Data and privacy

Pup does not automatically delete, anonymize or hide stored records because of age. Records and captured content remain until an authorized person explicitly deletes or replaces them. Some actions clear content while preserving audit metadata; their task guides explain the result. Data already erased cannot be recovered by removing an expiry rule. Moderation reasons, staff notes, warnings and command receipts have no automatic retention deadline. Warning expiry is optional and off by default; when set, it stops a warning counting toward sanctions without deleting its history. Command receipts contain only the command name, actor, server, channel, timestamp, execution outcome, and correlation ID. They never contain command arguments, moderator reasons, message content, tokens, autocomplete text, or private response payloads. Routine authorization denials remain privacy-safe operational telemetry and never become public command-audit history. Staff notes have a restricted administration history. The member concerned and standard case exports do not receive note content by default; an authorized restricted export is separately audited. Notes do not become inaccessible merely because they are old. Authorization decision history retains denied checks and attempted actions. Successful checks used only to open dashboard pages or show available controls are not retained. The checks still run, and case and evidence-access audits remain separate. The Assistant can answer questions from retained event logs and moderation cases after checking the asking member’s current server permissions. Logging view permits event-log searches; moderation view permits ordinary case outcomes and reasons; moderation administration is required for restricted staff-note text. Answers are posted in the conversation channel and are visible to members who can read that channel. Pup does not search support tickets, anonymous submissions or security incidents through this tool.

​

Member and message reports

With explicit consent, /report shares the reporter’s identity and reason with authorized server moderators. The reason is stored separately from list and history metadata until explicitly deleted. Reviewers read it through a separately authorized report-detail request. Message links do not copy Discord message content or attachments. Reports are not posted publicly and do not notify the reported member. Report intake retains a category, member or channel/message source reference, explicit consent, attachment count, reporter-visibility choice, opaque digest of the submitted text, and immutable lifecycle receipts. The Reports queue and ordinary member history do not expose the submitted text, attachment bytes, or private staff decisions. An attachment receipt is not a download or an archive. Only authorized case-evidence work may separately capture message or attachment content, subject to its own purpose, storage, scan and access controls.

​

Moderation case exports

Case export is limited to one member, a reviewed date range, named record families, and a recorded purpose. The export ledger stores the actor, scope digest, correlation ID, format, redaction choice, count, expiry and lifecycle; it never stores another copy of the exported payload. JSON and CSV downloads are regenerated from the authoritative case ledger, expire after fifteen minutes, and may be revoked by an authorized moderator. Standard exports omit restricted records. Restricted exports require the additional moderation administration permission. Attachment selection produces metadata-only markers: it never exposes a private-object URL or copies attachment bytes.

