Legal

Privacy Policy

Effective 13 November 2026 · Last updated 13 November 2026

In short

Signing in uses Discord and asks only for the identify permission. We see your Discord ID, username and avatar — never your email, password, or the list of servers you are in.
BTL Utilities reads messages in the servers it is added to so that features like automod and levelling can work. It does not save message text in its database.
We store records linked to Discord user IDs, such as XP, warnings and reports. The staff of that server can see and manage them.
The server leaderboard — names, avatars and XP — can be fetched without signing in.
We don’t sell data, show ads, or use analytics or tracking cookies.
To ask a question or have your data removed, contact the staff of the Discord server where you use BTL Utilities, who can pass your message on to us.

This policy explains what information BTL Utilities collects, why, who can see it, and what choices you have. It is written in plain language; the detail is in the sections below.

1. Who we are and what this covers

BTL Utilities is a Discord bot and web dashboard for community moderation, logging, levelling and related tools. It is run by the BTL Utilities team (“we”, “us”). This policy covers the BTL Utilities bot and the BTL Utilities dashboard. It does not cover Discord itself, which has its own Privacy Policy.

Each Discord server decides how BTL Utilities is set up in that server. The server’s owner and staff choose which features are on, what gets logged and what moderation actions are taken. If you have a question about a specific moderation decision, contact that server’s staff; for how BTL Utilities handles data, contact us.

2. Information we collect

2.1 When you sign in to the dashboard

You sign in with Discord. We request only Discord’s identify permission, which gives us your Discord user ID, username and avatar. We do not receive your email address, your password, or the list of servers you belong to. After you sign in we check, in the server BTL Utilities is configured for, whether you are a member and which roles you hold, so we can decide which dashboard sections you may open.

2.2 What the bot reads in a Discord server

For features to work, the bot receives events from the servers it is in, including messages as they are posted (using Discord’s “Message Content” permission), reactions, member joins and leaves, role changes and moderation events. This is processed as it happens — for example to apply an automod rule, count XP for levelling, or trigger an auto-reply. Message text is not saved in our database. Staff can, however, turn on event logging, in which case BTL Utilities posts details of events (which can include the content of edited or deleted messages) to a Discord channel those staff choose. That copy lives in Discord under that server’s control, not in our database. If the ticket transcript feature is in use, deleted messages in a ticket are held in memory while the ticket is open and written into a transcript that is posted to a staff channel.

BTL Utilities asks Discord for member presence information as part of the permissions it requests, but it does not store or use it.

BTL Utilities sends direct messages in some situations, for example to tell a member about a mute, or to tell a reporter how a report was handled.

2.3 Records we store

BTL Utilities keeps these records in its own database, linked to Discord user IDs:

Category	What is stored	Why
Levelling	XP, level, message count, time of last XP gain, weekly and monthly XP totals.	To run levels, rewards and leaderboards.
Rank card and applications	Card colours, bio text, background image link, a monthly edit counter, and pending card or custom-role requests (role name, colour, icon link).	To show your personalised rank card and review requests.
Moderation	Warning and infraction counts, moderation actions (type, user, moderator, reason, duration, time), staff notes, blacklist entries, reaction-spam strikes, and the roles saved for members who are muted or banned.	To enforce server rules and restore roles correctly.
Reports	Who reported and who was reported, the rules cited, a link to the message, any attachment link, notes, status and timestamps.	So staff can review and resolve reports.
Roles and community features	Role removals, temporary role expiry times, starboard entries (message and author IDs, star counts) and giveaways (host, prize, channel).	To run those features.
Dashboard access	Which roles and users may sign in, their permission levels, and an audit trail of permission changes (who changed what, and when).	To control and account for dashboard access.

Server staff also store configuration (channels, roles, messages, rules). That is settings data rather than personal data, though it may mention roles or channels.

2.4 Cookies and sessions

We use one cookie, connect.sid, to keep you signed in. It is set only after you sign in, is marked HTTP-only and SameSite=Lax (and Secure when the site is served over HTTPS), and lasts up to 7 days. It holds a random session identifier; the session itself (your Discord ID, username and avatar) is stored on our server. We do not use advertising, analytics or tracking cookies. Visiting these policy pages does not set any cookie.

