Privacy Policy

1 Whose data

We hold data about two groups of people, and treat them differently.

• Members of a server the bot is in. A member may never sign in to Colossus; the bot still records their activity in that server.
• Operators, who sign in to the dashboard to read those records.

2 What is recorded about members

In each server where the bot runs, and only for the signals that server has turned on, we record:

• Messages: when a message was sent, in which channel and category, its identifier, and values derived from the text (characters, words, links, GIFs, custom emoji, attachments and stickers), together with the users and roles it mentioned.
• Reactions: who reacted, whose message it was, and which emoji.
• Voice: which channel, and seconds spent connected, streaming, on video, muted or deafened.
• Activities: which application Discord reports the member using, and for how long.
• Membership: joins and leaves, the source of a join, the roles a member holds, and whether they boost the server.
• Scheduled events and threads: who created one, and who attended.
• Presence: counts only, never attributed to a person. How many members were online, idle, busy or offline at a given moment, with no identities attached.
• Sentiment: only in a server that turns it on, and only in the channels it picks. Hourly counts of messages by the labels a language model gave them (sentiment, topic, kind of message, tone and language) and by which of the server's tracked keywords they contain, split by channel, by roles the server picks and by how long each author has been a member. Counts of distinct authors use a random number that stands for each member and is never derived from their identifier. For a few messages per channel and day, kept as examples, we also store the message's identifier, its author and its labels.

3 Message text is not stored

We read message text in memory to produce the values above, then discard it. It is never written to storage. The one dashboard that shows it is Sentiment's Evidence, described below, which reads it from Discord each time.

In a server that turns on Sentiment, the text of messages in the channels it picks is also sent to Anthropic to be labelled, as described under Who else sees it. We send the text alone, with links, mentions and custom emoji removed, and nothing that identifies its author. Messages from bots, from members who opted out or hold a role the server does not record, and from channels the server does not record are not sent. A server can also have up to 30 days of past messages in those channels labelled.

Sentiment's Evidence shows a few of those messages, only to the people the server allows to open them, and lists none where there are fewer than 5 authors or 20 analysed messages. The text is read from Discord when a message is opened, and is not kept. A message deleted on Discord, or written by a member who has since opted out, can no longer be opened.

Polls are no longer recorded. Poll questions and answer options recorded before 24 September 2026 remain only in the raw event record, which deletes them within 3 days.

We also never record direct messages, anything from a server the bot is not in, the contents of attachments, or anything about a member from outside Discord.

4 What is recorded about operators

• Signing in uses Discord OAuth with the identify and guilds scopes. We receive your Discord identifier, username and avatar, and the list of servers you can manage, so we can show which of them Colossus could run in. We never see your Discord password.
• One cookie, colossus_session. It lasts seven days, and it is the only cookie this site sets.
• An audit log of administrative actions: who changed what, and when.
• Saved views and filters, which may name the members you filtered on.
• Your own preferences (language, sidebar state, workspace filter, chart visibility and chart settings), which stay in your browser and are never sent to us.

5 What we don't do

• We show no advertising and use no advertising identifiers.
• We use no third-party analytics, tag managers or session recording, and the site loads no third-party scripts.
• We do not sell your data, and we do not share it with anyone for their own purposes.
• We make no automated decisions about anyone.

6 Why it is processed

We process this data for four purposes, and no others:

• To produce the statistics the server asked for.
• To label the mood and subject of messages for a server that turns on Sentiment.
• To keep you signed in and determine what you may see.
• To operate the service and investigate abuse of it.

