garden progress and /speaktoplantlog memory can be deleted at any time by the user with /privacy delete-my-data. Chat memory is also held in memory only and is lost when the bot restarts. /privacy info shows these limits inside Discord.
If Plantlog is removed from a server, all data stored for that server is deleted 30 days after it leaves. This includes configuration, whitelist, snapshots, backups, incidents, timelines, warnings, tempbans, quarantine data, captcha, garden, and score history. The deletion is cancelled if Plantlog is added back before then. Threat network records that started in that server are not part of this deletion. They stay only until their own 365-day limit.

5. Your rights and deletion requests

You can ask us to access, correct, or delete data about you, or object to processing, by contacting loggbots@pm.me or opening a ticket in https://discord.gg/bwTP6VNuHd. Please include your Discord user ID, and a server ID if relevant. We may need to confirm that you own the account (for example, by asking you to message us from it). We aim to reply within 30 days.

Threat network appeals: run /network appeal for instructions, open a ticket in https://discord.gg/bwTP6VNuHd, or contact us directly. If a record is found to be wrong, the operator removes all of your network records (/network remove or /admin unflag).
Your own data: run /privacy delete-my-data to delete your garden progress and chatbot memory right away. Moderation records (warnings and threat network records) are kept for safety until their retention limit. To ask for their removal earlier, contact us through the support channels above.
Server-level data: server owners can delete backups (/backup delete), warnings (/clearwarns), and whitelist entries themselves, reset configuration (/config reset), and ask us to delete everything stored for their server. Removing Plantlog from the server also deletes it all automatically after 30 days.
Limits: we may keep a minimal record when we have a strong, legitimate safety reason, such as a confirmed nuke attacker in the threat network. We will tell you if we do. Messages Plantlog posted in a server's log channel are under that server's control. Ask that server's staff, or report the content to Discord.

If you are in the EU, the UK, or another region with data protection laws, you also have the right to complain to your local supervisory authority.

6. Children

Plantlog is meant for Discord users who meet Discord's minimum age (at least 13, or older where local law requires). We do not knowingly collect data from children under that age. If you believe such data has been processed, contact us and we will delete it.

7. Security

The database is stored on infrastructure controlled by the operator, and access is limited to the operator. The bot token and any API keys are kept in server-side environment files, not in the code. Commands that touch sensitive data are restricted to users with the right Discord permissions. Destructive actions (restore, undo, panic) need the server owner or a whitelisted user plus a confirmation. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.

8. International processing

The bot is hosted by the operator on cloud infrastructure that may be located outside the United Kingdom. Discord itself processes data globally under its own policies.

9. Changes

We may update this policy. Changes are posted with a new effective date in https://discord.gg/bwTP6VNuHd and/or at the URL linked from the bot's profile. Material changes, such as enabling an AI provider or changing threat network sharing, will be announced before they take effect. If you keep using Plantlog after changes take effect, you accept the updated policy.

10. Contact

Logg Bots · loggbots@pm.me · https://discord.gg/bwTP6VNuHd