2.5 Technical data

Our server writes ordinary operational logs (such as which page or API route was requested and how long it took). To protect public routes such as the leaderboard from abuse, it also counts requests per IP address, held in memory only for the length of the rate-limit window. An address that sends an excessive number of requests is blocked until the service restarts (or for longer if we add it to a permanent block list), and that block is recorded in our operational logs together with the IP address. Our hosting provider or any reverse proxy in front of the dashboard may also keep standard access logs, which can include IP addresses and browser details.

2.6 The public leaderboard

The levelling leaderboard is available through a public address that does not require signing in (it is rate-limited, and requests from blocked IP addresses are refused). For each member listed it returns their Discord user ID, Discord username, avatar, level and XP — including members who have since left the server. If you do not want to appear, ask the server’s staff or us to remove your levelling record.

3. How we use information

To sign you in and decide which dashboard sections you may use.
To run the features a server has turned on: automod, moderation tools, reports, levelling and rank cards, logging, auto-replies, role tools, giveaways and the starboard.
To keep the service secure, prevent abuse and rate-limit requests (which involves IP addresses — see section 2.5).
To fix problems and improve how BTL Utilities works.
To meet legal obligations and to respond to requests you make.

We do not use your information for advertising or profiling, and we do not make decisions about you using it beyond the moderation rules a server’s staff have configured.

4. Legal bases (where GDPR or UK GDPR applies)

If the GDPR or UK GDPR applies to you, we rely on: legitimate interests in providing moderation and community tools to the servers that use BTL Utilities, and in keeping them safe and secure (balanced against your rights, which is why we collect only what the features need); contract where you use the dashboard under our Terms; and legal obligation where the law requires us to keep or disclose information.

6. Third-party resources the dashboard loads

To display the dashboard, your browser loads some resources from other services, which therefore receive your IP address and browser details:

unpkg.com delivers the icon library (Lucide) the interface uses.
cdn.discordapp.com delivers avatars and other Discord images.

Fonts are hosted by us and are not loaded from a third party. This policy page loads nothing from third parties other than the links you choose to follow.

7. How long we keep information

Sign-in sessions expire after 7 days, or when you log out.
The role removal log is cleared of entries older than 30 days.
Request counts by IP address are held in memory for the rate-limit window only. Automatic blocks last until the service restarts; a mention in an operational log lasts as long as that log is kept.
Automod strikes stop counting after the expiry period each rule sets.
Everything else (levelling, moderation history, reports, rank cards, access records) is kept for as long as BTL Utilities is used in the server, so that things like warnings and XP stay consistent. We do not apply a shorter automatic deadline to these records. Staff can remove many of them using the bot or dashboard, and you can ask us to delete yours (see below).

8. Your choices and rights

You can ask us to tell you what we hold about you, correct it, delete it, or stop using it for a particular purpose. Depending on where you live, you may have further rights, including to object to processing, to receive your data in a portable format, and to complain to your local data-protection authority.

To make a request, contact the staff of the Discord server where you use BTL Utilities, who can pass your message on to us in a way we can link to you (for example, tell us your Discord user ID and the server). We aim to reply within one month. We may keep a minimum record where we need it for safety, to stop someone evading a ban, or to comply with the law.

You can also: sign out at any time; remove BTL Utilities’s access to your Discord account under Discord → Settings → Authorized Apps; and edit or reset your own rank card where the dashboard lets you.

9. Children

Discord requires users to be at least 13 (or older where local law sets a higher age). BTL Utilities is not directed at children under that age, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

10. Security

Dashboard access is limited by section and permission level, and these permissions are checked on our server for every page and request. Sessions use HTTP-only cookies. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect the information we hold and will act promptly if we learn of a problem.

11. Where information is processed

BTL Utilities runs on infrastructure provided by our hosting provider. Discord processes data in the United States and elsewhere. Where information is transferred across borders, we rely on appropriate safeguards where the law requires them.

12. Changes to this policy

We may update this policy as BTL Utilities changes. We will change the “Last updated” date above, and where a change is significant we will tell server staff through the dashboard or Discord.

13. Contact

Questions or requests: contact the staff of the Discord server where you use BTL Utilities, who can pass your message on to us. Operator: the BTL Utilities team.