1. Controller
Peter Gnädig
Klappschau 0, 24837 Schleswig
Germany
Telephone +49 175 3255576
Email fjordbot.contact@gmail.com
2. Data we process
Depending on how Fjord is used, processing may include:
- technical connection and security data such as IP address, timestamp, requested URL and browser information;
- Discord account data used for sign-in, including Discord ID, username, display name, avatar and, where provided by Discord and required, email address;
- Discord server, membership and permission information needed for authentication, server selection and administration;
- server configurations and content saved by authorized users, including embeds, AutoMod, welcome, activity-log and other dashboard settings;
- account preferences such as language, appearance and accent colour;
- log and error data where needed for security, stability and abuse prevention.
Account data, memberships and server events are obtained from Discord during sign-in and bot operations. Messages and moderation information may also concern server members who do not use the dashboard. Images, message templates and embeds supplied by authorised users are processed to provide the selected functions.
3. Discord sign-in and required information
Sign-in uses Discord OAuth2. Discord supplies user ID, username, display name, avatar, the authorised email address and its verification status, server memberships and permissions. These details support the session, server selection, access controls and matching privacy requests. Fjord does not receive your Discord password.
One-time sign-in records protect the redirect and Discord response. The Discord access token used during sign-in enables necessary queries and is not stored as a permanent account attribute. Session and retention periods are explained in the deletion section. Logging out ends the session but does not automatically delete all account preferences, pins or server data.
4. Bot functions and automated moderation
Server operators select modules and rules. Depending on enabled functions, Fjord processes user, server, channel, role, message and emoji IDs, profile details, memberships, permissions, message contents, links, attachments, reactions and server events. This includes members who do not sign in to Fjord. Information comes from Discord, user commands and settings entered by authorised server administrators.
Welcomes, farewell messages, automatic roles, moderation and activity logs use these details for the selected functions. Configured moderation rules can automatically delete messages, issue warnings and trigger timeouts, kicks or bans. Warnings may contain user ID, server ID, time, reason and moderator. Event notices are sent to configured Discord channels and visible according to channel permissions.
For edit and deletion notices, the activity log can temporarily hold message snapshots in memory. This cache is limited to approximately one hour and cleaned up while the service runs. Log messages published in Discord are separate. Individuals can contact server moderators and Fjord through our contact address about moderation actions. Where Article 22 GDPR applies, statutory rights including human intervention, expressing a viewpoint and contesting a decision remain available.
Server operators also determine access permissions and use of published content on their servers. Discord’s processing and server operators’ own processing additionally fall under their responsibility and privacy notices.
5. Purposes and legal bases
Sign-in, access controls and dashboard functions requested by users provide Fjord. Where processing is necessary to perform the service relationship or take steps requested before it, the basis is Article 6(1)(b) GDPR.
Secure operation, attack and abuse prevention, technical troubleshooting, server administration, welcomes and moderation rely on Article 6(1)(f) GDPR where we are responsible for these activities. Our legitimate interests and those of server operators are a functioning service, orderly server communities and protection of members. This also concerns members without a dashboard account. Necessity and the competing rights of affected individuals must be considered.
To comply with statutory data-protection duties, particularly rights requests and authority requirements, necessary information is processed under Article 6(1)(c) GDPR together with the relevant legal obligation. Contact enquiries rely on Article 6(1)(b) or (f), depending on their purpose. Required information enables sign-in, functions or handling of the enquiry. Without it the relevant service may be limited or unavailable.
6. Cookies and local storage
Fjord uses a server-side session with an HttpOnly session cookie for sign-in. Browser code does not read this cookie directly. The selected appearance and language are stored as fjord-theme and fjord-language in local browser storage and preference cookies. The code sets preference cookies to last one year. Local entries remain until changed or deleted using browser controls. For signed-in users, preferences are also sent to their account. The session supports the requested sign-in. Preference storage supports the appearance and language selected by the user. Access to the device strictly necessary for these requested functions falls under section 25(2)(2) TDDDG. Browser controls allow you to delete or block storage. This may remove saved preferences or restrict sign-in.
7. Recipients and international transfers
Fjord operates its databases itself on a dedicated server provided by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. The server is in Finland within the EU. A data-processing agreement under Article 28 GDPR is in place with Hetzner. Hetzner provides the hosting infrastructure. Further information is in Hetzner’s privacy policy. The S3-compatible RustFS object store, image renderer and image-processing services also run on this server and are operated by Fjord itself.
The public access path for the website and API uses Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare may process IP addresses, request and connection details and proxied content for delivery and security. See Cloudflare’s privacy policy and data-processing agreement. We use Cloudflare Tunnel for public access and Cloudflare’s cache to temporarily store and deliver images.
Sign-in, bot functions and loading Discord avatars transfer data to Discord. For EEA users, Discord identifies Discord Netherlands B.V., Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands, as controller of its service. Direct avatar requests also transmit browser connection details to Discord. Discord processes data in the USA and other countries. Its privacy policy explains applicable safeguards.
Our contact address uses Gmail. Email enquiries therefore also involve Google processing sender addresses, contents and attachments. Google identifies Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as controller for Google services in the EEA. See Google’s privacy policy.
Our own server’s location does not restrict these other services to EU processing. Transfers outside the EEA are subject to Articles 44 onwards GDPR. Published provider documents describe standard contractual clauses and, where applicable, adequacy decisions. Cloudflare’s data-processing agreement provides corresponding standard contractual clauses for these transfers. Information about applicable safeguards can be requested through our contact address.
