Privacy Policy
Last updated August 26, 2026
This page describes how Nocto ("the bot", "we", "us") collects, uses and stores information across the bot itself and its web dashboard. Nocto is operated by an individual and is not operated by Discord. This policy describes Nocto's current data processing practices and is intended to be clear about what information is stored, why it is stored, and how long it is retained.
What we store, and where
Nocto stores operational information in a PostgreSQL database we operate. This includes the Discord servers known to Nocto, the Nocto modules enabled for each server and their configuration, channels and roles within those servers that are required by the bot or web dashboard, information about RSS/Atom items that have already been seen, and records of when Nocto joins or leaves a Discord server. Server configuration may include information such as which feed URLs are configured, which channels features use, or which roles are associated with particular features. Some of this information, such as Discord server, channel and role IDs, can constitute personal data.
Information received from Discord
Nocto receives information from Discord as a result of being installed on a server or being used through the web dashboard. Depending on the features enabled, this can include server, channel and role information, information required to operate configured modules, and information provided through Discord's privileged intents. Much of this information is received from Discord rather than directly from the individual concerned. Discord's own processing of personal data is governed by Discord's own privacy practices and policies.
Message content and audit logging
Audit logging is disabled by default. A server administrator must explicitly enable and configure the relevant audit-log categories before Nocto begins retaining the information required to provide them. Message edit/delete logging causes Nocto to temporarily store recently received message information so that an edited or deleted message can be shown in the server's configured audit-log channel. The stored information can include the Discord message ID, the author's Discord ID, the author's username/tag, and the message content. This information is stored temporarily in Redis rather than the main PostgreSQL database. Message history is retained for 7 days by default. A server administrator can configure a longer retention period, up to a maximum of one year. When a message is edited, Nocto can use the stored version to show both the previous and updated content. When a message is deleted, Nocto can use the stored version to show the content that existed before deletion. If the stored message history has expired, or was not available when the event occurred, Nocto cannot recover the previous content. Message content stored for audit logging is used only to provide the configured audit-log functionality and is not used for advertising or to train artificial-intelligence or machine-learning models.
Member activity logging
Member activity logging is also disabled by default and must be explicitly enabled by a server administrator. Where enabled, Nocto may process information required to record configured member activity events, such as avatar or timeout changes. This information is retained according to the configured audit-log retention period and is used to produce the corresponding audit-log entries.
Discord permissions and privileged intents
Nocto requests only the Discord permissions required by its enabled features, such as viewing channels, sending messages or managing roles where a feature requires them. Some audit-log features require Discord's privileged Message Content and Server Members intents. These are enabled for the Nocto application where required. A server only receives the corresponding functionality when the relevant feature has been explicitly enabled and configured by its administrator.
The web dashboard
Logging into the dashboard uses Discord OAuth2. Nocto uses the information provided by Discord to identify you and determine which servers you are authorised to manage. Discord access and refresh tokens are discarded after the authentication process and are not stored by Nocto. Your dashboard session is maintained using a secure, signed and encrypted cookie in your browser. The session expires after 24 hours. Nocto does not maintain a server-side list of active dashboard sessions.
RSS and Atom feeds
If a server administrator configures an RSS or Atom feed, Nocto retrieves that feed and checks for new items. Nocto stores information about feed items it has already processed so that the same item is not repeatedly posted to Discord. The configured feed information and information required to identify previously processed items may therefore be stored as part of the server's configuration and RSS processing data. When Nocto retrieves a feed, the feed provider may receive the network information normally associated with an HTTP request, such as the IP address of the Nocto server.
How we use information
Nocto processes information to provide and operate the Discord bot and its enabled features, maintain server and module configuration, provide the web dashboard, authenticate dashboard users and determine which servers they can manage, provide audit logging where explicitly enabled by a server administrator, prevent duplicate RSS/Atom posts, maintain operational records of when Nocto joins or leaves Discord servers, detect and investigate abuse such as ban evasion, maintain the security and reliability of the service, and respond to privacy requests or other communications.
