Legal

Privacy Policy

What Asbern holds about you, where it is kept, who can see it, and what you can erase.

Last updated 2026-10-29

What Changed on 29 October 2026

This version replaces the one dated 26 October 2026. What is new or different:

An administrator can link an Asbern box to their server. An Asbern box is a small set of Asbern programs that runs in Docker on a machine the administrator owns, linked with a one-time command or code from Discord. The bot can then create game servers on that machine from a list of games Asbern has checked, start and stop them, and reach the Plex or Jellyfin server and the music player there. The bot keeps a short record about the box: what kind of machine it is, the versions of its programs, the results of its own checks and its network addresses. Folders, files and game worlds stay on the machine. See Your Asbern Box.
A game server's name can point at its owner's home. Where the box's owner allowed it, the box asks the home router to open a game server's player ports while that server runs, and, where this deployment has a names domain, the bot publishes a name for the server that points at the home's internet address while it runs. Every player who joins sees that address, a name can be found without being shared, and our DNS provider keeps a log of the addresses we set. See Router Ports, Names and Your Home's Address.
Members can be shown that home's internet address. This happens only for a game server whose administrator chose, for that one server, to let friends outside join, and only while it runs. It is shown to members of that server, as the server's name or as the address and the game's port, because it is what they type to join. A choice made for the whole Discord server never counts. See the same section.
A watch party on a box is reached directly. Its viewers connect to the box, so they see the home's internet address and the box sees theirs. See A Watch Party on a Box.
A media request can go to the operator's own request manager. Where the operator runs one (Seerr) on their own box, a title you ask for is filed there — as the Seerr user the operator chose, never as you — and the bot keeps the request manager's number for that title beside the request. See Media requests.
Music in a voice channel keeps who queued which song only while the session lasts. See Music in a voice channel.
The web console. Signing in to it sets one more strictly necessary cookie, described in the cookie table. The bot, not this website, checks who you are, and keeps no Discord token for you; while the console session lasts it holds your ID, name, avatar and servers in memory only.
A subscription bought through Discord's own store. Where this deployment sells Premium there too, the bot keeps a record of that subscription. See Billing.
A correction about the "what is my IP" lookup. The previous version said the bot asks a public service for its own internet address when a member starts a game server. The hosted bot never does that: its game servers are on administrators' own machines, and a box's address comes from the box's own connection. See Who Your Data Is Shared With.

If you last read the version dated 24 October 2026, the version dated 26 October 2026 changed this too:

Subscribe and Manage or cancel are described in words that hold while Asbern is free. Where a plan can be bought, Subscribe goes to Stripe's checkout page; Manage or cancel, for a subscription already running, goes to Stripe's billing portal. Where Asbern is offered free there is no Subscribe to press. What those pages collect is unchanged. See What Your Browser Sends Elsewhere.
A ban is appealed from the message it sent you. When a server bans you and tells you by private message, that message carries an Appeal button. An appeal sent from it opens a ticket only the server's staff can see — you are no longer in the server — and the verdict comes back to that same message. What an appeal records is unchanged. See Appeals you file, and their verdicts.
Nothing else on this page changed in this version.

If you last read the version dated 23 October 2026, the version dated 24 October 2026 changed this too:

A Sleeper fantasy league can now be one of a server's feeds. An administrator — or a group's Curator, for that group's own channels — can add a league by its link, and its trades, waiver results and each finished week's scores post as cards, like any other feed. The bot asks Sleeper's public API (api.sleeper.app) about that league. What it keeps is the league's id and name, which posts it has already made, and a copy of Sleeper's public list of NFL players' names — never anything about you. The team and manager names in a post are read from Sleeper when the post is made and are never saved. See Who Your Data Is Shared With.

If you last read the version dated 20 October 2026, the version dated 23 October 2026 changed this too:

There is no longer an Erase everything button. To have your data deleted, write to privacy@asbern.gg and say which server: a person checks that the request is yours and deletes your whole record there — the same record the button erased, with the same things kept back. That is a deletion request; see What You Can Erase.
Erasing your data no longer resets what you were already paid. If your data is erased part-way through a day, a week, a month or a season, the bot keeps the dates and counts that stop the same reward paying twice in that period — when you last took the Daily and Work, what you have earned today, which challenges and goals you have claimed, your pack and dig limits and today's battle winnings. They hold no balance, no messages and no history, only the ones for a period still running are kept, and the bot's daily clean-up deletes them once that period is over. See What You Can Erase.
Your first Poke Center heal of the day is free, and an erasure keeps that too. If your data is erased on a day you already took the free heal, the bot keeps that day's date — and nothing else — so it is not free twice; the daily clean-up deletes it once the day is over. See What You Can Erase.

If you last read the version dated 19 October 2026, the version dated 20 October 2026 changed this too:

The AFK prompt's card now says exactly when it goes. Besides when somebody acts on it, it is taken down once the person it names is back or has left the call, and it never stays longer than 12 hours — now also on a server that has switched off the bot's clean-up of its public cards, where until now an unanswered card could stay until somebody deleted it. A card somebody pins, or starts a thread from, is the one exception. See Message Content.

If you last read the version dated 15 October 2026, the version dated 19 October 2026 changed this too:

The bot now always asks Discord for presence information — who is online, idle or away, and what they are playing. It used to be something a deployment could switch off. It is used for the two counts it was already used for, and for one new thing: the AFK prompt, which notices that somebody in a voice call has gone idle so the people in that call can send them to the server's AFK channel. The prompt never stores anybody's status, and a member who has objected to activity counting is never read for one. See Message Content.

If you last read the version dated 8 October 2026, the version dated 15 October 2026 changed this too:

This website now counts its own traffic. Each page you open sends one short report to this website's own server, and so does the first press in the Asbern Demo that opens a demo sandbox, once per visit to the page. A line holds the UTC date and hour, a version number, which of those two things happened and, for a page, one word for the kind of page. It holds no IP address, nothing about your browser, no cookie and no identifier. The lines are kept on the server that runs this website, in a folder of their own and never beside the bot's member data, and each day's file is deleted after 365 days. See The Traffic Counters, under What This Website Logs.
The live tour is now the Asbern Demo, on the home page. Its section is renamed The Asbern Demo. What its sandbox holds and how long it is kept are unchanged.
The website can keep one flag in your browser's session storage. If you close the message beside the goat in the corner of the page, asbern-goat-hidden keeps it closed on the next page you open, until you close the tab. It holds the digit 1 and nothing about you. See Cookies.
The section headings are written as titles, with their main words capitalised. No section was reworded by it.

This page describes two separate things, because they hold different data and run in different places:

The bot — the Discord application that runs in your server. It runs on a machine, keeps files on that machine, and is what stores your levels, your balance and your activity counts.
This website — what you are reading. It shows you what the bot already holds, and it handles sign-in and, where a subscription exists, billing. It cannot change your levels, your balance, your inventory or your progress in any game. That is not a promise about intent, and it is worth saying precisely what holds it up rather than waving at "a test". The only part of the bot this website runs is the Asbern Demo on the home page, and what is proven — by a test that drives the code rather than reading it — is that a demo's throwaway server identifier can never be a real Discord server's. A press on this site therefore has no real record to reach. There is a second test that sweeps this site's own source for calls that would write to your record; that one reads the code, so it can be fooled by a call made one layer down, and the test says so about itself. The identifier test is the guarantee; the sweep is a tripwire beside it. What this site writes is short: the Asbern Demo's own throwaway sandbox — a scratch copy that is not, and cannot be, any real server — and, where a subscription exists, the record of that subscription's state when the payment processor reports a change. If the operator has switched on the traffic counters described below, it writes those too. All three are described in full further down, and none of them touches your levels, balance, inventory or game progress.

Who Is Responsible

This deployment is operated by Asbern LLC, who runs the machine the bot and this website run on and holds the files described below. You can reach them at support@asbern.gg.

Asbern identifies you by your Discord user ID — a number your Discord account already publishes. It never asks you for your email address, your phone number or your real name, and it never sees your Discord password. The card details that pay for a subscription are typed on Stripe's own pages and never reach us — see Billing, below. That checkout page does ask for an email address and a billing address: what you type there goes to Stripe, and to Link where the sale is made through Link, and not to us.

Signing in With Discord

Signing in to this website is optional. Without it you can read the site, try the Asbern Demo, and see the network-wide totals — no server's own figures and no member's.

When you do sign in, we ask Discord for exactly two permissions — identify and guilds — and nothing else. In particular we do not ask for your email address and we do not ask for your roles.

Adding the bot from this site is one Discord approval that does both. The Add to a server button asks for those same two permissions plus the two that add a bot to a server you pick in Discord's own list — bot and applications.commands — so you are signed in and the bot is added in one step. Neither of those two asks Discord anything more about you.

Discord then tells us:

your user ID, your username or display name, and your avatar image reference;
the list of servers you are a member of, and for each one whether you own it and what permissions you hold there;
and, if you have just added the bot, which server it was added to.

What happens next:

The access token Discord issues is used once and discarded. It is never written to disk, never stored in a database and never put in a cookie. A credential we keep is a credential we can leak, and we do not need one after the two calls above.
Your server list is intersected with the servers this deployment actually holds data for, and only the overlap is kept. If you are in two hundred servers and Asbern is in one of them, one ID is kept.
For those same servers, we note which ones Discord says you can manage — you own it, or hold Administrator or Manage Server there — because that decides who may start a subscription and who sees a server's module usage. Nothing else about your permissions is kept.
If the server-list request fails, we treat it as an empty list rather than failing your sign-in. That means you can see less than usual, never more.

⚠ That list is a snapshot taken when you sign in, and it is trusted for 24 hours. It is written into the cookie described below and read from there on every page, so if you leave one of those servers your sign-in keeps showing it to you — including that server's statistics and the profiles of its members — for up to 24 hours after you signed in. After that the list is emptied rather than trusted, and the site asks Discord again, which usually takes no clicks; until it has, the site shows you as signed out rather than as someone whose servers it can still see. The rest of your sign-in — who you are — lasts until the cookie expires 7 days after it was issued, or until you sign out. Signing out and back in rebuilds the list immediately. We would rather state that plainly than imply the check is live.

Signing out deletes the cookie. There is no server-side session record to delete, because there is not one to begin with.

Cookies

This site sets at most three cookies, all strictly necessary — your session, one that stops a forged sign-in and, only if you sign in to the web console, that console's sign-in — so there is nothing here to consent to and no banner to dismiss.

Cookie	What it holds	Lifetime
`asbern_session`	Your Discord user ID, your display name, a link to your avatar image, the intersected list of server IDs above, which of those you can manage, the server you have just added the bot to if you did, the name and icon of those same servers, when the server list stops being trusted, and an expiry time.	7 days
`asbern_oauth_state`	A random value used once to prove that a sign-in you started is the sign-in that came back, marked to say whether that sign-in is also adding the bot. It holds nothing about you.	10 minutes. It is deleted as soon as a sign-in completes, or when you cancel it on Discord's own page; a sign-in that fails any other way, or that you walk away from, leaves it in place to expire on its own
`__Host-asbern_console`	Set only if you sign in to the web console: an opaque sign-in token the bot issued and only the bot can read. It holds nothing about you — no name, no ID, no server list.	Until the bot's console session ends: at most 12 hours, or 1 hour without use. Signing out, or signing out everywhere, ends it

All three are HttpOnly (JavaScript on the page cannot read them) and all three are SameSite=Lax. The console's cookie is always marked Secure, and its __Host- prefix tells your browser to refuse it unless it is. Behind that cookie, while the console session lasts, the bot holds your Discord user ID, your display name, a reference to your avatar image and the IDs of up to 200 of your servers that the bot is in — in memory only, never on disk, and forgotten when the session ends or the bot restarts. Earlier versions of this site set a third cookie to remember where to send you after signing in. Nothing sets it now, and if your browser still holds one, your next sign-in deletes it.

The server names and icons in the first cookie are there so that your servers can be shown to you by name instead of by number. They cover only the servers in the intersected list above — the ones you are in that also run this bot — and they are the same names and pictures Discord shows you in its own sidebar. They are dropped from the cookie the moment that list goes stale.

⚠ On the first two, the Secure flag is set from the build mode, not from the address bar. They are marked Secure — meaning your browser will only ever send them back over HTTPS — whenever the site is running with NODE_ENV=production, which is how the shipped container runs it. A developer running this site locally in development mode gets them without that flag. We say it that way round because that is what the code actually checks; it does not inspect the scheme of the request.

⚠ The session cookie is signed, not encrypted. The signature stops anyone editing it — adding a server you are not in is the attack it prevents — but it does not hide the contents from whoever holds the cookie. Nothing secret is put in it for exactly that reason.

There is no advertising, no tracking pixel, no third-party script and no fingerprinting.

The site can keep two things in your browser's local storage, and only if you use them. Neither is a cookie, neither is sent to this site or anywhere else, and clearing this site's data in your browser removes both:

asbern-theme holds your light or dark choice. It is written when you press the theme switch; until you do, the site follows your device's own setting and writes nothing.
asbern.stats.presets.v1 holds any statistics presets you save. Each one keeps the name you give it, which view it opens, which series are switched on, any average lines you added, whether the reference line is shown, and the date range. Apart from the name you type, it holds no member's name or ID. Applying a preset changes the page's filters exactly as choosing them by hand does, so its date range travels in the page address like any other filter; the saved list itself stays in your browser.

