TheaGet Started

Legal

Privacy Policy

Last updated October 13, 2026

In effect since October 14, 2026. Previous version

What We Collect

Discord account. When you sign in we receive your Discord ID, username, avatar, and the email address on your Discord account via OAuth, and we read the list of servers you manage so the dashboard knows which ones to show. Servers where Thea is not installed are not stored, OAuth tokens are encrypted at rest with AES-256-GCM, and we never see your Discord password.

Email. We ask you to confirm your email address with a mailed code before the dashboard opens. It is used for account security (confirming your address and a deletion), official notices, service status announcements, billing emails (a failed payment, a server paused for non-payment) and plan-limit warnings. It is also used for a few optional product emails: a setup reminder a few days after you add Thea if your server still has no knowledge sources or answers, and, when Thea is removed from a server you own, a note saying so and a final reminder before that server's data is deleted. You can turn the optional ones off with the unsubscribe link in each of them or in your dashboard settings; the others are part of running your account and cannot be turned off. Your address is never shared. The content of a notice is never put in an email; the email only tells you one is waiting. Our emails load the Thea logo from our email provider's servers, so opening one can let that provider see it was opened.

Server data. For servers you connect: the server name, ID, icon, and the channel configuration you set in the dashboard. If a server's admins upload a background image for welcome cards, it is stored in a publicly readable file bucket and deleted once no server's settings use it any more — after they replace or remove it, for example, or after the server's data is deleted (see How Long We Keep It for how soon). The welcome cards themselves — a greeting image with a new member's name and avatar — are made when the member joins, posted to the channel the server chose, and not stored by us.

Conversations. Messages that are routed to Thea as questions — and the answers it gives — are stored as transcripts so you can review them in the dashboard and correct wrong answers. In a support ticket, the transcript also holds every message the member and the server's staff write in the ticket channel, each with its author's Discord ID, and the member's answers to the server's ticket form. When anyone rates an answer, the rating is stored with their Discord ID. With each conversation we also keep a record of the safety check run on each question and answer — a hash of the text, the scores and the asker's Discord ID, never the text itself — and, for an answered question, a numerical fingerprint of it (an embedding, made by our AI provider) so that a near-identical question later in the same server can be pointed to the earlier answer. All of it goes when the conversation does; see How Long We Keep It.

Casual chatter in your server is not stored in our database; only messages the bot actually handles are. The bot does hold recent messages from every channel it can see in its working memory — up to 200 per channel, for about a day, and emptied whenever it restarts — whether or not the server uses logging. That is what lets server logging, below, record what a deleted or edited message said. Nothing in that memory is written to our database.

Answers. To write an answer, Thea sends an AI model the question, up to five earlier messages between the member and Thea in the same conversation or ticket (including the member's ticket-form answers), and the passages it retrieved from the server's knowledge sources. A server's staff messages and internal notes are never sent. On Pro and Business plans it also sends up to four images attached to the question, as temporary Discord links the provider fetches itself; the images are not stored with the transcript. The question and any images are checked by the OpenAI Moderation API before an answer is written, and the answer is checked the same way before it is posted.

Staff notes on tickets. A server's support staff can attach internal notes to a ticket — handover context like "already refunded, waiting on proof." These are written by that server's staff, not by you, and they can be about you. They are stored alongside that ticket's conversation and are visible only to staff of that server: they are never posted in the ticket channel, never included in the transcript sent to the member, and never used to generate an answer. They age out on the same clock as the conversation they belong to, below, and a request about what a server's staff have written has to go to that server's staff.

Ticket triage. If a server turns on ticket triage, the opening message of a new ticket (up to 2,000 characters) is sent to an AI model (OpenAI, through Vercel's AI Gateway), which labels the ticket's topic, its urgency and the member's apparent mood: calm, neutral, frustrated or angry. If the server also lets Thea hand tickets to its team, an "urgent" or "angry" label on the opening message hands the ticket straight to a person and notifies the server's support role. Later messages in the ticket that look frustrated are checked the same way, and for those a "frustrated" or "angry" label does the same. The labels are visible to that server's staff and are kept on the ticket, which goes with its conversation, and in the server's audit log, which is kept while the server is connected. Ticket triage is off unless a server turns it on.

Onboarding forms. A server can ask new members to fill in a short form when they arrive — an email address, an order number, or nothing at all beyond pressing a button to agree to the rules. What you type is posted to a channel that server's admins chose, and that message is the only copy: we do not store your answers, not even briefly, so there is nothing here for us to show you, export, or delete. What we do keep is the fact that you were asked and whether you finished — your Discord ID, a few timestamps, and a count of how many times you were reminded — which is what stops the bot asking you again and lets staff see who never got through. If the server has turned reminders on, that count and the time of the last one are what keep them to the schedule its admins set, and what stop them entirely seven days after you arrived whether you filled the form in or not. The record that you were asked, with its reminder count, is deleted 30 days after you were asked. A one-line record that you finished — your Discord ID and when — is kept while the server is connected, so you are not asked again if you leave and rejoin, and is deleted with the server. Because the answers live in someone else's server channel, they sit outside How Long We Keep It and Your Rights below in exactly the way server logs do, and a request about them has to go to that server's staff. No server may use this form to ask for passwords, login codes, payment details or identity documents — the product refuses those questions, and every form carries a line from us saying so.