​

Case evidence access

Case evidence is separate from a case export. In a case, a moderator selects a specific purpose and confirms that they reviewed the request and have the required consent or other lawful basis. Only then does Pup load a small metadata inventory: availability, stored size and type, sensitivity and legal-hold state. It never lists message text, attachment names, Discord URLs, checksums, storage locations or provider identifiers. Standard evidence requires current moderation-view access. Restricted evidence is omitted unless the same current operator also has moderation-administration access. Every private download is separately checked against the current server, case, purpose, policy revision and evidence sensitivity, then audited. Changing a revision requires a refresh; deleted, missing, inaccessible, oversized and partial evidence remains that state and Pup never manufactures a replacement. Recording a share creates only a redacted, auditable authorization decision, not an object URL or another copy of the evidence. An authorized administrator can revoke that exact recorded share. A legal hold prevents deletion, and provider or checksum failure remains a privacy-safe failure state rather than a download. Case-evidence files, encrypted attachments and ticket transcripts have no automatic deletion deadline. Authorized deletion still checks legal holds and current permissions, and provider failures remain failures until confirmed. Authorization decision history has no age limit or automatic row-count pruning. Configured message-edit and single-message-deletion logging stores source text and author information where the route is enabled. Stored text is capped at 1,800 characters per value. Captured source records and event content have no automatic expiry; successful log delivery does not clear them. Messages in log destinations are excluded to prevent feedback loops. A message that predates capture or never reaches Pup can still have unavailable text or author details. Bulk-deletion records contain counts and opaque identifiers, not message bodies. Pup does not automatically delete delivered Discord log messages. Configured member logs show the name recorded at the event and the before and after values Discord supplied for changed usernames, display names, server nicknames, avatar references, and roles. Avatar links point to Discord’s CDN; an older avatar may no longer be available there. These stored details have no automatic expiry. Pup cannot reconstruct a prior value that Discord did not supply. Each server separately configures attachment handling for every logging event family: no retention, metadata-only, encrypted archive, or thumbnail. The policy revision is snapshotted with each accepted attachment; changing a policy does not change an earlier capture decision. No-retention produces no attachment provenance record. Other modes retain only the minimum provenance (opaque Discord attachment ID, size, media type when provided, policy revision, and health outcome), never an attachment name or Discord URL. An archive or thumbnail is accepted only after the configured consent, type, size, destination, access, legal-hold, and malware-scan checks pass. Bytes are encrypted in the private-object store until explicitly deleted. If a scan or storage prerequisite is unavailable, Pup fails closed and records a privacy-safe rejection/health outcome rather than fetching the attachment. The product’s only fixed ceiling is the 25 MiB private-object safety limit; types, consent, legal-hold use, and archive choice remain server policy. For archive modes, Pup reads a temporary Discord attachment URL only in the bot process after the policy gates pass. It sends the bytes to the configured malware scanner, encrypts clean bytes into staging, and waits for the private-object worker to verify the provider copy before marking the provenance archived. Scanner or storage failure never falls back to retaining a copy or URL. Security incidents retain compact policy and recovery diagnostics rather than the triggering message, private pattern, attachment name or surrounding chat. Operational telemetry excludes moderation content and raw provider errors. Optional analytics are disabled by default and require explicit configuration.

​

Join-admission account signals

When a server enables join admission, Pup uses only Discord-visible account creation time, bot status, and a server’s bounded recent-join window. Account creation time is an account age, not a person’s age. Pup does not collect or accept device data, IP addresses, proxies, fingerprints, profile-text scraping, or claims that accounts belong to the same person. A separately authorized human review may record a narrow reviewed profile signal, but the automated join guard does not inspect profile text. These are uncertain review signals and can produce false positives. They only route a member to the configured verification boundary; they never make an identity claim or automatically kick or ban. The server configures a one-to- sixty-minute account-signal window for decisions; stored review records do not expire. Authorized server configurators can restore the exact quarantine role to correct a mistaken gate, and the member’s private notice tells them to contact a moderator for that correction.

​

Dashboard audit receipts

The authorised moderation activity view searches dashboard configuration, permission and role changes, retries, exports, migration receipts, and other administrative outcomes alongside operational records. Every receipt shows its actor when that actor is a usable Discord identity, server, surface, correlation, and safe result code. Dashboard-originated receipts also show opaque before/after fingerprints. Those fingerprints are SHA-256 digests of the receipt’s stable resource reference and configuration/policy revisions; they make a state transition comparable without storing a settings snapshot. They never contain a secret, command option, free-text reason, sensitive content, or raw Discord/provider payload. The activity view and its bounded, reviewed export use the same access checks.

​

Moderation audit correlation

Pup records the following Discord audit families with fixed summaries. It uses the audit-entry identifier only to deduplicate and correlate the observation; it never copies Discord’s audit reason or a changed timeout value into the live log or moderation-correlation record. An audit entry performed by Pup is shown as a Pup action rather than misclassified as an external action. AutoMod keeps its own native summary even when Discord attributes it to Pup.