The site can keep one thing in your browser's session storage, and only if you use it. asbern-goat-hidden is written when you close the message beside the goat in the corner of the page, so the message stays closed on the next page you open. It holds the digit 1 and nothing about you, it is never sent to this site or anywhere else, and your browser deletes it when you close the tab.

The site keeps two anonymous counters about itself where the operator has switched them on; they are described in What This Website Logs, below. They set no cookie, read none, and hold nothing about you.

What Your Browser Sends Elsewhere

One outside host receives requests directly from your browser: cdn.discordapp.com, which serves Discord's own images. What it is asked for is an avatar, a server icon or a custom emoji, and which of those reach it depends on whether you are signed in:

On every example bot card on this site, the avatar drawn on the card is Discord's own default, anonymous avatar (cdn.discordapp.com/embed/avatars/0.png). Those cards are canned screenshots of the bot, so that image is the same for everybody and the request happens whether or not you are signed in.
In the Asbern Demo, if you are already signed in, your own avatar is drawn instead, so the demo looks like yours. That is the one case where the address of the image identifies you.
On your own signed-in pages — your server list and the statistics pages — each of your servers is drawn with its own icon (cdn.discordapp.com/icons/…), and where a members table has a row for you, that row is drawn with your own avatar (cdn.discordapp.com/avatars/…). Both addresses are built from what is already in the session cookie described above, so neither request exists until you sign in, and the icons cover only the servers you are in that also run this bot.
Other members' pictures, on a server's statistics pages. Where the bot has recorded a member's picture (see What the Bot Stores About You), the members table and the list you pick members to compare from load it from that same host: the picture that member set for that server (cdn.discordapp.com/guilds/…/users/…/avatars/…) where they have one, and their own Discord avatar (cdn.discordapp.com/avatars/…) otherwise. Those addresses carry the member's Discord ID, so loading them tells Discord which members' pictures your browser asked for. A member who has objected to activity counting is not in those lists, so their picture is never loaded by anybody else. A member with no recorded picture, or whose picture Discord no longer serves, is drawn as a coloured monogram by this site itself, never with Discord's default avatar for their ID, which would be a confident, wrong picture for anybody who has ever set their own.

Loading an image from Discord's CDN discloses your IP address and browser to Discord, as loading any image from any site does. Discord's own privacy policy covers what they do with it.

⚠ A card can also draw a server's custom emoji as an image from that same host (cdn.discordapp.com/emojis/…), and as this version ships, one of them does. The example cards use the bot's own Pokeball emoji, so opening a page that shows one makes a second image request to cdn.discordapp.com alongside the avatar above. It is a picture and nothing else: the request carries no account of yours, and it is the same for every visitor whether or not you are signed in.

⚠ This paragraph used to say no such request was made, and until 2026-09-09 that was true — every emoji in the example cards carried a placeholder ID, and a placeholder is drawn as plain text rather than fetched. It stopped being true the moment those cards started showing the real emoji, which is a visible improvement to the pictures and a new outside request at the same time. Both halves are stated here rather than only the nice one.

No other outside host is loaded by this site's pages at all — no web font, no third-party script, no tag manager, no tracking pixel. Everything else comes from this site's own server.

Some presses take your browser to another site rather than loading anything into this one: Sign in with Discord goes to Discord's own page to approve it, and back. Where a plan can be bought, Subscribe goes to Stripe's checkout page, and the billing portal behind Manage or cancel — for a subscription already running — is Stripe's too. What those pages collect is set out under Billing, below.

Our own server talks to Discord (discord.com) on your behalf, for the sign-in described above. It also talks to Stripe (api.stripe.com) when a subscription is started — see Billing, below.

⚠ The Asbern Demo runs the bot's own code inside this website, so it is fair to ask what that code can reach. It reaches nothing further, and the reason is that the website is handed none of the bot's integration credentials: no media-server token, no download-client keys, no statistics-provider key. A demo sandbox also starts with nothing configured in it, so those parts of the bot have nothing to contact.

⚠ The bot itself is a separate program on a separate network path, and it does contact other things — everything its operator has switched on, plus one address nobody configures. All of that is set out under Who Your Data Is Shared With, below.

What This Website Logs

Nothing in this site's own code records an IP address or a user agent — anywhere, in any mode, including in the counters described below. There is no request log and no access log in it. What it does write is a note when something fails on its own server. Each note goes to the website's own output (in the shipped container, its log; never to a file of its own), none is ever shown to the visitor, and they come in these forms:

A page or request that fails writes one line: when it happened, which page it was — without anything after a ? in its address — a shortened error message, where in the code it broke, and an error reference. That line never holds your IP address, your browser, your cookies or the body of your request, though the error message can repeat a piece of what you sent, which is why it is shortened.
A press in the Asbern Demo that fails is caught by the demo itself and writes a trace instead: the error message in full and the chain of code it passed through, which can run to many lines. Before it is written, your Discord display name and picture are taken out of it — except a display name shorter than three characters, which is left in, because removing so short a string would shred the trace. The demo runs you under a made-up ID, so your Discord user ID is never in it, and it never holds your IP address, your browser or your cookies. It can include what you pressed.
A checkout that fails writes one line with Stripe's reply, cut to 300 characters, so the operator can see what went wrong. Stripe's reply can repeat part of the request, which carries the server's ID and the Discord user ID of the account that started the checkout. It never holds your IP address, your browser or your cookies.
A second subscription for one server — two checkouts that both completed — is cancelled at Stripe automatically, and writes one line so the operator can refund it: the server's ID, the two Stripe subscription IDs and whether the cancel went through. It never holds the Discord user ID of whoever paid, your IP address, your browser or your cookies.

When a page fails in your browser, the error is also written to your browser's own console, on your device. Nothing on this site reads it.

The Traffic Counters

The site counts two things about itself: that a page of some kind was viewed, and that a session of the Asbern Demo was opened. They answer two questions — which kinds of page are read, and whether the demo on the home page is opened — and they are the only thing this site counts about the people who visit it.

On this site they are on. Each page you open sends one short report to this website's own server — never to anyone else — and so does the first press in the Asbern Demo that opens a demo sandbox, once per visit to the page.

When they are on, one line is written per report, and a line can hold only these four things:

Field	What it is
The time	The UTC date and hour. Not the minute, not the second.
A version number	Which shape the line is in, so an old line can still be read.
The event	One of exactly two words: a page was viewed, or an Asbern Demo session was opened.
Which kind of page	For a page view only, and only one word from a fixed list: `home`, `pricing`, `features`, `docs`, `stats`, `legal`, `other` or `unknown`. It is worked out from the address of the page that sent the report by comparing it with this site's own; the address itself is never written down, and anything not on this site is simply `other`.

That is the entire record. No IP address, no user agent, no cookie — none is set and none is read — no visitor or session identifier, no Discord ID, no display name, no avatar, no referring hostname, no screen size, no language, no country. Nothing in a line can be tied to a person, and no two lines can be tied to each other: a "visit" is not a row here, it is a tally.

Where the lines are kept. On the server that runs this website, one file per day, in a folder of their own. That folder is never inside the bot's member data: the website switches the counters off rather than write there.

How long. Each day's file is deleted after 365 days. The first line written on a later day removes every day file older than that; nothing else is ever deleted from that folder.

Who can read them. The operator, on that server. Over the web, only once the operator separately sets a secret token for it: until then that address answers "not found" to everyone — including the operator.

The hosted configuration this software ships puts a reverse proxy (Caddy) in front of this site, and it writes a line for each request: when it was made, which page was asked for, and how it was answered. Before a line is written, the proxy removes your IP address, your browser's user agent and every header that could carry them. The lines go to the container's own log, which is rotated at 10 MB with 3 files kept, never to a file of their own. If whoever runs this deployment has put a different proxy in front of it, that proxy's logs are theirs to configure.

What the Website Can Show, and to Whom

The site reads the bot's data through a single query layer with a fixed list of readable things. Every one of them is checked against one of four levels of access before it runs. Three are about you and the servers you are in, and come first; the fourth is the operator's, and comes last.

Anyone, signed in or not, sees three numbers: the total messages and total voice minutes across every server on this deployment, and how many servers the bot is in, free and paid together — and, month by month, how the first two totals have moved, with how many years of history the network holds. Voice is counted as all the time spent connected. Those totals include every server's whole history — what Asbern recorded itself and any history a server's administrator imported from another bot. No server is named and no member is named. That is the whole of the public view, by construction — the readouts behind it cannot return anything else.

A signed-in member of a server sees that server, and only the servers Discord says they are in. That covers the server's message and voice totals, its activity over time, its growth, its leaderboards, its per-member table — one row per member of the server with their message and voice figures side by side — its per-channel breakdown, its heat map, its hour-of-day and weekday profiles, its active-member counts, the change from the period before, how far back the archive goes, which time zone its days are counted in, and the individual profile, standing and hour-of-day pattern of any member of that same server. This deployment offers Asbern free, so every server's figures are shown to its own signed-in members, as they are on a server with a subscription.

Six further readouts cover that same server, added as the bot learned to record them. Its thread participation — how many of its messages were posted in threads, and how many threads were started. Its mention counts: how many mentions each member gave and how many they received, labelled by name the same way its leaderboard rows are. Its role membership over time, with the grants and removals underneath it. The busiest moment in voice each day, and the channel it happened in. Which parts of the bot get used, counted per module — how many members opened each one and how often, never what any one person did inside it — and that one is shown only to people who can manage the server, meaning Discord says they own it or hold Administrator or Manage Server there. And how long new members take to say something for the first time, together with how each month's arrivals have fared since; that last one is counts only and names nobody, at any depth.

And six more, added in this version. Where a server's history was brought across from another bot, which months that other bot measured, so each chart can mark the imported stretch — month keys and counts only, naming nobody. A comparison of up to four members of the server side by side on one chart, labelled by name the way a leaderboard row is. Its engagement counts — reactions, attachments, links, edits, deletions, stream time, thread messages and mentions — added up for the whole server per period, never per member. Its online headcount over time: how many members were online, idle and do not disturb, never who. The games played there, game by game: the minutes played and how many different members played it, never which ones. And its invite leaderboard: who brought people in, labelled by name, and the routes people arrived by. A member who has objected to activity counting is left out of the comparison and off the invite leaderboard.

⚠ Several of those began recording later than the archive itself. Where one has no history for the period you are looking at, the page says so rather than drawing a zero — "nobody did this" and "we were not measuring yet" are different facts, and this software will not present them as the same one.

⚠ That last part is deliberate and you should know about it. A leaderboard is a table with other people's rows in it; a board where every row but yours is hidden is not a board. So another member of your server can open your activity profile, and you can open theirs. Those rows are labelled by name, using the display name kept beside the activity archive that is described under What the Bot Stores About You below; where the archive holds no name for somebody, the row says so rather than printing a bare ID. The full ID is in the page address of an individual profile.

If you have objected to activity counting, nobody else is shown you. You are left out of the leaderboards, the per-member table, the mention counts, the invite leaderboard and the comparison, and another member who opens your profile is told your statistics are not shown here. That message does tell them you are hidden, and we would rather say so than pretend it does not. You can still open your own. Nothing about you as an individual is visible to anyone who is not in a server with you — the only thing a stranger can see that you contributed to is your share of the two anonymous network-wide totals, which name nobody and no server.

Membership is asked of Discord, never of our own files. Our files know which servers the bot is in; that is a different question, and answering with it would hand a stranger any server we hold data for. When you are refused, the refusal deliberately does not say whether the server exists.

⚠ Discord is asked at sign-in, not on every request — see the snapshot note under Signing in with Discord. So the guarantee is that we never invent a membership from our own records; it is not that the answer is checked afresh each time you open a page.

And one page more, for the operator of this deployment. Only the Discord accounts this deployment's own configuration names as its operators can open it. Nothing a visitor holds can make an account one of them — not a cookie, not a server role, not an administrator's permission in any server — and to everybody else, signed in or not, its address answers as though it did not exist. It reads the bot's usage archive (see Diagnostic Logs) for a period the page asks about, and covers the servers that were active in it — the busiest listed one by one, the rest counted only in the totals. It shows how many interactions happened; which buttons were pressed, by the button's internal name and never what anybody typed — anything after a | in that name (which item was chosen) is dropped, and so is a page or tab number that ends it, though a number elsewhere in the name is kept; how many failed or were refused; how quickly the bot answered; the error codes behind the failures and the rules behind the refusals; one count of the distinct members who used the bot, across every server together; and how far back that archive goes. It also shows the same counts for the period before it, so the page can say whether a number is rising or falling — and, where the archive does not reach back far enough for that comparison to mean anything, it says so instead of calling a quiet server a busy one. It ranks which parts of the bot are used most, and which have stopped being used; it can open one server on its own — that server's presses, the features it uses and the problems it hit; and, from any one feature, which servers press that one thing. It shows the bot's own in-game currency moved across every server, which is play money: no price, payment, subscription amount or revenue figure exists in anything this site can read, so none can be shown. It says when the usage archive was last written, so a page that has gone stale cannot be mistaken for a quiet week. And it lists which servers this deployment serves and whether each one's subscription is active, read from the deployment's own billing files — no purchaser is named, and no card, payment identifier or billing detail is read or shown anywhere on it. Servers are identified by ID, or by name where the operator is a member of them — the names come from the operator's own Discord server list at sign-in, never from our files. No member is named on it, and there is no per-server member breakdown at all. The operator can also switch on a private feed in Discord, which is not this page and does name servers — see The operator's private feed in Discord, below.