Legal basis for processing
Where UK data protection law applies, Nocto processes personal data on an appropriate lawful basis depending on the purpose. This may include legitimate interests for operating and securing Nocto, providing its features, maintaining server configuration, preventing abuse and maintaining appropriate operational records; performance of a contract or steps taken at the user's request where processing is necessary to provide a service requested by the user, such as dashboard authentication and functionality; and compliance with a legal obligation where processing is necessary for Nocto to comply with the law. Where we rely on legitimate interests, those interests include operating and securing the service, preventing abuse, and providing features requested by server administrators.
Data retention
Different types of information are retained for different periods, and no store described in this policy retains information for longer than one year, with one exception. Audit-log message history is retained for 7 days by default, unless a server administrator configures a longer period, up to a maximum of one year. A server's saved Nocto configuration is retained so that it can be restored automatically if the bot is re-added after being removed, but is automatically deleted after one year if the server has not re-added Nocto by then. Warn and timeout history is likewise automatically deleted after one year. The one exception is server join and leave records, which are retained for as long as reasonably necessary for operational, security and abuse-prevention purposes (for example, identifying a bot being repeatedly removed and re-added) and are not subject to the one-year limit, since automatically deleting them would undermine that purpose. RSS/Atom information is retained for as long as necessary to prevent duplicate processing and operate the configured feed functionality. Where a specific retention period is not stated, information is retained only for as long as reasonably necessary for the purpose for which it was collected.
Security
Traffic between Nocto's own processes and its databases is encrypted in transit. Database backups are encrypted at rest. Dashboard sessions use a secure, signed and encrypted cookie, described further under The Web Dashboard above. These measures reduce risk but, as with any online service, we cannot guarantee absolute security.
Backups
Our PostgreSQL database is backed up regularly so that we can recover from accidental deletion, hardware failure or other operational problems. We retain 7 daily backups, 4 weekly backups and 6 monthly backups. Backups are used for recovery purposes and are not intended to extend the normal retention period of personal data. Where information is deleted from live systems, copies may remain in an existing backup until that backup expires. Backup copies are not used for normal operation and are not restored except where necessary for recovery.
Who receives your information
We do not sell personal data or provide it to third parties for advertising or behavioural tracking. Information may be processed by infrastructure or service providers used to operate Nocto where this is necessary to provide the service, maintain its infrastructure or protect its security. Such providers may process information on our behalf and are not permitted to use it for unrelated purposes. We may also disclose information where required by law or where necessary to protect the rights, security or property of Nocto, its users or others.
What we don't do
We do not sell your data, we do not display advertising, we do not use third-party advertising or tracking technologies on the Nocto website or dashboard, and we do not use information processed through Nocto to train artificial-intelligence or machine-learning models.
Removing Nocto from a server
Removing Nocto from a Discord server stops the bot from operating there, but does not automatically delete the server's saved configuration. Saved configuration may be retained so that, if Nocto is added to the same server again, its previous configuration can be restored. If a server was previously removed from Nocto and is subsequently added again, the dashboard provides an option to wipe the saved configuration for that server. You can also contact us to request deletion of information associated with a server. Some information may remain temporarily in backups after deletion from live systems, as described in the Backups section.
Your rights
Where UK data protection law applies, you may have rights over personal data that Nocto processes about you. Depending on the circumstances, these may include the right to request access to your personal data, correction of inaccurate or incomplete personal data, deletion of personal data, restriction of processing, objection to certain processing including processing based on legitimate interests, and data portability where the applicable legal requirements are met. These rights are not absolute and may not apply in every situation. To exercise a privacy right or ask a question about how Nocto processes information, contact [email protected]. We may need to verify your identity before responding to a request.
Complaints
If you believe Nocto has not handled your personal data appropriately, please contact us first at [email protected] so that we can investigate the issue. You also have the right to complain to the UK's data protection supervisory authority, the Information Commissioner's Office (ICO).
Changes to this policy
This Privacy Policy may be updated from time to time to reflect changes to Nocto, its features, its infrastructure or applicable legal requirements. The date at the top of this page indicates when the policy was most recently updated.
Contact
Questions about this policy, privacy requests or other privacy concerns: [email protected].