​

Voice participation logs

When the voice log route is enabled, Pup can record a member joining, leaving, or moving between voice channels. Voice participation uses its own destination; it is separate from moderation logging, and each of those three event types can be disabled independently. Entries contain only a generic summary, member and channel references, and the event time. They do not include channel names, voice content, mute/deafen state, video/stream state, profile details, or Discord audit reasons. Replayed gateway events are deduplicated for a short window; a later repeat remains a new event. Delivery retries are durable, and a delivered entry has no automatic deletion deadline. Unrelated member updates, including profile and nickname changes, are rejected from this correlation path. Audit entries without a usable subject are still safe to log with their fixed summary, but are not turned into a member-action record. The public roadmap exposes approved capability descriptions and delivery progress. It does not expose private issue descriptions, people, provider payloads or operational evidence. Self-hosted deployments can use the bundled catalog without a connection to a planning service.

​

Anonymous submissions and support access

Anonymous previews can be confirmed only during the configured interval (fifteen minutes by default). That deadline does not erase stored drafts. Confirmed posts, their text and private author association remain until the author, a designated reviewer or the server owner removes them. Older stored submissions no longer expire automatically. Deleted records are not periodically purged. Public posts omit account attribution; designated reviewers and the verified server owner can see authors. See anonymous submissions. Suggestions no longer disappear after a retention period. Tickets are not automatically archived or deleted for inactivity. Polls still close at their chosen time; closing does not delete ballots or history. The verified server owner can also read and manage private tickets and modmail, including internal notes and retained ticket transcripts, without membership in the configured support team. Other staff need the relevant task permission and the conversation’s configured team role. Configuration permission or installation-operator status alone does not grant this dashboard access. Private Discord ticket channels also remain subject to Discord’s owner and administrator permissions.

​

Assistant memory

The optional Assistant sends the triggering message, a short window from its channel or thread, relevant replied-to images, and retrieved server memories to the configured Azure OpenAI deployment. Web search is optional; when it is on, Pup also fetches public pages and PDFs it decides to read, and those pages see an ordinary request from Pup’s server. Pup does not send raw history from another private channel into a public reply. When History search is on, messages Pup reads from the current conversation or public channels are also sent to Azure OpenAI. Reminders store the member and channel identifiers, the reminder text, the due time and the originating message identifier. Delivered and cancelled reminder records currently have no automatic expiry. Pup also stores collected source messages in its own database: raw message text, author and channel names, server/member/channel/message identifiers, reply references and image attachment URLs. It collects a message when learning is enabled for that channel or the message requests an allowed Assistant reply. Turning learning off therefore does not stop storage and Azure OpenAI processing needed for requested replies. These local source records currently have no automatic expiry or periodic purge. Finishing a reply or memory-processing request does not clear their content. Deleting a Discord message marks the local record deleted but leaves its text, names, identifiers and attachment URLs stored. A short reply-context window is not a storage-retention limit. Discord message deletion does not currently guarantee removal of a source already sent to Supermemory. When learning is enabled, Pup sends eligible new messages to Supermemory with the server, channel, member and message identifiers needed for attribution. Public channels learn by default; private and restricted channels do not. A server administrator can override either choice per channel. Learning settings control future collection. Supermemory may retain submitted source content even when its model extracts no durable memory. Assistant memory is shared across one server. This means a memory learned in an explicitly enabled private channel may later inform a reply elsewhere in that server. Administrators can inspect memories and exclude one from active recall. That operation does not promise erasure of all provider processing history.

​

Functional deadlines and external copies

Sign-in sessions, access tokens, preview confirmations and export download authorizations still expire. Rate limits, cooldowns, delivery retries, worker leases, reminders, temporary moderation reversals and poll closing still run. These timers do not set a retention period on the underlying records. Pup cannot extend Discord attachment or avatar URLs, recover data already erased, or control every copy held by Discord, Azure OpenAI, Supermemory or other providers. Self-hosting operators also control backups and infrastructure logs. Provider retention and deletion behavior remains separate from Pup’s stored records.