The Asbern Demo

The Asbern Demo on this site's home page runs the real bot against a throwaway sandbox created for your visit: a temporary directory whose identifier cannot be a Discord server ID, so a press in the demo can never reach a real server's data. It starts empty and is seeded with an invented member.

How long it lasts. A sandbox is deleted within 30 minutes of your last press. That is enforced by a sweep running on a timer inside the website — once a minute — as well as on every press in the demo, so the last visit of the evening is cleared like any other instead of waiting for somebody else to arrive and trigger it. No more than 200 sandboxes exist at once; past that, the oldest is removed early to make room.

⚠ One honest limit, so you are not told more than the code does. The index of live sandboxes is held in the website's memory. If the website process is restarted before the sweep reaches one, that directory is left behind in the machine's temporary folder for the operator's own housekeeping to clear. What is in it is the invented member and whatever you pressed — never any real server's data, because a demo sandbox structurally cannot be a real server.

The demo sets no cookie and needs no account. If you happen to already be signed in, your display name and avatar are drawn on the card so the demo looks like yours — that reads the session cookie you already have and writes nothing new. Anything the bot writes while you press buttons goes into the throwaway directory and is deleted with it.

The Operator's Private Feed in Discord

This is off unless the operator of this deployment switches it on, by naming one channel in their own Discord server. When it is on, the bot — never this website — posts a short card to that channel each time it is added to a server or removed from one, and, where this deployment sells subscriptions, each time a server's subscription changes. It exists so the people who run the bot can see who is using it.

What a card shows:

the server's name, its ID and its member count at the moment the card is posted — for every server, including servers the operator is not a member of, which the operator's page above never does;
for an add, the Discord account that added the bot, read from that server's audit log where the bot is allowed to read it. That name is put on the card and is not kept anywhere on the machine;
for a removal, since when the bot had been there, and, where subscriptions are sold, the subscription's state in words;
a subscription change in words — a free trial started, a subscription started, a payment, a renewal, lifetime access bought, a complimentary code applied or withdrawn, a payment that failed, a lapse — with, where it was recorded, which plan it was for. Never an amount, a card, an email address or a payment identifier.

Nobody is mentioned or notified by a card. The bot refuses to post unless the channel is private — @everyone cannot see it and no role is allowed to see it — and checks that before every post. ⚠ Anyone holding an administrator role in the operator's own server can still read it, because Discord lets administrators see every channel.

What the bot keeps to do this is one file on the machine. For each server the bot has been in it holds the server's ID, name, member count and icon, when the bot joined and when it was removed, and how many times it has been added. Where subscriptions are sold it also holds, per server, the subscription's current state in a word, a count of the payments on the current subscription, and one-way fingerprints of the billing events it has already announced, so it never announces one twice — never the payment processor's own identifiers. It also holds the cards waiting to be posted. It holds no member's ID or name. The machine's daily backup leaves this file out; a snapshot of the machine's data taken by hand — the one taken before each update, for instance — includes it, and is kept as Backups below describes.

How long it is kept, and deleting it. The file stays until the operator deletes it: switching the feed off stops it changing, but does not delete it. A server's entries are deleted with the rest of its data if a deletion of that server's data is asked for, except the server's ID and the time of that deletion, which stay so that a billing record kept because its subscription is still running is not announced all over again — what that subscription does afterwards is announced, and remembered, like anything else. ⚠ The cards already posted are messages in the operator's own Discord channel, and a deletion request does not reach them by itself: when a request names a server, the operator deletes that server's cards by hand. A request to delete only your own data does not reach them either. A card names the account that added the bot; if that is you and you want it gone, write to privacy@asbern.gg.

Billing

Payments are processed by Stripe. Card numbers, expiry dates and security codes are entered on Stripe's own pages and never reach us — that is the entire reason for using a processor.

When a subscription is started, we send Stripe the Discord server ID the subscription is for and the Discord user ID of the person starting it, so that a payment event arriving months later can be matched back to the right server. Where a promotional price applies, the checkout also carries that promotion's own identifier — a name for the offer, not for you. Stripe is a payment processor in the United States and has its own privacy policy.

⚠ Where the checkout page says the sale is "Sold through Link", the seller is Link, not us. This deployment sells through Stripe's Managed Payments unless its operator has switched that off, and under Managed Payments Link — Stripe's payment service — is the merchant of record: the business that sells you the subscription, and that works out, collects and pays the sales tax on it. To do that, Link collects from you, on its own checkout page, your email address, your billing address and your payment details. The receipt comes from Link; the charge appears on your card statement beginning LINK.COM* followed by the seller's statement name (LINK.COM* ASBERN for the hosted Asbern service); and you can cancel the subscription at link.com as well as by writing to us. What Link collects it holds as its own business, under its own privacy policy. Stripe's notices to this site about a subscription can carry some of those details on the way past; the site reads out of them the server ID, the subscription's IDs, its state and the Discord user ID of the person who started it, and keeps nothing else — not your email address, not your address and not your card.

What we store on our own disk for a subscribed server is exactly this, and nothing else:

the subscription's state (active, in grace, read-only, or lapsed);
the Stripe customer ID and subscription ID;
the Discord user ID of the person who started the subscription — the only account this site lets manage or cancel it;
when it last changed;
when the subscription on record ended, if it has — which is how a subscription that has ended is told apart from one whose card is still being retried;
whether the server bought lifetime access — a single flag, set when a one-time purchase is paid for, saying that there is nothing left to renew or cancel;
when the server's free trial ends, once Stripe has said so — which is how the bot can name the date to the server's admins;
while a checkout for the server is open, when it was opened, when it expires, which rate was chosen and Stripe's ID for that checkout — which is how a second checkout for the same server is refused while the first is still open. It is removed when that checkout completes or fails to open, and it names nobody;
a rolling history of the last 20 billing events — and for each of those, six things: the time it was recorded, the event type, the reason, the resulting state, for an event that came from Stripe, Stripe's own ID for the event, which is how the same event is never applied twice, and, for a purchase or a payment where Stripe says so, which plan it was for — monthly, annual or lifetime, a word and never an amount;
and, where a server was given access by a complimentary code instead of a card, the record of that: a one-way fingerprint of the code rather than the code itself, the label it carries, when it was redeemed and, for a code that lasts a set time, when that time ends — plus one line in the history above, which for a comp also carries that label.

Never a card number, never a card token, never a secret. Those live at Stripe.

⚠ Complimentary codes exist, they are the path this deployment has actually tested, and neither document mentioned them before today. They are set by whoever runs this deployment, they are not yours and they carry nothing about you — but a code that grants free service is a credential, so what is written down is a fingerprint of it and not the code. A record written before that change still holds the code as typed; it is dropped from anything that reads the record, and it leaves the disk the next time that server's billing record is written at all.

Where this deployment also sells Premium through Discord's own store, a server can subscribe inside Discord instead, and Discord takes the payment. The bot then keeps a separate record of that subscription: whether it is live, when it ends, and Discord's identifiers for the subscription and its entitlement — stored only as a short hash, enough to match the next event Discord sends about them, and nothing more than that: a short hash of an identifier can be matched back to it by trying candidates, so we do not call it secret. It holds no purchaser ID. It is kept while a Discord subscription is live; a deletion request made after the last one ended or was refunded removes it. A server that has subscribed through Discord before does not get a free trial on this website. Where the deployment does not sell through Discord, nothing of this is written.

A subscription record is kept for as long as the rest of the server's data is: after a subscription lapses, because it is the record of what a server bought, and after the bot is removed from the server. That includes a server that removes the bot while its subscription is still running — paid up, with a payment being retried, or covered by a complimentary code that has not run out (a code lasts either a set time, such as three months, or until it is withdrawn). Removing the bot does not cancel a subscription, and re-adding the bot during a paid term brings the paid features straight back. The record is also how a server that comes back is recognised as one that has subscribed before, which is why it gets no second free trial. Like the rest of a departed server's data, it is deleted only if somebody asks for that server's data to be deleted — see If a Server Removes the Bot — and even then it is kept while the subscription is still running: paid up, with a payment being retried, or covered by a complimentary code. Deleting it then would make the server read as never billed while it is still being charged or still holds its code. Cancel the subscription first (or have the code withdrawn, or let its time run out), and the record can go once it has ended.

⚠ The site also reads the bot's own list of servers it has left. That list holds server IDs and when each departure was noticed — nothing about any member — and the site only reads it: your servers page marks a server the bot has left, and the checkout refuses to start a subscription for one.

What the Bot Stores About You

Which of these exist depends on what the server's administrators have switched on. Everything is keyed by your Discord user ID.

⚠ This list covers the main stores and is not exhaustive: a feature an administrator switches on can keep its own small record — a ticket you opened, a poll you voted in — keyed the same way and erased by the same request described under What You Can Erase.

