Privacy and your data

This English version is a convenience translation. If it differs from the Portuguese text, the Portuguese version prevails.

This page describes the features and data handling implemented in public Lobbito. The operator's and infrastructure information must be completed by the operator.

Data separated by community

Discord IDs, display name, profile, recreational points, inventory, operations and settings are tied to the server where they were used. The dashboard requires current Discord authorization; an administrator cannot view data from another server.

O login solicita identificação e lista de servidores. Tokens OAuth são usados durante o login e descartados, sem serem mantidos no navegador ou banco. O cookie do painel identifica uma sessão que expira em 60 minutos e é revogada ao sair. Uma tentativa financeira com resposta interrompida pode manter uma chave opaca na aba do navegador para repetir o mesmo pedido após recarga, sem guardar seu texto, motivo ou credenciais.

AI conversation and text protection

When you use /ai, the question, the community's guidance and the allowed recent context are sent to OpenAI. The optional history is separated by server, channel and person, with up to 10 interactions and retention of 1 to 72 hours, as configured. Replies can be private or public in the command's channel; in public mode, members with access to the channel can see them.

Protection of questions and answers uses OpenAI's omni-moderation-latest and is mandatory. Analysis of regular conversations depends on administrative configuration, chosen channels and the actual availability of the message content intent. Only new text messages are analyzed: attachments are not sent for this analysis and there is no history scan.

The private review queue keeps references to the message, categories, scores, status and human decision, without a copy of the text, for 1 to 30 days. Failures and quotas show as “not analyzed”; a flag doesn't prove a violation nor apply automatic punishment. Deleting the queue removes its review records, keeping counters and temporary identifiers needed to prevent repetition. Usage dashboards don't show questions or answers to administrators.

Optional modules

Enabled features may keep XP, levels, voluntary giveaway entries, reminders, tickets, role choices, birthday month and day, and moderation records. Birthdays don't include the year of birth. Manual moderation records author, target, reason and action status and restricts the records to the authorized team in the configured admin channel.

AutoMod uses Discord's native rules: Lobbito stores the configuration, including the blocked word list, and creates the rules in the server. Discord is what checks messages; they never go through Lobbito.

Identity and the weekly schedule are server administrative settings. Publication requests retain the author, configuration used, status and message reference for up to 30 days after processing. The current hub is preserved while in use; uncertain requests await administrative review. Disconnecting a panel does not delete its message or remove roles. Hub lookups are private and use each member's existing data.

Entry verification gives the configured role to whoever clicks the button. Account age is worked out from the Discord ID, without storing anything about the person. The raid alert counts joins in memory only, for one minute, without recording who joined.

Suggestions keep the author, text, status and decision reason. Votes stay only in the Discord reactions. Decided suggestions are deleted from Lobbito 90 days later; the posted message stays on Discord. The data export includes your suggestions.

The daily streak keeps only the number of days in a row and your record. Achievements and the monthly ranking are worked out from existing records, without storing anything new.

The dashboard's configuration history shows who saved each change and when, from the server's audit records, without the content of configured messages.

Social alerts read configured official sources. Integrations that require authorization only work with the operator's credentials and valid authorization for the community; the dashboard shows availability and delivery states without revealing tokens. The observed history depends on what the provider makes available.

Custom replies are the server's administrative texts, available through private lookup to current members. /reply remove deletes the content even with the module off; the configuration stays until administrative removal or deletion of the community's data. Old confirmations don't restore deleted content. The last read defines the lookup's reply; a later removal doesn't recall replies in transit or already saved. Minimal text-free operation and audit metadata expire after seven days plus the cleanup interval.

Inversion, grayscale, horizontal mirroring and rotation process locally the PNG/JPEG voluntarily sent as an attachment of the interaction itself. Lobbito doesn't keep the image, its hash, name or signed URL; metadata is stripped from the output, with byte, pixel and processing limits. The original attachment and saved replies remain subject to Discord's storage. There is no AI provider in this feature.

Fictional work and assets use only this community's points. Balances, positions, last activity, daily limits and receipts stay tied to the server to keep operations consistent; they don't verify real work or quotes. Group games keep room, participants and tries only in memory for up to five minutes, without history or reward. Only current authorized participants in the channel see the status, their own tries and the remaining time; restarting the bot ends the rooms. Invitations are shared manually with a copyable command, without direct messages.