Invite campaign tracking. If server staff create a tracked invite or register an existing one, we store the campaign name, the invite code and its Discord settings and use counters, the creator's Discord ID, and an optional promoter Discord ID. While tracking is active, we also record join sessions: the member's Discord ID, when they joined, qualified, or left, and whether their invite attribution was inferred, ambiguous, or unknown.

Discord does not tell bots which invite a member used. Thea compares invite counter changes around joins and labels the result instead of presenting an inference as fact. Ambiguous and unknown joins are not assigned to a promoter. Discord does not provide click data, and Thea does not collect link impressions, browsing activity, or IP addresses for invite campaigns.

AutoMod scans. If a server turns on AutoMod, messages there are scanned for abuse and scams. A scan reads everything a message carries: its text; the text of link previews, forwarded messages and polls; sticker and attachment names; a forum post's title; and its images, link-preview images included. A scan record holds the Discord IDs of the member, the message and the channel, a hash of the content, the category, scores and confidence, a short trace of which checks fired, and any action taken — not the text or the images themselves.

The text and up to three images go directly to the OpenAI Moderation API, the images as temporary Discord links that OpenAI fetches itself. Image scanning is on by default, and a server's admins can turn it off. On paid plans, if a server turns on AI classification, messages the other checks find borderline, and every message with images, are also sent to an AI model (OpenAI, through Vercel's AI Gateway) with up to ten images — screenshots included — the server's own rules, and a note of which automatic checks the message tripped. Where staff have set a topic for a channel, a message there may also be checked against that topic by the same model. Images can show other people. Everything sent is used only for the scan and is not retained by us. To spot the same link or message being pushed by several accounts at once, AutoMod also keeps short-lived markers in each server — hashes of the link or message, of who posted it, and of where — which stop counting after 15 minutes.

Message text does outlast a scan in two places. A serious finding is copied into a report for human review, text included; see Reports. And when AutoMod acts, it posts a notice to the AutoMod log channel the server chose. The notice names the member, gives the reason and lists the file names of any attachments; for a message held back for review, it also contains the message text, with secrets such as tokens removed, so staff can approve or reject it. That post is held by Discord in the server's channel in the same way as Server logs below: we cannot delete it, and a request about it has to go to that server's staff.

If a member asks the server's moderators to review an AutoMod decision, what they write (up to 500 characters) and the moderator's ruling are kept with the scan record. AutoMod can act on members as well as messages: depending on the server's settings, repeated findings can lead to a timeout, a kick, or a ban, temporary or permanent. A temporary ban keeps the member's Discord ID and the time it ends, so the bot can lift it on time.

Name screening. If a server turns on name screening, members' usernames, display names and server nicknames are checked when they join and whenever they change them, using the same automatic checks and the OpenAI Moderation API. A flagged name is posted, with the member's Discord ID, to the server's AutoMod log channel for its staff, and the finding is kept like any other scan record, with a hash of the name rather than the name itself. Name screening can flag a member for review or time them out; it never removes anyone on its own.

Moderator notes and the watchlist. A server's moderators can keep notes about a member and can put a member on a watchlist. Like staff notes on tickets, these are written by that server's staff, can be about you, and are visible only to them: they are never shown to you and never given to an AI model. While you are watched, your messages are sent to AutoMod's AI classifier, where the server has turned it on, even when nothing else about them looks wrong — it is told only that you are watched, never why — and staff get at most about one notice an hour in their AutoMod log channel while you are active. Notes and watches, including ones that were revoked or have expired, are kept while the server is connected and deleted with it, and a request about them has to go to that server's staff.

Raid protection. If a server turns on raid protection, Thea watches how quickly members join and, during a raid, can require recent joiners, and accounts younger than an age the server sets (worked out from the Discord ID), to pass a short challenge before they can take part. Depending on the server's settings, failing it restricts the member, kicks them, or bans them permanently. That is the server's decision, made with settings its staff chose, so a request to review it goes to that server's staff. We keep your Discord ID and when you passed, so you are not challenged again, until that server's staff remove it or the server is deleted, along with a summary of each raid: when it started and ended, which staff member started or ended it, and counts. Challenge answers are never stored.

Step-up checks. If a server turns on AutoMod's step-up check, a Discord account less than a week old whose first message in the server contains a link has that message removed and is timed out for ten minutes until it passes a short challenge. We keep the member's Discord ID and whether they passed with the AutoMod scan record that triggered the check, and delete them no later than that record. Passing is also recorded the same way as a raid challenge pass — your Discord ID and when you passed — so you are not asked again, and that record is kept until the server's staff remove it or the server is deleted (see Raid protection).