Progression — your level, XP, rank, prestige tier and achievements.
Your display name in that server. It is kept alongside the activity archive so old statistics can still be labelled after a rename — and it is also written into any record a member of staff will read back later: a moderation case or warning raised about you, an automod appeal you filed, a ticket you opened, an onboarding application you submitted, a giveaway that was drawn. Those all keep a name beside the ID, cut to 64 characters, for the same reason: a record that reads "user 1234 was warned by user 5678" is unreadable a year later. ⚠ We would rather write that list than claim a shorter one. Everything counted, tallied or scored — levels, currency, activity, game progress — is keyed by your Discord ID alone, and the places that keep a name are the places that keep a record of something somebody did.
⚠ A member record held with the statistics archive — who you are, not only what you did. Beside the counts the bot keeps one row per member, and it holds more than a name: whether the ID is a person or a bot, the display name a card should print, your Discord username, your account-level display name, your nickname in that server, a reference to your avatar and to your server-specific avatar where you have set one — a reference, not a copy of the picture — when you joined that server, and when the bot last saw you. It also records, once each and never again, the first time you sent a message and the first time you joined a voice channel there, which is what lets a server say how long its members take to settle in rather than only how loud they are now. It is written when you join, when your name or nickname changes, and by a sweep that runs once a day. A row is merged, never replaced, and a member who has left keeps their row, because a four-year chart with an unlabelled column on it is a chart about nobody. Any member of that server can find you by these names with Members, under Other in /menu, and open the same public card you can already show from the leaderboard or from your row on a casino card — a card you have switched off does not open, and if you have objected to activity counting it shows no activity.
Which parts of the bot you open. Per day, for each part of the product — the casino, the Pokémon console, the screening room, the admin console and so on — how many times you entered it and how many presses you made inside it. This tally records the part and nothing finer: not which button inside it, not what it did, not anything you typed into it. Apart from the raw diagnostic event log, which keeps each press with your Discord ID for 90 days (see Diagnostic Logs), the one lasting record of which door you press is the quick-links profile, immediately below.
⚠ Which menu doors you press, for your quick links. The General tab of /menu shows Daily and then up to four quick links chosen for you — the doors you use most. To choose them, the bot keeps a small profile per server: for each menu door that can be a quick link (the casino, your rank, the Pokémon console and so on), a count of how often you have pressed it, which door sits in which position on your row, and the day the counts were last updated. It is not a log — there is no time of day, no list of presses, and nothing about what you did once you were through the door. The counts halve every 14 days, so last month's habit fades, and a door whose count falls below a twentieth of one press is forgotten. ⚠ The halving is worked out when the counts are next written, so if you stop using the menu, the last counts stay as they were until you press a door again. Presses are held in memory for up to a minute before they are written, so a restart loses at most that minute. It is used only to arrange your own General row: nobody else sees it, it is on no leaderboard, and nothing else in the product reads it. It is kept on your levels record in that server for as long as that record is, so a deletion request removes it. If you have objected to activity counting — see What You Can Erase — the profile is deleted at once, in the same write that records the objection, and no press is recorded after that.
In-server currency — your balance, your items, and your lifetime earnings. This currency has no real-world value and cannot be bought or cashed out.
Activity counts — per day: how many messages you sent, how many minutes you were connected to a voice channel, how many of those minutes you were actually engaged, how many of them you had your camera or screen share on, how many milliseconds you spent watching in the screening room, how many reactions you gave and received, how many messages you edited or deleted, how many carried an attachment, and — only where the counter is switched on for the whole deployment, see below — how many contained a link. Four more count conversation rather than volume: how many of your messages were sent inside a thread — a subset of the message count, not an addition to it — how many threads or forum posts you started, how many times you mentioned somebody, and how many times somebody mentioned you. Messages and voice minutes are also counted per channel, so there is a per-day record of which channels you were active in. Voice is counted per channel in both of the two ways it is measured — the minutes you were connected, and the smaller number of minutes you were actually in a conversation (unmuted, with somebody else there) — so the per-channel record distinguishes sitting in a channel from talking in one. These are counts: what you said and which links you posted are not stored by any of them, and neither is the name of a file you attached. The one place a filename can be held at all is the staff delete log described below, which is off in every server by default. ⚠ Two of these are counted about you because somebody else acted — reactions received, and mentions received. Nothing about the message itself is written down: not its text, not the channel it was in, not who else was named in it. Who mentioned whom is a separate counter and is described a few lines further down.
⚠ An hour-of-day profile. Alongside the daily counts, the bot keeps a per-member tally of which hours of the day you are active in — messages, engaged voice minutes and connected voice minutes, filed under the hour they happened in your server's local time and added up over a whole month. It is what draws the "when is this member around" pattern on a profile. The daily counts above are also held hour by hour for the trailing 48 hours — that is what draws the 24-hour chart — and pruned away after that; only messages, engaged voice minutes and connected voice minutes survive the pruning into this profile. It has no day dimension — a month gives 24 numbers, not 24 numbers per day — and it is not deleted on any schedule: it is part of the server's long-run history and is kept for as long as that history is. It is a coarse routine, not a location and not a log of what you did.
Who you were in voice with, and who you talk to — for each minute you share a voice channel with somebody, a counter for that pair; and, separately, a counter for who replied to, who reacted to, and who mentioned whom. Each of those is two Discord IDs and a number, filed under a day — never a message, never a word of one, never a channel. This is what lets the statistics describe a community rather than a list of individuals. ⚠ Where one of those pairings cannot be recorded, the number missed is kept beside it rather than quietly dropped — so a chart drawn from these can say how much of the picture it is missing instead of implying it is complete. The missed count is a number and nothing else: it names nobody.
⚠ Game and activity time. Where the bot receives Discord's presence information — see Message Content for when it does — it counts, per day, how many minutes you spent on each activity Discord shows beside your name: playing a game, streaming, listening, watching or competing. Each is kept under the activity's name as Discord gives it — a game's title, say — with the minutes filed under the day they happened in, split at local midnight. The names themselves are kept once, in a shared list of activity names that carries no member ID. ⛔ Your custom status is never recorded — its text is something you typed — and neither is anything else a presence carries beyond the kind of activity and its name: not the details line, not the state, not a party or an invite. If you have objected to activity counting, nothing is recorded for you and a session already open is dropped without being counted. An import from StatBot, described below, can fill the same record for the time before the bot joined your server, with StatBot's own figures. A deletion request removes your game-time rows along with your other activity counts, whichever of the two wrote them.
Game progress — your Pokémon, Pokédex, items, battle record, casino and tycoon state, and anything else you have earned by playing. For the casino that includes a running record for each game: rounds played, rounds won, your current and best winning streak, your biggest win, and how your last round went (so a card can tell a new best from an old one). ⚠ That record is not private. The casino's own cards in a channel — a closed table, a duel, a big win — can show it beside your name ("5th duel win · 3 in a row") to anyone who can read that channel, and there is no switch for it. It never shows losses, and never your spending or your ledger.
Watch history — what you watched through the screening room, for how long, and where you got to, so it can offer to resume. The "where you got to" markers are dropped 90 days after you last watched that title; the history itself is kept until you clear it.
Media requests — if the server runs the screening room and you ask for a title the library does not have, the bot records that request: the title, its year, whether it is a film or a show, the request manager's number for the title when the server uses one, and — for each person who asked — your Discord ID, the channel you asked in, and the server. It also holds a per-member "DM me when it lands" preference, which is off unless you switch it on yourself. Making the request also puts the title on the operator's own Plex watchlist — or, where the operator runs a request manager (Seerr) on their own box, files the title there, as the Seerr user the operator chose and not as you; what leaves this deployment when it does, and what does not, is set out under Who Your Data Is Shared With.
Music in a voice channel — where a server plays music from its own library in a voice channel, the bot keeps, for that session only, who started it, who queued each song and who voted to skip. That record is deleted when the session ends; a queue left waiting — the box went offline, everyone left, the bot restarted — is held for at most 30 minutes for the next Play, then deleted. A deletion request removes you from it at once. My Spotify reads what Discord shows you listening to on Spotify once, at the moment you press it, and stores nothing.
The counting game — for each counting channel on the server: how many valid counts you have made there and whether you counted last. A counting channel that is removed or deleted keeps that record, so the count carries on if counting comes back to that category. A deletion request removes you from every channel's record.
Game servers — how many times you have started each one.
Moderation records — warnings and cases raised against you, including a voice ban (how long it lasts, and who lifted it, if anybody did) and a removal from a category (which category, who removed you and when — that one records IDs and no names); the reason a moderator typed; and your Discord name as it stood when the record was made, and the name of the moderator who made it, both cut to 64 characters, for the reason given above. A case never contains the text of your messages. The server's staff can see these records, and you see the ones you can still appeal on your own Appeals screen. A moderator can void a case, which marks it withdrawn and stops it counting against you; the record itself is kept, deliberately, so that a moderator's action stays answerable — the most recent 5,000 cases per server, past which the oldest go first.
Appeals you file, and their verdicts — which case you appealed, the statement you typed (up to 2,000 characters), your Discord name at the time, the ticket it opened, and the verdict: Accepted, Reduced or Rejected — or Withdrawn, if you closed it yourself — with who decided it, their name, when, and any note they added. The verdict card is posted in the appeal's ticket channel, which you and the server's staff can see; you also see the verdict on your Appeals screen for 30 days after it, and normally in a private message too. A ban is appealed from the Appeal button on the private message it sent you: that appeal's ticket channel is seen by the server's staff only, since you are no longer in the server, and its verdict comes to you in that message. A member of staff can never decide their own appeal.
⚠ Your birthday, if the server has switched birthdays on and you have given it one. That is the day and month, and the year as well if you choose to add one — the year is never required and leaving it out is a supported answer. This is the only date of birth anywhere in the software. The feature is off in every server by default, nothing here is written unless you type it, and you can remove it yourself from the same place you set it — a removal really deletes the row rather than blanking it.
Reminders you set — unless the server has switched reminders off, the note you typed, when it is due and where it should be delivered. On by default; kept until it fires; nothing may be set more than three years ahead. Once a reminder has reached you, the note, where it went and when you set it are kept for one more day so its card can Snooze it — only you can — and are then deleted. If a reminder could not be delivered — your DMs from the server were closed, say — a short notice of that (its number and the reason, not the note) is kept for a week so your Reminders screen can tell you, and is then deleted.
⚠ Who invited you, and who you invited — where the server has switched invite attribution on. Each row is a pair of Discord IDs, the invite code used, when it happened, whether the account looked new enough to be counted as fake, and whether the person has since left. Only the most recent 500 rows per server are kept; the running per-inviter totals behind the leaderboard are not trimmed at all. Off by default, deliberately, because it records a durable link between two members.
Polls, tickets and starboard entries — where those features are switched on. A ticket holds text you typed; the rest hold IDs and counts. ⚠ Suggestions were retired, so there is no longer any way to post one. A suggestion posted before that is still held, and is erased by the same request as everything else on this list.
Feedback you send — the words, your Discord ID and your display name, filed with this server's staff or sent to the bot's owner, whichever you chose. What each one keeps is set out under Who Your Data Is Shared With.

⚠ And four things counted about the server rather than about you. These carry no member ID at all — there is nothing in them that can be traced back to a person — but they sit in the same archive, and it would be wrong to describe that archive without them.

Joins and leaves, per day, and — where the bot can tell them apart — whether a leave was somebody going of their own accord, a kick, or a ban. It is a daily tally and never a list: no departure is recorded against anybody's name here.
Boosts and unboosts, per day, counted the same way.
The busiest voice moment of each day — the largest number of people who were in voice at one instant, the hour that happened in, and the same figure for each channel. It is a maximum, not a roster: it says twelve people were in voice, never which twelve.
How many people hold each role, recorded once a day, and how many times each role was granted or taken away. Keyed by the role, never by the member: the record can say a role was granted eleven times and cannot say to whom.

⚠ The bot also keeps the names of your channels and your roles beside the archive, for the same reason it keeps display names: once a channel or a role is deleted, Discord can no longer say what it was called, and the archive still holds years of counts filed under its ID. Those rows carry no member ID either, and nothing there is ever deleted.

⚠ And one more count about the server, with nobody in it: how many people were online. Where the bot receives presence information, it records for each hour how many members were online, idle and do not disturb, as last seen in that hour — bots included, the way Discord's own member list counts them. It is a headcount, never a roster: it cannot say who was online, and the bot keeps no record of when you personally were online or what your status was. An import from StatBot can fill the same count for the hours before the bot joined.

⚠ And one store that is not the bot's own doing but sits with its files. Where the operator brought a server's history across from a previous statistics bot, the raw responses from that service are kept beside the statistics as the record of what was imported. Those responses are that other service's own shape rather than ours, and they can carry usernames, nicknames and avatar references for the members they cover. Nothing in the bot reads them and nothing renders them; they exist so an import can be checked or repeated. If no history was imported, the directory does not exist. Those captures come from the operator's own import tool; the import a server's administrator can run, described next, writes none of StatBot's raw responses to disk.

⚠ History brought across from StatBot, at an administrator's request. A server's administrator can ask the bot to copy that server's history from StatBot — a statistics bot the server may have used before — so its charts do not start on the day this bot arrived.

The key is the administrator's own, and it is not kept. StatBot shares history only through its API, with a key the administrator creates in StatBot and pastes in. The bot sends it to StatBot's API (api.statbot.net) and nowhere else, holds it in memory only, until the fetch ends — whether it finished, failed or was cancelled — and never writes it to disk; a restart forgets it. Retrying a fetch that failed part-way asks for the key again.
What comes across is StatBot's own counts for the time before the bot joined that server: messages and voice minutes per member, per channel and per hour; game time per member; the hourly online headcount; the server's daily joins, leaves and member count, as StatBot counted them, which may include bots; StatBot's all-time invite totals — how many people joined through each invite link and through each member's invites, as StatBot counted them up to the day of the import, never day by day; and the names of channels and games. Where the archive has no record at all for a member StatBot counted, a member record is created for them holding StatBot's display name, marked as imported. Days the bot measured itself are never touched.
Nothing is written until the administrator applies a preview. The fetched history waits in memory as that preview for up to 30 minutes, and is discarded unless it is applied. If a fetch stops part-way on a temporary fault, what it had already fetched waits in memory for up to 30 minutes so it can pick up where it stopped, and is discarded after that. None of StatBot's raw responses is ever written to disk.
Who is left out. A member who has objected to activity counting is not imported. Neither is a member whose record was erased: the bot checks every month of its administrative record for that, and if it cannot read that record it prepares nothing at all rather than risk bringing one back. An inviter who has objected, or whose record was erased, is left out of the invite totals too, and a deletion request removes your invite totals along with the rest.
Imported history is marked as imported, month by month, so that server's own charts can show which months the other bot measured. It also counts in the two network-wide totals the public page shows, which are anonymous sums that name no server and no member.
An administrator can take an import back out at any time. That removes the history it added and every record it created — a member, a channel or a game name — except a record the bot has since added a field of its own to, which stays, with only its imported mark removed. That is usually a member the bot has seen since. A channel the bot has recorded again keeps a field of its own only if it sits in a category, so an undo can remove the name of a channel the bot also knows; the bot's daily sweep writes the name of every channel that still exists back again.

Message Content

The bot holds three of Discord's privileged intents, and it is fair to name all three. Message Content is the one this section is about. Server Members is the second: it is what lets the bot see joins and leaves and look a member up, which is how welcomes, roles, moderation and the "who is in this server" half of the statistics work at all. It carries no message text. The third, Presence — who is online, and what they are playing — is required: the bot always asks for it, and it is used for exactly three things. Two are described above: counting game and activity time and an hourly online headcount. The third is the AFK prompt: when somebody in a voice call has gone idle, the bot posts a short card naming them in a text channel of that voice channel's category (or in the call's own chat when the category has none), so one of the people in the call can send them to the server's AFK channel. Everyone who can read that text channel sees the card, not only the people in the call. The card is deleted as soon as somebody acts on it. It is also taken down once it no longer applies — when the person is back (no longer idle or, where the bot is going by voice signs, no longer both muted and deafened) or when they leave that call, whether they disconnect, move to another call or are moved to the AFK channel — usually within two minutes of the change. Any card still up is deleted 12 hours after it was posted, whatever the server's own clean-up setting says. The one exception is a card somebody in the server has pinned or started a thread from, which stays until it is deleted by hand. The prompt reads a status at the moment it decides and never stores it: it keeps only which card it posted and when it last prompted each person, so it can take its own card down and wait two hours before prompting the same person again. A member who has objected to activity counting is never read for a prompt. Nothing else reads Presence, and of everything a presence carries the bot keeps only the kind of each activity and its name, and the three status counts. ⚠ If Discord refuses it, the bot runs without it. Presence has to be switched on for the bot in Discord's own developer settings, and Discord can decline it. Then the bot starts without it, records neither count itself, and the AFK prompt decides from voice signs alone (muted and deafened for a long time); the only way either count then holds a number is an import from StatBot, which brings in StatBot's own figures.

Here is every way the bot uses message text. The server-wide half of that list is held in place by a test rather than by this paragraph: the link counter must stay explicitly opt-in, and a new read of message text in the bot's message handler fails the build until somebody declares it deliberately.