8. Retention and deletion
Server configurations, stored content and uploaded files remain stored for the requested functions until authorized users delete or replace them or the server cleanup described below applies. For new automatic and manual warnings, the server can configure a period per warning level from one hour to one year (365 days). Without configuration, it is one year; longer periods are not allowed. The expiration date is fixed when the warning is issued. It cannot subsequently be changed for warnings already stored with an expiration date; changed settings apply only to new warnings. The database automatically removes expired warnings from active warning records. Older warnings without an expiration date are not given one retroactively. Earlier authorized removal by moderators, server cleanup and requests for erasure or restriction subject to applicable legal requirements remain possible. The backup rules described below continue to apply.
Logging out alone does not remove account preferences or pins. Global block lists store the relevant Discord user or server ID for the duration of a block to enforce it and prevent circumvention. Applying a block does not automatically delete all other data. Contact enquiries are retained for handling and necessary evidence. Required retention of technical logs depends on troubleshooting, security incidents and, where applicable, preservation of legal claims. Data must be deleted when its purpose and any overriding statutory grounds cease to apply.
An account block also blocks known associated email addresses through an HMAC comparison value generated with a secret key, alongside the Discord user ID. This does not block IP addresses. Existing sign-in sessions are removed and further sign-ins using blocked identifiers are rejected. Associated account identities, personal dashboard preferences, server pins and installation flows are cleaned up. Interrupted cleanup is retried. A minimal block entry containing the identifier, reason and time remains for as long as the necessary block applies. Account blocking does not reset AutoMod or moderation records, particularly warnings. These continue to support moderation and prevention of repeated abuse. Retention must be limited to necessary data and purposes and reviewed regularly. Separate server cleanup and statutory rights to erasure, restriction and objection remain unaffected.
To securely match data-protection requests to an account, Fjord stores the Discord user ID, the email address most recently supplied during a successful Discord sign-in, its verification status, and the times of the first and most recent synchronisation. There is exactly one identity record per Discord account, and it is updated at every subsequent sign-in. After two months without another sign-in, this identity record is deleted during the next daily cleanup.
Server settings, warnings, server pins and uploaded server files are associated with the relevant Discord server ID. For cleanup, Fjord collects the server IDs stored in its databases and object storage and compares them with the bot’s complete, synchronised membership list. Stored server IDs absent from that list are initially recorded for review before deletion. Server IDs that the bot reports as current memberships are excluded from this cleanup.
While the service is running, Fjord checks every 15 minutes whether the bot is still present on stored servers. Deletion starts no earlier than 15 minutes after its absence is first detected and only after renewed confirmation for that server. Data is preserved when the server list is incomplete, connections fail or absence is not clearly confirmed. Following confirmed removal, associated configurations, warnings, server pins and uploaded server files are deleted from active databases and object storage. Failed deletion jobs remain stored and are retried. This server cleanup does not delete global block lists or copies held by Discord.
Sign-in remains valid for at most 31 days from sign-in and ends sooner on logout or account blocking. Active use does not extend this fixed lifetime. Expired server-side sessions are deleted from the session database. Cleanup runs every minute while the service is running and immediately after a restart. Outages may delay physical deletion. Cleanup is retried when the service is restored. The expired session remains invalid regardless of this delay. One-time records for Discord sign-in are valid for ten minutes by default and at most 30 minutes depending on configuration. Consumed records are removed; expired records are also cleaned up during new sign-in attempts. The two-month period without a new sign-in applies only to the separate account identity record, not to sign-in sessions. Deleting that record does not automatically delete account preferences or server pins.
We operate an active versioned backup system for databases and uploaded server files. Backups may include server settings, moderation data, account identities, account preferences and block mappings. Active sign-in sessions and short-lived OAuth records are excluded from restoration material. These backups have a retention period of seven days. Deletion from active storage does not immediately remove older backup copies. Expired backup generations are automatically cleaned up. After interruptions or storage outages, cleanup is retried when operation resumes. Backups are intended for recovery and must be kept separate from active storage. Restoration must take account of previous erasures, restrictions and valid blocks.
Images may additionally be stored in Cloudflare and browser caches. Deleting the original file on our server does not immediately remove those copies. Cached images may remain available until the configured cache validity expires or the relevant cache is separately cleared. Deletion at Fjord also does not automatically remove messages published in Discord or copies made by recipients.
9. Rights of data subjects
Subject to the GDPR, data subjects may request access, rectification, erasure, restriction of processing, data portability and objection. Consent may be withdrawn for the future.
Privacy requests may be sent by email or post to the controller identified above. If known, the Discord user ID and affected servers help locate the data. You may make a request without signing in to the dashboard or accessing a previously used email address. We request additional information necessary to confirm identity only where there are reasonable doubts. A missing or changed Discord email address alone does not prevent you from exercising your rights. Personal data is not disclosed to unauthorised third parties.
We normally inform you of the action taken within one month of receiving the request. If its complexity or the number of requests requires an extension, we explain the reasons within that month and may extend the period by no more than two additional months. Requests are normally handled free of charge. Any refusal or fee must meet the legal requirements and will be explained. Withdrawing consent does not affect the lawfulness of earlier processing.
Where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We then stop processing the affected data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.
Complaints about Fjord or the Discord bot may be sent, together with a description of the matter and the information needed to identify it, to fjordbot.contact@gmail.com. Independently of this, suspected data-protection infringements may be reported to a competent supervisory authority, in particular in the country of residence, place of work or place of the alleged infringement. For the operator based in Schleswig-Holstein, the local authority is the ULD Schleswig-Holstein.
10. Data security
The public connection uses HTTPS. Sign-in and server permissions restrict access to the dashboard and its settings. The active versioned backup system is used to support recovery after accidental deletion, corruption, data loss or technical failures. Safeguards and recovery must be assessed against the processed data and risks. Separate services on the same physical server alone do not protect against its complete failure.
11. Changes
This privacy policy is updated when processing, functions, providers or legal requirements change. The currently published version applies.