7 Who else sees it

• Discord, the source of all of it. What Discord does with the data is governed by Discord's privacy policy, not this one.
• Cloudflare, which serves this dashboard and so sees the requests that reach it.
• Polar Software Inc., the merchant of record for paid plans. Polar runs the checkout and holds the payment details (card numbers never reach us), and it knows which server subscribed to what. What Polar does with that data is governed by Polar's privacy policy.
• Anthropic, PBC, which labels message text for servers that use Sentiment and writes the opening paragraph of their weekly briefing from figures that name no member. Anthropic acts as our processor: under its terms, it does not train its models on what we send and deletes it within 30 days, though it may keep anything its automated safety systems flag for up to two years, and anything the law requires it to keep.
• Visitors to the Colossus website, which may show the names and icons of servers using the shared Colossus bot unless a server owner turns this off in the server's settings.
• Everything else, the databases, the bot and the API, runs on infrastructure we operate. There are no other processors.

8 How long it is kept

• Each server can set a retention window of at least 90 days, or keep its statistics for as long as it uses Colossus. Statistics older than the window are permanently deleted; without a window, nothing is deleted for age.
• The raw event record that statistics are computed from is deleted a day at a time once it is 2 days old, so none of it is kept longer than 3 days, or briefly longer while it is still being processed, whatever the window. The copies of reactions and message authorship used to credit late reactions are deleted after 30 days.
• The audit log of administrative actions, the team's and each server's, is kept for 365 days, then deleted.
• Some records are not bound by the window and are kept for as long as the server uses Colossus: the names and avatars of members, channels and roles; the roles each member holds; the dates of each member's first and most recent message and voice session, with running totals; and the server's annotations and saved views.
• Sentiment's counts follow the retention window like other statistics. The examples kept for Evidence are deleted once they are 90 days old, whatever the window. The random number that stands for a member in those counts is kept for as long as the server uses Colossus, or until the member opts out.
• A server's plan limits how far back its dashboard shows and how far back history can be imported. It does not change how long data is kept.
• Dashboard sessions expire after seven days.
• Deleting a server in Colossus deletes all of its data within minutes. If the bot is removed from the Discord server instead, the data is kept for 90 days in case it returns, then deleted. Moving a server to a different Discord server deletes what was recorded for the previous one within an hour.
• We keep a nightly backup for each of the last seven days and for each of the last five Sundays, so none is older than five weeks. Deleted data, including data erased by /opt-out, can remain in a backup until that backup expires. If we restore from a backup, we erase again everyone who had opted out before Colossus records anything.

9 Opting out

A member can run /opt-out in the server. Recording stops from that moment, and within 48 hours we erase everything already recorded about them in that server, most of it at once.

• The erasure covers every record in which a member can be named. The raw event record is the one exception: their events in it are skipped rather than counted, and leave it as everyone's do, within the time given under How long it is kept.
• Sentiment stops sending their messages to Anthropic. Their examples kept for Evidence are deleted at once, and so is the random number that stood for them, so the Sentiment counts that hold it no longer lead back to them.
• So that new events stay suppressed once the identifier is gone, we keep a one-way hash of the member's Discord identifier and nothing else. It cannot be reversed, only compared against a new event.
• /opt-in resumes recording. Data already erased is not restored.
• Opt-out applies to one server. Run it in each server concerned.

10 Isolation between servers

Each server's data is held in its own tenant, isolated at the database level. A query made for one server cannot read another server's data.

11 Your rights

Two rights are built into the product and need no help from us:

• Erasure: running /opt-out in the server stops recording at once and erases your data within 48 hours, most of it immediately.
• Deleting a whole data set: a server owner who deletes the server in Colossus deletes all of it, subject to the backups described above.
• For anything else, such as a copy of the data we hold about you or a correction, write to us at [email protected], or to the owner of the server the bot is in.

12 Security

We serve all traffic over HTTPS, protect sessions against tampering, and limit access to the systems that hold your data to the people who need it. No system is entirely secure, and we make no promise to the contrary.

13 Age

Colossus applies Discord's minimum age, because a Discord account is the only way in. We do not knowingly hold data about anyone below that age, and we cannot verify age independently of Discord.

14 Changes to this policy

We update this policy as the service changes. The date at the top of this page shows when the current version was published.

15 Contact

Questions about your data go to us at [email protected], or to the owner of the server the bot is in. If you are not sure which server, ask its owner.