The counting game. In each counting channel — at most one per category, added by an administrator or that category's Curator — the bot reads each message to find a number at the start. It stores the number and nothing else — that integer is the game's state, and it is the single deliberate exception to the rule that content is never recorded. In every other channel the counting code stops before it looks.
A "links posted" counter, and only if it has been switched on. It is off by default; when it is on, the bot checks whether a message contains a web address and increases a counter. The address itself is not stored and neither is the message. ⚠ The switch is the deployment's, not your server's, and we would rather correct that than leave it flattering. There is one setting for the whole machine the bot runs on, no per-server key and no control anywhere in the admin console — the only way to turn it on is for whoever runs the deployment to hand-edit the deployment's own configuration file. So if it is on it is on everywhere the bot is, and if nobody has edited that file it is on nowhere.
Moderator clean-up. An administrator can ask the bot to remove recent messages in one channel — all of them, or only one member's, only bots, only those with a link or an attachment, only those matching text they type, or only those older than a number of days. The bot reads those messages to decide which match, deletes them, and keeps nothing.
Automatic moderation, mostly without reading anything. Most of Asbern's automatic moderation rules are compiled into Discord's own AutoMod and evaluated inside Discord before a message ever reaches the bot. The handful of rule types that do need the bot to read a message are off by default and each has to be switched on by the server deliberately.

Beyond those, the bot does not log message content, does not archive chat, does not read direct messages, and never writes the text of a message to disk. There is no edit or delete content log: what a message said before it was edited, and what a deleted message said, are recorded nowhere and no setting can make them be. That was refused deliberately, in writing, rather than left undone.

⚠ What the bot can hold, when a server switches it on, is message metadata — including who posted and what a file was called. It is a different thing from content and it is not nothing, so it has its own section immediately below.

Support-ticket transcripts, where a server uses tickets, contain the ticket's own record — who opened it, when, who handled it, the answers you typed into the ticket form, and the staff member's closing note. They contain no message text from the ticket channel, in any mode.

The Staff Delete Log, and the Message Metadata Behind It

⚠ This is off in every server by default, and in this version there is no button anywhere in the product that turns it on. It is written up here anyway, because it exists in the software and a policy that only describes the switched-on features is a policy that goes stale the day somebody flips one.

When Discord tells a bot that a message was deleted, it usually sends only the message's ID and the channel — no author, no time. A staff delete log that cannot say who is close to useless, so the software can keep a short-lived note about recent messages purely so that it can answer that one question.

What a note can hold, per message: the message's ID, the channel's ID, the author's Discord ID, whether that author is a bot, when the message was posted, when the note was taken, how many times the message was edited afterwards, and — for each attached file — its name, its size and its type. Up to 10 files per message; each name is cut to 120 characters and scrubbed first, so a bot token, a webhook address, a server invite or an email address pasted into a filename is replaced before anything is kept.

What a note never holds, in any configuration: one character of what anybody typed. The record even has a slot for a message's length and the bot deliberately leaves it empty, because the only way to measure a message is to read it.

Where it lives and how long: in memory, and never on disk. It is therefore in no backup and no export, and restarting the bot erases every note completely. A note expires 6 hours after it is taken; at most 200 are held for one channel and at most 5,000 for one server. Those are the shipped figures, and all three of them are clamped by a hard ceiling that no configuration can pass: a note's life can never be set beyond 24 hours, one channel can never hold more than 1,000 notes, and one server never more than 20,000. So nothing held here outlives a day, in any server, in any configuration.

Who can see it: nothing anywhere lets a person browse the notes. Only one field is ever drawn out of one — the author's Discord ID — and it goes to two places: the "who deleted what" card in whichever channel a server has chosen for its staff moderation log, and the reply counter described further up, so that "who replied to whom" can be tallied when Discord did not say. In this version nothing displays the filenames at all; they are held against a bulk-delete report the software can build but that no button currently opens.

Whether it is running in your server: almost certainly not. It is off by default, and the settings screens that used to switch it on were removed, so the only way to enable it today is for whoever runs the deployment to hand-edit that server's settings file on the machine itself. If nobody has done that, nothing above is happening and no note exists.

Your Asbern Box

A server's administrator can link an Asbern box to that server. A box is a small set of Asbern programs that runs in Docker on a machine the administrator owns — a home server, a NAS or a PC. They install it with a command Discord shows them, which carries a single-use grant so the box links itself; a box can also be linked with a one-time code. Only that server's administrators can get the command or make a code. The machine stays theirs: one program on it, the agent, carries out every act on the machine's Docker and decides what it will do, and the bot can only ask it. The box connects out to the bot, and the bot never connects to the box's programs. The one connection the bot makes to the home is the check from outside, described under Router Ports, Names and Your Home's Address.

What the box does when the bot asks. It creates game servers on that machine, but only games from a list Asbern has checked and signed, with options from that list — never from anything typed in Discord. It starts and stops them, and containers its owner linked to it. It backs a game server up and lists its backups. It reaches the Plex or Jellyfin server on that machine, and a request manager (Seerr) where its owner set one up, and it plays music in a voice channel. Restoring a backup, typing in a password or a key, and turning router ports on are done on the machine itself, never from Discord.

What the bot keeps about a box. It is one file per server, on this deployment's machine:

one-way fingerprints of the one-time codes, of the install command's single-use grant and of the box's credential — never the code, the grant or the credential itself — with when each was made, used and withdrawn, and the Discord ID of the administrator who made each code or grant, and for a grant the name of the machine that used it. A code's row, with that ID, goes when the next code is made — for a code that was used, the next one made more than a day after it was used — and after that only its fingerprint and when it was used are kept, for the last 16 codes used. A grant lasts an hour and is used once. Its row, with that ID, goes in the same way: when a later grant is made more than a day after it was used or ran out, and only then. At most eight are kept;
the kind of machine the administrator chose when they asked for the command (for example Linux, Unraid, Synology, or Docker Desktop on Windows or a Mac), a short box ID worked out from its credential, the machine's name as its system reports it, the version of Asbern's programs on it, and when it last checked in;
the box's network addresses: its address on the home network; the public internet address its router reports, kept only where it matches the address the box's link arrives from; whether the internet provider shares one address between several homes, so that friends outside cannot reach it; and its Tailscale address and name, where Tailscale is installed. They are asked for while the box is linked and written down only when they change. They are deleted when the box is removed or unlinked, when its owner turns router ports off on the machine, and once the box has been offline for 72 hours;
for each of its game servers: how members join it — the way in an administrator chose for that server — and the router's last answer for that server's ports.

What the box tells the bot while it is linked, to draw Admin › Box and the setup screens, and which the bot does not write down unless this section says so: its processor type and the versions of each of its programs; what it can do, and the results of its own checks — whether Docker, its programs, the router and the home network are in order — as words from a fixed list; and, by port number only, any ports other programs on that machine have opened on the router.

For each game server created or linked on the box, that server's own settings hold the game, the short name the box gave it, its label, the ports players connect on, how members join it and the options an administrator picked from the list. They never hold a folder, a file name or a command. Those stay on the machine.

The address a box connects from. The part of the bot the box connects to sees the internet address the box's link arrives from. It uses it to limit how fast anybody can guess at codes, to check the router's answer against it, and to check from outside that friends can reach a game server; and, where the box's owner allowed it, it publishes it in a game server's name while that server runs (see Router Ports, Names and Your Home's Address). It is never written to a log or an event.

What reaches the logs (see Diagnostic Logs): when a box links, connects or disconnects, what it can do, the results of its checks, whether friends outside can reach a game server, when a router port is opened or closed and when a name is written or taken down, and why — as fixed words and counts, under the server's ID. The logs never hold an address, a code, a credential or a player.

Who sees what. The server's administrators see the box's name, kind, version and checks, and its addresses, in Admin › Box and the setup screens. Members of that server see one way to join a game server, and only where an administrator chose how members join that one server:

Friends outside can join shows the server's name and port while it runs, or the home's internet address and port where the game cannot join by name (see the next section);
Private network shows the box's Tailscale name, or its Tailscale address where it has no name;
Join by code, on a game that has its own join service, shows the code the game printed.

That way in appears on the game server's card in that Discord server and on its screens under Gaming › Servers. No setting made for a whole Discord server counts as that choice, however and whenever it was saved; until an administrator chooses for a server, members are shown no address for it. An address an administrator types in for a server themselves is shown as they typed it. The box's addresses are never shown to another server, never on this website and never in the operator's private feed.

What stays on the machine. In the box's own folders and Docker volumes:

the box's credential, and the keys its own programs use;
the name of the Discord server it is linked to, which the bot tells the box each time it connects, so that the box's own page can say which server it belongs to;
every game server's files — its world, its settings and any mods — and its console output;
backups of a game server, made and kept on that machine, in the box's backups folder. Each holds the server's files as they were: its world, its settings and any mods. The bot is told only each backup's ID, time, size and kind. Anything on that machine that can read the box's folders can read them, a game's own mods included;
how each game server ended — when, which server, how, and its exit code, for the newest 100 — which the box reports to the bot as those facts and never as a log line;
the Plex sign-in where Plex was linked, the Jellyfin sign-in where Jellyfin was linked — a session Jellyfin gave the box through Quick Connect — and the request manager's key, which is typed in on the machine. None of them is sent to the bot;
any read-only keys the box's own page holds for home-automation or storage software, such as Home Assistant or TrueNAS. They stay on the machine, and in this version nothing read with them is sent to the bot;
the programs' own logs. The watch party's program writes a line to its log each time a viewer's link is accepted or refused, with that viewer's Discord ID and internet address — on the box owner's machine, kept as Docker's own log settings there keep it.

What the bot asks the box while it is linked. Besides the above, the box answers the bot's questions, and the answers are drawn in Discord:

which game servers it runs: for each, the short name, label, game and ports, and whether it is running and can start — never a folder or a file — and, while an administrator is choosing one to link, the names of the machine's other containers and the software each one runs;
how a running game server is doing, as the game itself reports it: how many are playing, the server's own name and its map, and — only when an administrator opens that server's activity — the names its players use in the game. The bot keeps only the count, each server's latest and highest, to draw its card and to stop it when it is empty. The map and the players' names are shown only to that administrator, and never written down;
for Watch, where the box reaches a Plex or Jellyfin server: the library, its titles and artwork, what is playing and the Live TV guide — what the screening-room screens show. What the bot keeps of it is set out in What the Bot Stores About You.

Updates. The box fetches Asbern's programs only from the private image store this deployment uses, with a credential that comes from its link, and installs a new version when nothing on it needs the old one. The images are held by a storage provider, which sees the box's internet address when it downloads one, as any download does. Neither the image store nor the service that hands out its credentials keeps a log of that address.

Removing it.

Remove, under /menu › Other › Admin › Box, tells the box to close every router port it opened, takes down every name its game servers had, withdraws the box's credential and deletes its addresses at once. A box that is not connected at that moment closes them itself the next time it connects and is told its link was withdrawn; until then it keeps its forwards while its games run. The same happens to a box when another machine is linked in its place. The game servers' settings, Plex and the watch party's settings are kept, for a box linked later.
Remove under Media does the same, and ⚠ also turns Watch off and forgets Plex.
On the machine, docker exec -it asbern-agent asbern ports off closes every router port the box opened and stops it asking again, and the bot takes those servers' names down. Only the box can turn router ports back on.
Afterwards, the bot still keeps the record that a box was linked: the fingerprints, the box's ID, name and version, when it was linked and when the link was withdrawn, and the Discord ID of whoever made a code or grant still on it. The game servers added from it stay until an administrator removes them under Game Servers. If a deletion of that server's data is asked for, the operator deletes this record too, by hand.
The daily backup leaves this file out. A snapshot of the machine's data taken by hand, such as the one before each update, includes it (see Backups).

A PC linked with the earlier Asbern Companion app. That app is no longer offered, but a PC linked with it keeps working. The bot keeps the same record about it as about a box. The app opens router ports, or adds a Windows Firewall rule, only where the person at the PC allowed it for that server on the app's own page, and asks the router to close those ports when the server stops; if the PC switches off first, the router's own time limit, or the app's next start, closes them.

Router Ports, Names and Your Home's Address

This section is about a game server on a box that friends outside the home can join. None of it happens unless the box's owner allowed it on the machine and an administrator switched it on for that server.

The box's owner decides, on the machine. When the box is installed, its owner is asked whether the box may open game ports on their router, and the answer is recorded on the box. Discord can turn router ports off but never on: only the box can, with docker exec -it asbern-agent asbern ports on, and docker exec -it asbern-agent asbern ports off turns them off again. On Windows, the installer adds a Windows Firewall rule for the game ports only after saying what it does, and Windows asks first.

What the box asks the router. While a game server runs with Friends outside can join switched on, the box asks the home router — by UPnP, NAT-PMP or PCP, the standard ways a program asks a router — to forward that game's player ports to the machine, and to stop when the server stops. It asks only for the ports the game's entry in Asbern's list marks for players — never a console, administration or web port — only of the router the machine uses, and only for a limited time that it renews while the server runs, so a forward it could not withdraw lapses by itself within an hour. It also keeps the game servers themselves from asking the router for anything; on a machine where it cannot, it opens nothing. The router is told the machine's address on the home network, the ports and how long to keep each forward — and, where it asks by UPnP, a label naming Asbern, a random ID for the box and the game server's short name, which any device on the home network can read from the router's list of forwards. The box keeps a record of the forwards it asked for, so it withdraws only its own; its log, and what it reports to the bot, are fixed words, port numbers and counts, never an address.