Bonds and recognitions require a private invitation and acceptance, with codes shared manually by the participants. They keep both participants' IDs, status and deadlines: invitations for up to one hour and acceptances for up to thirty days. Any participant can revoke, even with the module off and no quota available. /reputation remove without a code offers a private selection of your own records: status, direction and deadline, without third-party IDs. The selection only prepares a new confirmation; it doesn't delete or accept invitations. Minimal anti-repetition receipts expire after thirty days plus the cleanup interval; there are no messages to third parties, ranking or effects on points and roles.

Private event records observe only the creation, change and removal of channels and roles while the module is active. They keep the resource and server IDs, type and time for seven days, limited to one thousand events per community; they don't keep names, content, previous values or author inference. The team views or clears them in the configured private admin channel.

External searches send only the chosen term to Wikipedia or Open Library. Weather sends only the typed city name or coordinates rounded to 0.01 degree to Open-Meteo, with worldwide coverage. These sources may receive the operator's IP address and process lookups under their own policies. Lobbito doesn't keep terms or coordinates nor make automatic lookups; replies are private. Local game rules need no external source.

Support requests on the website

The support form requires Discord sign-in and keeps the requester's ID, given name, optional e-mail, subject, message and status. Only the author sees their requests; the general inbox is restricted to the operator accounts configured on the server, with no access for community administrators. Requests expire after 30 days and are deleted in the next periodic cleanup. Nothing is sent by e-mail or Discord, there are no attachments and requests are not included in public records. Don't send secrets or sensitive information.

View and remove your data

Shared profiles require the owner's consent, per server. Editing bio/title or /profile hide revokes future access; cards already saved by others cannot be recalled. Cards are generated locally, without avatars, age or data from external sources. AFK is manual, without a reason or message tracking, expires within 24 hours and can be removed with /afk remove.

Reports are claims made by their author, not automatically verified, limited to 400 characters and without message collection. Only the authorized team sees their content in the configured private admin channel; there are no alerts or automatic punishment. The retention configured for new records is 1 to 30 days, seven by default; expired ones can no longer be viewed and are deleted in the periodic cleanup. /report mine shows your own statuses and deadlines and lets you pick a record to prepare its withdrawal; /report withdraw without an identifier opens the same private selection. The confirmation removes only the chosen report, even with the module disabled and no quota available. Quotas persist for up to two days; minimal metadata of these operations and their local audit, without bio/description, are kept for up to seven days plus the cleanup interval.

When you report through a message's menu, the report keeps only that message's link, never its content.

The Monthly Roulette keeps receipts, tickets and encrypted reservations for up to 90 days after the end of the month, plus the cleanup interval; a campaign with a prize not yet delivered is kept until the staff resolves the delivery. Deleting your profile does not remove these reservations or the points ledger. Exports include only your receipts and delivery states, without codes, ciphertext, fingerprints or keys. Codes are delivered only to the winner in a private reply or an authorized DM; uncertain failures require review of the same prize, with no extra spin or charge.

On the installed server, use /privacy export to get your data, /privacy delete-profile to remove your local bio and title, consent, AFK, reports you sent and bonds/recognitions you take part in, and /privacy delete-conversations to delete your AI history. Administrators can also delete their own history from the dashboard, even with the AI module disabled. Hiding your profile, withdrawing AFK/reports and deleting profile/conversations don't depend on available lookup quota. Personal exports include your profile consent, active AFK, reports you sent, last work activity and fictional positions; bonds/recognitions are exported without third-party IDs; they don't include other authors' reports about you, the reviewer's identity, other people's conversations or reasons of administrative moderation cases.

Contadores, IDs e registros de operações permanecem para integridade, auditoria e prevenção de repetição enquanto a comunidade usa o serviço. Ao desinstalar o bot, o processamento é interrompido e a remoção dos dados operacionais do banco é agendada para 30 dias depois. Isso não apaga mensagens já enviadas ao Discord. Prazos de backups e logs da hospedagem precisam ser informados pelo operador.

Discord, OpenAI when used and the providers of enabled integrations take part in the processing each feature needs. The infrastructure and additional suppliers must be identified by the operator.