A name that follows the home. Where this deployment has a names domain, each such game server gets a name under it, like valheim-yourserver-k7q2m9x4 followed by that domain. While the server runs, the bot writes the name into the domain's DNS records, pointing at the internet address the bot saw the box's link arrive from — never an address the box or anybody else supplies — once a check from outside, or an administrator's It works, has shown that friends can reach it. The name is taken down when the server stops; when Friends outside is switched off for it; when the server or the box is removed; when the box's owner turns router ports off; and when the box has been offline for 15 minutes. It is written again when the server next starts — unless we have taken that server's names down over a report of abuse, which keeps every one of them down, its watch-party names too, until we lift it.

The part of the name after the game is chosen per Discord server: by default the server's own name, shortened, followed by eight random characters, so that knowing a community does not tell anybody its address. An administrator can change it, at most three times a day. Old names are taken down at once, and a name that is let go rests for 30 days before any other server can have it.
What the bot keeps about names, in that server's own settings: the chosen part and when it was changed; each game server's name and when it was last written; the last result of the check from outside and when it ran; an administrator's It works; and a short keyed fingerprint of the address the last check was made at — never the address itself. The fingerprint is made with a key kept on the bot's machine and nowhere else. With that key it could be matched back to the address by trying every address, so it is deleted with the box's addresses (see Your Asbern box). One list across this deployment records which Discord server holds which name, and when a name was let go and by which server — never an address and never a member.
Some games cannot join by name. For those, and when a name could not be written — for example while this deployment's limit on new names is reached — members are shown the home's internet address and the port instead, on the same terms: only while the server runs.

The check from outside. To tell an administrator whether friends can reach a game server, the bot makes the same single connection a player's game would make: to the home's internet address — the one it saw the box's link arrive from — at that game server's port, asking the game for its name. It does that when the server is created or started, when an administrator presses Check again, and when the home's address changes, never as a sweep, and within limits per server and per address. It keeps the result as a word, with the fingerprint above, and nothing else. For a game server an administrator added By address at a public internet address, the bot also asks that address how many are playing, each time it checks.

What anybody can see, and what we cannot erase.

Every player who joins a game server directly sees the home's internet address, as with any game server a player connects to.
A name is public. Anyone who has it, or finds it, can look it up while the server runs. Names can be found without being shared: once anyone looks one up, it can turn up in public DNS history, and services that collect that history can list the names under a domain and the addresses they pointed at. The random characters stop guessing; they do not stop that.
Our DNS provider keeps a log of the addresses we set for 90 days, and public DNS history services may keep them longer. We cannot erase either. Taking a name down stops it pointing at the home from then on.
List publicly, on a game that has it, also puts the server and the home's address in that game's own public server list. It is off unless an administrator switches it on.
Join by code, on a game that has its own join service, opens no router port and uses no name: friends type a code the game shows. Whether that game's join service lets its players see the home's address is up to the game.

A Watch Party on a Box

Where a box runs the server's watch party, viewers' browsers connect to the box directly.

Viewers see the home's internet address, and the box sees theirs, as with any website. The box's watch-party program logs a viewer's Discord ID and address on that machine when it accepts or refuses their link (see Your Asbern Box). The bot never receives a viewer's address.
The box opens one port on the router for it, only while a screening is live or a viewer's link is waiting, and closes it otherwise.
Each screening gets a name of its own, made of random characters under a random name for that box, written while the screening is live and taken down when it ends, so a link from an earlier screening reaches nothing. The bot keeps the names of live screenings, and the newest 16 already used for each box for at most 90 days, so none is handed out twice in that time.
The box's certificate. So that viewers' browsers can trust the connection, the box orders a certificate from Let's Encrypt, a public certificate authority, which sees the home's internet address when the box asks. The certificate names only the box's own random name, never the Discord server's, and like every certificate it is published in public Certificate Transparency logs. The bot's part is to write the short value Let's Encrypt asks for into the domain's DNS, and to remove it afterwards. The box's keys never leave it.
Where this deployment has no names domain, viewers reach the box at an address its administrator set up themselves.

Diagnostic Logs

The bot writes two logs on the machine it runs on. Both obey the same rule about their contents — message text and secrets are never recorded, with the counting game's parsed number as the single stated exception — but they are kept for different lengths of time, and it would be misleading to give you one number for both.

The structured event log is the record of what the bot did: which action ran, whether it succeeded, which rule refused a request, and how in-server currency moved. ⚠ A line that records a member's action carries that member's Discord ID — for a button press, together with the button's full internal ID, including which item or page it was for — so for as long as the raw files last, they are a record of what you pressed and when. Its raw log files are deleted after 90 days. On the way there they are compressed at the 14-day mark, by a housekeeping pass the bot runs shortly after start-up and once a day after that. Daily summaries, which contain counts and no content, are kept.

The usage archive is a smaller, longer-lived fold of that same event log, and it is what the operator's page described under What the website can show reads. It is kept indefinitely — it is what outlasts the raw files — and most of it is counts with no person in them: how often each button was pressed and how often it failed, per day and per server. ⚠ It also keeps one small row per member per day, under your Discord ID: how many things you pressed and how many of those failed, how much in-server currency you earned, spent and wagered, how much the casino paid you back, how many voice sessions you had, how long they lasted, and how many of them you started in an empty channel. No text, no channel and no server are kept beside it. ⚠ Two more things in it name you: per day, who gave in-server currency to whom — the two Discord IDs, how many gifts and how much — and, for a voice session still open when a day ends, the time it started. If you have objected to activity counting in a server, nothing you do there is added to your daily row and no gift there that involves you is recorded; an open voice session's start time is kept either way. The archive is built from the raw log in batches, roughly every half hour, and it judges each thing you did by the setting you had when you did it — it reads your presses of the switch out of that same log — so switching counting back on before the next batch, or a day being rebuilt from the raw files later, does not let what you did while it was off into your row. The one exception is a very large rebuild done in pieces: a piece that stops before your first press of the switch judges what it holds by your setting at the time it is built. ⚠ To judge by the setting you had at the time, the archive keeps a record of when you switched counting off and on in each server: the moment of each press of the switch and, if you objected by writing to us instead, the moment the archive first noticed it. Each of those is kept for 100 days, longer than the raw log, so any day that can still be rebuilt is judged correctly; an objection that is still in force is kept for as long as it stands, the same as the setting itself. A deletion request removes them — your daily rows, every gift record that names you and your open voice-session times, from every day the archive holds. None of them is split by server, so an erasure in any one server removes them for every server. ⚠ It does not rewrite the raw log files, which keep your ID until they are deleted at 90 days, and on the rare occasion a day of the archive is rebuilt from those files — a busy day's log file rolled over while it was being written, or a damaged archive file — rows from before the erasure can come back for that period. The record of your switch presses is the one part kept per server, and a deletion request clears it for the server it names — except that an objection still in force is kept as one entry that says only that you have objected, with no time and no history, because without it a day rebuilt from the raw log could count what you did while you had objected. Like the rows above, a rebuilt day can put presses from before the erasure back into this record, for as long as the raw log still holds them. A server's switch records are deleted with the rest of its data if a deletion of that server's data is asked for — see If a Server Removes the Bot.

The plain application log (app.log) is the running commentary an operator reads when something breaks. It is kept by size rather than by age: when the file reaches 10 MB it rolls over, three previous files are kept beside it, and the fourth-oldest is deleted. So how long a line survives there depends on how busy the server is and not on a number of days — months on a quiet deployment, days on a loud one. Nothing deletes it on a schedule, and we would rather say so than quote you a retention period the code does not enforce.

And there is one more file, which is not a log. Every change made from the administrative console is written to an administrative record: what was changed, which setting, by which Discord ID, under which name, against which server, and whether it was a dry run. It is append-only and never rewritten — that is the point of it, because "who turned that off?" has to survive whoever wants a different answer later — so nothing deletes it and nothing edits it. Values that look like a credential are replaced before they are written, by name and by a flag the setting itself carries. It records administrators rather than members, but an administrator is a member too, which is why it is described here.

Backups

The deployment keeps snapshots of the files described above so that a failure does not take a server's history with it. Nothing ever reads a backup to answer a question about you.

⚠ A deletion is not applied retroactively to those snapshots, and that is deliberate. Reaching into a backup to remove one record would make every restore from it an incomplete one, and it would open a write path into the copy that exists precisely as insurance. The backups age out instead, and a deletion is complete across every copy once they have:

Kind of snapshot	How long it is kept
The daily one, `backups/<date>/`	7 days, aged by its own name
One taken by hand before a maintenance change	at most 90 days from when it was last written — and never on the pass that first notices it, because the operator is warned by name for at least 7 days first

So the honest worst case for a deletion to be gone from every copy is 97 days, not seven. The daily rotation clears in a week; a hand-made snapshot taken the day before you asked can take the full ninety plus its warning period. We would rather give you the longer number than the one that covers the common case.

⚠ And there is one exception, which is why it is written down here rather than discovered later. The operator can mark an individual snapshot to be kept indefinitely, by placing a marker file beside it — indefinitely in the sense that no age ever removes it. That is a deliberate act, it is visible in the directory, and the housekeeping reports how many are held on every pass — so an exemption from the window above can never be taken silently. If such a snapshot contains member data, that data is kept for as long as the marker is.

⚠ That exception is bounded by count rather than by time. The 5 most recently written marked snapshots are kept; when a sixth is marked, the oldest is warned about by name for at least 7 days and is then removed, along with its marker. So a marked snapshot is never removed for its age, and the set of them cannot grow without bound — which is what stops the windows above being defeated one marker at a time.

We do not restore a backup in order to bring back data somebody asked us to delete.

How Long Things Are Kept

What	How long
Progression, currency, game progress, achievements	Indefinitely — including if you leave and rejoin
Activity counts and voice co-presence	Indefinitely; this is the server's own long-run history
Per-channel counts, camera/screen-share minutes and screening-room watch time	Indefinitely, with the activity counts they belong to
The hour-of-day profile	Indefinitely; nothing prunes it, and it is part of the same long-run history
The member record held with the activity archive — names, nickname, avatar references, join date, last seen, and first message and first voice	For as long as that archive is kept
Which parts of the bot you open	Indefinitely, with the activity counts they belong to
Game and activity time	Indefinitely, with the activity counts they belong to
Your quick-links profile — which menu doors you press	As long as your levels record in that server. The counts halve every 14 days, worked out when they are next written, and a door below a twentieth of a press is forgotten. A deletion request removes it; objecting to activity counting deletes it at once
Daily counts about the server — joins, leaves, boosts, the busiest voice moment, role headcounts and role changes	Indefinitely; this is the server's own long-run history
Channel and role names held with the archive	Indefinitely. A deleted channel or role keeps its row, so old counts can still be labelled
The hourly online headcount, and the list of game and activity names	Indefinitely. Neither carries a member ID
History imported from StatBot	With the archive it joins. An administrator can take it back out at any time
A StatBot key pasted in for an import	In memory only, until the fetch ends. Never written to disk
An import preview, before it is applied	In memory only, for up to 30 minutes, then discarded unless applied
Watch history	Until you clear it
Resume points (where you got to in a title)	90 days after you last watched it, or until you clear them. ⚠ The sweep that removes them runs at start-up and weekly after that, so in practice a marker can survive up to about a week past the 90
Media requests, where the screening room is in use	Until the title arrives and everyone who asked has been told; a request for something that never arrives stays queued until the operator clears it
The "DM me when it lands" preference	Until you switch it off
Counting tallies	Indefinitely
Your birthday, where you have set one	Until you remove it
A reminder you set	Until it fires, then one more day so you can snooze it; never more than three years ahead
Invite attribution, where a server has switched it on	The most recent 500 rows per server; the per-inviter totals behind the leaderboard are never trimmed
Poll votes, starboard entries and ticket records, and any suggestion posted before suggestions were retired	Indefinitely, unless the server's staff delete them
Feedback filed with a server's staff	Until staff delete it, which removes the words and keeps the record that it existed. At most 500 per server; past that, the oldest notes staff have dealt with go first
Feedback sent to the bot's owner	The most recent 2,000 notes across the deployment. A server's notes are deleted with the rest of its data if a deletion of that server's data is asked for
A box's network addresses and its router's answers	Until the box is removed or unlinked, its owner turns router ports off on the machine, or it has been offline for 72 hours, whichever comes first. Replaced whenever the box reports new ones. A PC linked with the earlier app: until the link is removed, or another machine is linked in its place
The record that a box was linked — fingerprints of its codes, grants and credential, its ID, name and version, when, and the Discord ID of the administrator who made each code or grant	Indefinitely, with the server's other settings; a code's maker goes with that code's row when a later code is made, and a grant's row when a later grant is made more than a day after it was used or ran out — not before (see Your Asbern Box). The operator deletes it by hand if a deletion of that server's data is asked for. A deletion request for your own data does not reach it
The address a box connects from	In memory, while its link lasts, and never in a log. Published in a game server's name only as Router Ports, Names and Your Home's Address describes
A game server's name in DNS, pointing at the home's internet address	Only while that server runs, and taken down about 15 minutes after the box goes offline. Our DNS provider's log keeps each address we set for 90 days, and public DNS history services may keep it longer; neither can be erased by us
A server's names record — the chosen part of its names and when it changed, each game server's name, when it was last written, the last outside check's result and the keyed fingerprint of the address it was made at, and an It works press	The fingerprint, the check's evidence and the press go with the box's addresses (above). The rest is kept with the server's other settings, and deleted with them on request, after every name has been taken down
Which Discord server holds which name, and names let go	While a server holds it. A name let go is kept, with its date and the server that let it go, for 30 days, so that only that server can take it back before then. A deletion of that server's data drops the server from it
Watch-party screening names already used	The newest 16 for each box, for at most 90 days
The operator's record of each time a server's Watch was switched off over copyright notices, and switched back on — when, and by whom	The newest 50 for each server. Kept when Watch is switched back on, because the repeat-infringer policy in the Terms relies on it; deleted with the server's other data on request
The operator's record of each time a server's names were taken down over a report of abuse, and restored — when, and by whom	The newest 50 acts for each server. Kept when the names are restored; deleted with the server's other data on request
Who queued which song in a music session, and skip votes	Until the session ends, or 30 minutes after a queue was left waiting. A deletion request removes you from it at once
The operator feed's file, where the operator has switched the feed on — each server's ID, name, member count and icon, when the bot joined and left, and fingerprints of the billing events already announced	Until the operator deletes it; switching the feed off does not. A server's entries go if a deletion of that server's data is asked for; its ID and the time of that deletion stay. The daily backup leaves it out; a snapshot taken by hand, such as the one before each update, includes it (see Backups)
Cards the operator feed has posted	In the operator's private Discord channel until the operator deletes them. A deletion request that names a server has its cards deleted by hand; a request to delete only your own data does not reach them
Moderation cases, including voice bans and their lifts and removals from a category	The most recent 5,000 cases per server; past that, the oldest go first. Voiding one withdraws it; it is not deleted. A deletion request leaves them in place
Appeals you file, and their verdicts	The most recent 2,000 appeals per server; past that, the oldest go first. A deletion request leaves them in place
Warnings	Indefinitely — but only the most recent 200 per member. Past that the oldest is dropped as a new one is added, and the bot tells the moderator how many it dropped
The administrative record of console changes	Indefinitely. It is append-only by design and nothing rewrites it
Everything above, once a server removes the bot	Kept, with no time limit, until somebody asks for that server's data to be deleted. See If a Server Removes the Bot, below
A request to delete a server's data	Indefinitely, in an append-only record: which server, who asked, when the request arrived and when it was carried out, the email or ticket it came in on, and how much was deleted. Who asked is usually an email address, and it is kept with the rest of the record. Nothing about any member's activity or records is in it
Backups of everything above	7 days for the daily snapshot; at most 90 days from its last write for one taken by hand, plus 7 days of warnings first — so 97 days is the honest worst case for a deletion to clear every copy. A snapshot the operator has deliberately marked to be kept is the stated exception. See Backups, above
Message metadata notes, where a server has switched them on	6 hours; in memory only, and erased outright by a restart
Diagnostic logs — raw files	90 days
Diagnostic logs — daily summaries (no content)	Indefinitely
The usage archive, including one row per member per day	Indefinitely. A deletion request removes the rows that name you — see Diagnostic Logs
The usage archive's record of when you switched counting off and on	100 days for each press. An objection still in force is kept for as long as it stands, and a deletion request keeps only that. A server's records go with the rest of its data if a deletion of that server's data is asked for
Application log (`app.log`)	Kept by size, not by age: 10 MB a file, three older files beside it, then dropped
Asbern Demo sandbox	Deleted within 30 minutes of your last press
This website's traffic counter lines, where they are switched on	Each day's file is deleted after 365 days
Sign-in session cookie (`asbern_session`)	7 days, or until you sign out
Sign-in security cookie (`asbern_oauth_state`)	10 minutes. Deleted as soon as a sign-in completes or is cancelled on Discord's page; any other failed or abandoned one is left to expire
Subscription record	For as long as the rest of the server's data — including after the bot is removed, whether or not its subscription is still running. It is deleted only if a deletion of that server's data is asked for, and not while the subscription is still running

⚠ A lapsed subscription erases nothing. Every subscription state the software models — active, grace, read-only and lapsed — retains the server's data, and there is deliberately no state that deletes it. A server that stops paying loses its paid features; /menu, the casino and the Pokémon adventure keep working, and it does not lose its history. If it comes back, the history is unbroken. That is a property of the code, not a policy we could quietly change.

If a Server Removes the Bot

When the bot is removed from a server, nothing is deleted. The server is marked as departed, and everything the bot held for it — the economy, the levels, the Pokémon progress, the statistics, the counting history and the moderation records — is kept, with no time limit, until somebody asks for it to be deleted. Nothing deletes it on a timer.

The reason is that a server that comes back should not start from zero. Removals are often not final — a permissions change, an admin tidying up integrations, a community that goes quiet for a season, a falling-out that gets patched up. Re-add the bot and everything is still there, exactly as it was; re-adding it simply clears the departed mark.

To have a departed server's data deleted, write to privacy@asbern.gg and name the server. We may ask you to show that you own or administer it, because deleting a server's history on a stranger's say-so would be the worse failure. Whoever runs this deployment then deletes it.

⚠ Three things are worth being plain about.

We keep this data because a return should be lossless, not because we need it for anything else. Nothing is processed while a server is departed — no counting, no leaderboards, no activity — the files simply sit there until the server returns or somebody asks for them to be deleted.
It does not delay anything you ask for about yourself. Having your own data deleted is a different request — a deletion request, to the same address, about you rather than the server — and it is answered on its own, whether the server is present or departed.
When a server's data is deleted on request, the deletion is real: the server's directory and its slice of the activity archive are removed. What is kept is the append-only record that the deletion happened, and the request itself — which server, when, and who asked for it — so that we can answer "prove you deleted it". Backups age out on their own schedule, described above.

⚠ The subscription record is kept on the same rule. Removing the bot does not cancel a subscription, so a departed server's subscription record stays with the rest of its data — see Billing — which is also how a server that returns is still recognised as one that has subscribed before. A request to delete the server's data leaves that one record in place while the subscription is still running; cancel it first, and the record can go once it has ended.

⚠ One fact outlives that record: that this server once subscribed. The free trial is one per server, and nothing else would remember that this one has already had it — so when the record does go, a marker holding the server’s id and the date is kept. It holds no payment details, no email address and nothing about any member, and it is the only thing kept back.

What You Can Erase

From the bot, yourself: open /menu, go to the Profile tab, press Settings, and open the screen headed Clear My History. It offers two rows.

Watch history — titles watched, watch parties, resume points, saved titles and channels, and most-watched live channels.
Game server history — your own game-server start counts. Only yours go; each game server's overall start total stays.

Both clear on a single press, and their button is greyed out when there is nothing to clear. They are real deletions, they take effect immediately, and they touch only your own record.

Everything else, by asking: to have your data deleted, contact privacy@asbern.gg and say which server. That is a deletion request. We check that the request is yours — that it comes from your own Discord account, or that you can show it is — because deleting somebody's record on a stranger's say-so would be the worse failure. Then a person deletes your whole record in that server: your money, XP and levels, achievements, game progress, activity counts and the rest of the stores described above, with only what is listed below kept back. There is no longer a button in the bot that does this; the deletion is done by a person, on request, and the request is recorded — who asked, when and for which server — so that we can show it was done.

Stopping new activity from being recorded is a switch, not an erasure, and it sits one screen up: on the same Settings screen, the row Stop counting my activity. While it is off, the bot records no new activity counts, game time, voice co-presence or conversation links for you in that server, deletes your quick-links profile at once and records no press into it, and adds nothing to your row in the usage archive, which judges what you did by the setting you had at the time. It does not change how you earn XP, money or levels, it does not remove what is already held — a deletion request does that — and the same row switches it back on. ⚠ The raw diagnostic event log is not affected: it still keeps each press with your Discord ID for its 90 days. You can also object by writing to the address at the foot of this section.

What cannot be erased PIECEMEAL, and why we say so instead of implying otherwise:

Currency balances and levels. A deletion request removes yours. There is no way to erase only your balance or only your level and leave the rest standing — these stores are written with strict correctness guarantees that protect everybody's balances at once, and a partial per-field deletion would bypass them.
Activity counts. A deletion request removes your rows from them too. There is no way to erase a single month or a single channel: they are stored as monthly files of aggregate cells covering every member at once, and rewriting one to remove a slice risks the whole month.
The counting game. There is no per-member switch that stops the counting game keeping your tally, and no button that erases a single count. A deletion request removes your tally; if you want to object to it specifically, write to the address at the foot of this section.
Administrators cannot delete them for you either, and that is on purpose. Asbern refuses, at startup, to load any administrative control that writes a member's XP, level, money, inventory, game progress or progression — because a leaderboard an administrator can edit is a leaderboard nobody can trust. The consequence is worth stating plainly: nobody but you can have your own progression record erased, and a deletion request above is how.

What a deletion request leaves in place: moderation records. Warnings and cases — voice bans and removals from a category included — and appeals with their verdicts are kept when your own data is erased. A case is the server's record of what its staff decided, not your record of yourself, and erasing it on request would let anyone wipe a ban history by asking. Voiding a case withdraws it; the record goes only with the rest of the server's data.

…and what you were already paid for this period. If your data is erased part-way through a day, a week, a month or a season, what you already collected in it stays collected, so that an erasure cannot be used to be paid the same reward twice: the Daily and Work keep their cooldowns, today's limits on what chatting, voice and Work can earn stay where they are, a challenge, goal or season reward you claimed stays claimed, and so do the pack limits still running, today's dig squares and today's battle winnings. A wild Pokémon you caught stays caught for as long as it is still in the channel. What is kept is dates and counts only — no balance, no messages, no history — and only for a period that is still running when the erasure happens — and the bot's daily clean-up deletes each one once its period has ended. The first Poke Center heal of each day is free, and the date of the one you took today is kept the same way.

What can be erased is a whole server's data. The bot keeps most of each server's files in their own directory, named for that server, and whoever runs the deployment deletes it when somebody asks — nothing deletes it on a timer, including after the bot has been removed. See If a server removes the bot.

⚠ "Most" is doing real work in that sentence, and it would be dishonest to leave it doing it quietly. Three of the stores described above are still held as single deployment-wide files keyed by Discord ID, with no per-server dimension at all: watch history, game-server start counts and member warnings. Deleting a server's own directory does not reach any of them — they have to be cleared separately and by hand. That is a limitation of how those three files are written rather than a decision about your data, and until it is corrected this is the accurate description of what deleting a server actually deletes.

To ask about, or ask for the deletion of, what is held about you, write to privacy@asbern.gg.

Who Your Data Is Shared With

Asbern does not sell data, does not share it with advertisers, does not use it for profiling or advertising, and does not use it to train any model. There is no telemetry and no usage reporting: nothing about you or your server is sent to the people who wrote the software on a schedule, in the background, or by any automatic process at all — with one exception the operator has to switch on, the private feed described in The Operator's Private Feed in Discord. That feed tells whoever runs this deployment (on the hosted service, the same people) when the bot joins or leaves a server and when a subscription changes, and it names no member except the account that added the bot. The one route that carries your own words out of your server is a door you have to open and press, and it is described at the end of this section. An Asbern box that an administrator links reports to this deployment's bot while it is linked, as Your Asbern box describes; that is the feature the administrator asked for, and it goes nowhere else.

That is not the same as saying the bot talks to nothing. It talks to whatever its operator has switched on. These are the outbound addresses in the shipped code:

Discord, continuously, because that is what a Discord bot is. That is discord.com for its API and gateway.discord.gg for the live connection the bot holds open. Where the operator has switched on the private feed, its cards travel the same way, to one channel in the operator's own Discord server.
Whatever the operator configured, and only that. A media server, a download queue, a game server, a statistics provider, a fantasy-league feed. Several of those run on the operator's own machine and never touch the public internet. These are the outside ones, and this is the whole list in the shipped code:
- Plex's own catalogue (discover.provider.plex.tv) when somebody searches the screening room for a title the library does not have, and when a requested title is added to the operator's watchlist;
- StatBot's API (api.statbot.net) where a server uses it as its statistics source, or where an administrator imports the server's history from it with their own StatBot key;
- Sleeper's public API (api.sleeper.app) where an administrator has bound a fantasy league, or where an administrator or a group's Curator has added a Sleeper league as a feed (its league, its week, its trades and scores, its team names and the public list of players' names);
- the feed sources, where an administrator — or a category's Curator, for that category's own channels — has asked to be told when somebody goes live or something is published: Twitch (api.twitch.tv, and id.twitch.tv for the token that lets us ask it), YouTube (www.youtube.com, its public channel feed, and — only where the deployment has set a Google key — Google's YouTube API, www.googleapis.com, to turn an @handle into a channel), Reddit (www.reddit.com, a subreddit's public feed), Steam (store.steampowered.com, a game's news feed) and GitHub (github.com, a project's releases feed); the publishers on the bot's ready-made list, each named beside its feed on the Feeds help page; and, for a feed added by its address, whatever address was typed in, which is by definition not a list we can publish;
- quickchart.io, a chart renderer, which is switched off in the shipped configuration — charts are drawn on the operator's own machine — and can only be reached if whoever runs the deployment sets an environment variable to choose it.
Every one of them is off until it is configured, each has its own terms, and each is the operator's responsibility rather than ours. None of these requests carries your Discord ID or names any member. What goes out is a broadcaster or channel name, a YouTube handle, a subreddit, a search term, a feed address, or a server ID — and for the chart renderer, were it ever switched on, a set of dated whole-server totals with nobody in it. The detail is immediately below.
⚠ What leaves in those requests is the server's own identifiers and the operator's own credentials, not yours. A title you typed into the screening-room search goes to Plex's catalogue so it can offer you candidates, and a title you request is added to the operator's Plex watchlist — or, where the operator runs a request manager (Seerr) on their own box, both go to that instead; your Discord ID is not sent with any of them. The statistics provider is asked about the server, by server ID, and picks your row out of the answer here rather than being told who is asking. An import sends the administrator's own StatBot key with those requests, and nothing about any member.
The weather service, api.open-meteo.com, where an administrator has given the Pokémon world a real-world place. It needs no key and no account, which is why it is the default. The request carries the coordinates of the place the administrator chose and nothing else — no member is named in it, and it does not fire at all until a place has been set.
One address the hosted bot never asks: api.ipify.org, a public "what is my IP" lookup, which is in the shipped code for a bot that runs on the same machine as its game servers. The hosted bot's game servers are on administrators' own machines, and a box's address comes from the box's own connection — see Your Asbern Box.
The DNS provider for this deployment's names domain, where one is set up: Amazon Route 53 (route53.amazonaws.com). The bot sends it a game server's name with the home's internet address while that server runs, takes it down again, and writes the short values a box's certificate order needs. It carries no member and no Discord ID. The provider keeps a log of the addresses we set; Router Ports, Names and Your Home's Address says for how long.
A box owner's own home, for the check from outside: one connection to a game server's port at the home's internet address, the same connection a player's game makes. It carries nothing about any member.

One thing can leave because you pressed it. /menu has one Feedback door, and the form it opens asks who a note is for. The box holds up to 1,000 characters, and before you type a word the form tells you what each choice means.

This server's staff. The note is filed in the server's own feedback inbox, which its administrators read in the admin console. It is never posted in a channel and it never leaves the server. It holds what you typed, your Discord ID and display name, and when you sent it. An inbox keeps at most 500 notes; past that, the oldest notes staff have already dealt with are dropped first. A note staff delete loses its words and keeps only the record that it existed, so a second administrator can see it was dealt with.
The bot's owner — whoever runs this copy of the bot. The note is sent to them as a Discord direct message carrying what you typed, the name and ID of the server you sent it from, the bot's version number, your Discord display name and your Discord user ID, and when you sent it. If that direct message is refused, it goes instead to a backup address the operator has set up, carrying the same except your name and your ID. A copy is also kept on the machine, in this deployment's own feedback archive, before it is sent — so it is kept even when neither route delivers it. The archive holds at most the 2,000 most recent notes from every server together, and a server's notes are deleted with the rest of its data if a deletion of that server's data is asked for — see If a Server Removes the Bot. A deletion request does not reach this archive by itself; to have a note removed from it, name the note when you write to privacy@asbern.gg.

Neither sends your avatar, your email address, or anything else from your Discord profile, and nothing is sent unless you open that door and press send.

Beyond the list above and that one door, the only recipients outside this deployment are Stripe and — where a sale is made through it — Link, and only for what the billing section names. A box's own downloads and its certificate order go from the box itself, not from this deployment: see Your Asbern Box and A Watch Party on a Box.

Your Rights Under EU and UK Data Protection Law

This section applies to you if you are in the European Economic Area, the United Kingdom or Switzerland. Those laws follow the person rather than the company: they apply because of where you are, not because of where we are, and none of what follows is a favour we are doing you. If you are somewhere else, the sections above still describe everything that is held, and the requests below are honoured for everybody regardless of where they live — see Everywhere Else at the end.

Who Decides What Happens to Your Data

Asbern LLC is the controller of the data described on this page, and can be reached at privacy@asbern.gg for anything in this section. There is no separate data protection officer: the law requires one only of public authorities, of organisations whose core activity is large-scale systematic monitoring, and of those handling special-category data at scale, and this is none of the three. Saying so is more useful than naming a title nobody holds — a request sent to that address reaches the person who can actually act on it.

Where Your Data Is

Your data is processed and stored in Ashburn, Virginia, United States.

⚠ That is outside the EEA and outside the United Kingdom, and you are entitled to know it before you decide anything. The European Commission has not issued an adequacy decision that covers this deployment, and we do not hold a certification under the EU–US Data Privacy Framework — we would rather say that plainly than imply a protection we have not earned. Nor have we signed Standard Contractual Clauses with anyone, and the reason is structural rather than an oversight: those clauses bind an exporter inside the EEA to an importer outside it, and there is no exporter in the middle here. Your Discord server talks to our machine directly.

What that leaves you is the thing this paragraph exists to give you — the information to decide. The practical risk of data being held in the United States is that it is reachable by US legal process in ways EEA data is not. What is held is listed in full above; it is Discord identifiers you already publish, activity counts from one server, and — only if you subscribe — billing identifiers held by Stripe rather than by us. If that is not a trade you want to make, you do not have to make it, and the section below on objecting and erasing is how you stop.

Where Your Data Came From, Since You Never Filled in a Form

Almost nothing here was typed by you into a box of ours. Your Discord user ID, your display name and your avatar reach us from Discord, because you are in a server that runs this bot, and your activity counts are produced by the bot watching a channel it was pointed at. The few things you do supply deliberately — a birthday, a timezone, a feedback message — are named as such in the sections above.

⚠ So there is no answer to "what happens if I refuse to provide it", because nothing was ever asked of you. You are not under a statutory or contractual obligation to provide any of it. The way to stop the bot holding new data about you is to stop being in a server that runs it, and the way to remove what it already holds is a deletion request, described under What you can erase. Payment details are the one exception: if you choose to subscribe, providing them to Stripe — or to Link, where the sale is made through Link — is a requirement of that contract, and not providing them simply means no subscription.

Why We Are Allowed to Hold It

Every line below is a legal basis under Article 6, and they are not interchangeable — which one applies decides which rights you have.

What	Why we may do it
Running the bot's features in a server you are in — levels, balance, activity counts, the games	Legitimate interests. The server's administrators asked for a bot that does these things, and it cannot do them without keeping a record per member. The interest is theirs and ours in operating the service; what it costs you is a set of counters attached to an identifier Discord already publishes, in one server, which you can erase yourself at any time.
Moderation records — warnings, the staff delete log, automatic moderation	Legitimate interests in a server being able to run a safe community and show its staff why an action was taken.
Signing you in on this website and showing you your own record	Legitimate interests in letting you see what is held about you, which is also the point of the access right below.
Keeping diagnostic logs and backups	Legitimate interests in the service staying up and in being able to recover it after a failure.
Arranging your quick links from the doors you press	Legitimate interests in putting the parts of the bot you use most one press away. It is used for nothing else, and objecting to activity counting deletes it.
Importing a server's history from StatBot, at its administrator's request	Legitimate interests of that server in keeping its own history across a change of bot. You may object, and a deletion request removes what was imported about you.
Showing the operator how the bot is used	Legitimate interests in keeping the service working and finding what breaks. It names no member.
Keeping a server's data after the bot has been removed, until somebody asks for it to be deleted	Legitimate interests of that server in coming back to its history intact, which is the only reason it is kept. Nothing is processed while it waits, and a request to delete it is honoured.
Keeping the record of a linked Asbern box, and asking it what it runs	Legitimate interests of the server's administrators, who linked the box so the bot could run their game servers and watch party on it. It holds no member's data beyond the Discord ID of the administrator who made a code.
Publishing a box owner's home internet address in a game server's name while it runs, and checking from outside that friends can reach it	Consent of the box's owner, given on the machine when router ports were turned on. No name is published for a game server unless an administrator of the Discord server, who need not be the box's owner, has also chosen Friends outside can join for that server. The box's owner can withdraw consent at any time, and it takes effect at once: `asbern ports off` on the machine, like an administrator switching Friends outside off for one server, takes the names down within a minute. Withdrawing cannot recall what the DNS provider's log or public DNS history already hold.
A birthday year, and any other optional detail you type in yourself	Consent. It is off by default, you supply it or you do not, and you can withdraw it by removing it from the same screen you set it on. Withdrawing does not undo what was done while it was set, and nothing else stops working when you do.
Taking payment for a subscription	Performance of a contract with whoever subscribes. Where the sale is made through Link, Link is the seller, and what it collects it holds as its own business under its own privacy policy.
Keeping the financial record of that payment	Legal obligation — tax and accounting law requires it to be kept, which is why it outlives a cancellation.

⛔ We do not rely on consent for the ordinary running of the bot, and it would be dishonest to pretend otherwise — you cannot meaningfully consent to a bot that was already in the server when you joined. Legitimate interests is the accurate basis, and its price is that you get an unconditional right to object to it, which consent-based processing does not carry in the same form. That right is immediately below.

What You Can Ask For

Right	How it works here
Access — a copy of what is held	Most of it you can already see: `/menu` shows your own record in the server, and this website shows it too. For a copy in writing, or for anything the screens do not show, write to privacy@asbern.gg.
Rectification — correct something wrong	Your name and avatar come from Discord and correct themselves when you change them there. For anything else, write to the same address.
Erasure — delete it	Write to privacy@asbern.gg: a deletion request, described under What You Can Erase, deletes your record in that server once we have checked the request is yours. That section, and the stores described above it, are also honest about what it cannot reach and why.
Restriction — freeze it instead of deleting it, while something is disputed	By request. Say what you are disputing so there is something to freeze.
Objection — tell us to stop	Because most of the bot runs on legitimate interests, you may object at any time and we must stop unless we can show compelling grounds that override yours. In practice, for a Discord bot, you objecting is the end of it. For activity counting you can do it yourself, in one press: Stop counting my activity, on the Settings screen of the Profile tab. For anything else, or if you would rather, write to privacy@asbern.gg.
Portability — take it elsewhere	For the data you supplied and the data processed by consent or under a contract, in a machine-readable form, by request.
Withdraw consent	On the same screen you gave it; for a box's router ports, on the machine, with `asbern ports off`. It takes effect immediately and never costs you anything else.
Complain to a regulator	Below, and it does not depend on asking us first.

There is no charge, and no requirement to give a reason for erasure or objection. We answer within one month; if a request is genuinely complex we may take up to two more, and we will tell you inside the first month if that happens rather than going quiet. We may ask you to prove you control the Discord account in question — usually by sending the request from it — because handing somebody else's record to whoever asks would be the worse failure.

Complaining About Us

You can complain to a supervisory authority, and you do not have to raise it with us first (though it is usually faster). You may complain to the authority in the country where you live, where you work, or where you think the problem happened.

In the EEA, each country has its own. The European Data Protection Board publishes the current list of every national authority and how to reach it.
In the United Kingdom, it is the Information Commissioner's Office.
In Switzerland, it is the Federal Data Protection and Information Commissioner.

⚠ We deliberately do not name one single authority as "ours". The one that matters is yours, and pointing every reader at a regulator in a country they do not live in would send most of them to the wrong door. There is also nothing to name: the one-stop-shop mechanism gives a controller a single lead authority only where it has an establishment inside the EEA, and this one does not.

Automated Decisions

Nothing here makes an automated decision about you that produces legal effects or anything similarly significant, and there is no profiling for advertising, scoring or prediction of any kind.

The closest thing in the software is the automatic moderation an administrator can switch on, which can delete a message or time you out according to rules that server's own staff configured. We say what it is rather than claiming it does not exist: it is a rule about behaviour in one Discord server, it is visible to and reversible by that server's staff, and it has no effect on anything outside that server. Levels, balances and leaderboards are arithmetic on counters, not decisions about a person. Nor are your quick links: they are arranged automatically from the doors you press, and all that changes is which buttons you see first.

Everything Else That Has to Be Said Here, Said Elsewhere

Two of the disclosures the law requires are already on this page in full, and repeating them here in summary would only create a second version to drift out of date:

Who Your Data Is Shared With — the section of that name, which lists every outbound address in the shipped code and says which of them carry anything about you (almost none do).
How long it is kept — the section of that name, including what happens when a server removes the bot.

Everywhere Else

If you are in the United States, this deployment is small enough that most state privacy statutes do not reach it — including the one where we are established, the State of Texas, United States of America, whose act exempts small businesses, and California's, whose thresholds we are nowhere near. We would rather tell you that than let a compliance-sounding paragraph imply an obligation we are not under.

What matters more is what we do regardless: we do not sell your personal data, we do not share it for cross-context behavioural advertising, and we do not use it to train any model — so the opt-outs those laws are mostly built around have nothing to bite on here. The access, correction and deletion requests described above are honoured for anybody who asks, from anywhere, on the same terms and at no charge. Rights that exist by law in your state are not diminished by anything on this page.

Children

Asbern is not directed at children. You must meet Discord's own minimum age for your country in order to use Discord at all, and therefore to use Asbern.

⚠ Asbern never asks how old you are, with one exception you control. The birthday feature described above accepts an optional year, and a year is an age. It is off in every server by default, the year is never required, you supply it yourself or not at all, and you can remove it from the same screen you set it on. Nothing else in the software asks, infers or records anybody's age.

Changes to This Page

When this page changes, the date at the top changes with it and the list at the top says what changed. It is kept in the same version control as the software, so its history is reviewable rather than assertable.

Contact

support@asbern.gg

For questions about your data specifically — what is held, or a request to delete or export it — write to privacy@asbern.gg. It reaches the same operator; it is named separately so a data request is not buried in general support.