Scam Defense Network. For servers that use AutoMod, two network settings are on by default: contributing scam signals to the network, and using network findings. Server admins can turn either off at any time. When contribution is on, suspicious domains, links, invite codes, attachment fingerprints, and destinations found in QR codes are normalized and converted to keyed HMAC-SHA256 digests before they enter the shared record. The shared observation contains the digest, a rotating pseudonym for the contributing server, counts, review outcomes, and coarse timestamps — not the raw indicator, message text, server name, member ID, or channel ID. A server's own tenant-isolated AutoMod record remains associated with that server so its moderators can review what happened.

One server cannot make a signal actionable by itself. Only qualified, established servers count toward the minimum of three independent contributors, and moderator reviews can retract or suppress a false positive. Turning contribution off stops that server's evidence from counting toward network quorum and public statistics. The public Network Pulse shows only rounded aggregate totals and three-hour activity buckets: values are rounded down in groups, and a category or time bucket supported by fewer than three participating servers is shown as zero. It exposes no indicator or contributor lookup, and it does not collect or infer geographic location.

Contributing servers also help train a shared scam-detection model. Each AutoMod finding in a contributing server is also reduced to a short list of numbers — for example whether the account is new, whether it is new to the server, whether it has few roles or the default avatar, how long the message was and how many links it held — stored with the finding whether or not anyone reviews it. When the server's moderators rule on the finding, the ruling becomes its label, and only labelled findings are used for training. No Discord IDs and no message text go into the model. Turning contribution off stops that server's rulings from being used the next time the model is trained, and the numbers already stored for it are deleted; turning it back on does not bring them back.

Optional global blacklist. A server can separately opt in to Thea's global blacklist. When a human moderator uses Thea to issue a permanent ban, we keep the banned Discord ID, the moderator's Discord ID, the server ID, the kind of Thea moderation action, and its timestamp as a possible signal. A person is listed only after at least three different moderators across three different participating servers independently issue qualifying bans within 90 days. Automatic AutoMod or raid bans, temporary bans, a server's native or third-party bans, and actions caused by the blacklist do not count. Participating servers can ask only whether one specific member is currently listed; they cannot see the contributing servers, moderator identities, their reasons, the person's appeal, or anyone else's blacklist record. The affected person receives the public reference number (for example BL-213131) and a private, expiring Discord link showing only aggregate status and dates. Their appeal statement is visible only to Thea's trust and safety staff.

Server logs. If a server turns on server logging, its admins choose separate Discord channels for message, member, join, moderation, server, voice, and ticket activity, then choose each event Thea should post. Those events can include deleted message content and the text a message held before it was edited, bulk deletes and Discord invite posts; member role, avatar, username and nickname changes; joins and leaves; bans, unbans, and timeouts; channel, role, emoji, and server changes; and voice joins, moves, and leaves.

Thea sends each enabled event directly to the chosen channel. We do not store those server-log posts — there is no copy in our database and we cannot read one back — but the copy in that server's channel is real, and it sits outside everything under How Long We Keep It and Your Rights below. It lives in someone else's server under Discord's retention, so it outlasts deleting your data here, removing the bot, and deleting your account. Only that server's staff can remove it, and an erasure request for it has to go to them. Server owners who enable this are choosing to keep that record and are responsible for it.

A server can also point this at its support tickets, and that one works differently on purpose. The ticket log records the lifecycle — a ticket opened, claimed, escalated, closed, reopened or deleted, with the ticket number and the Discord IDs of the people involved. Almost nothing written inside a ticket is copied into it: not your messages, not your answers to the server's ticket form, not the transcript, and not the staff's private notes. Those stay in the ticket channel and on that server's dashboard, where only people who could already read the ticket can see them. Your messages and form answers are also given to the AI model as context when Thea answers in that ticket (see Answers); staff notes never are.

There is one exception, and it is the survey we send you after a ticket closes. If the server has a ticket log channel, your rating and the comment you write with it are posted there, in your own words, for that server's staff. The comment box says the team will see what you write, and this is where they see it — a channel chosen by that server's admins, which may be readable by more of their staff than could read your ticket. We also store your rating and comment with the ticket, where that server's staff can see them on the dashboard, and they are deleted with the ticket's conversation. The survey is optional and the comment is optional; a rating with no comment posts the rating alone.

Reports. When content is reported to us — by a person or by an automated flag — we keep a snapshot of the reported content so a human can review it. The snapshot is deleted when the report is resolved, unless it must be kept as evidence for an enforcement decision (a legal hold). AutoMod files these reports itself: every finding of high or critical severity, and every time it removes a member, opens one whose snapshot is the message's text and attachment names, with secrets such as tokens removed, up to 8,000 characters, together with the member's Discord ID. Reports are reviewed by Thea's trust and safety staff, and an open report has no time limit: its snapshot stays until a reviewer resolves it.

Knowledge sources. The docs, sites, files, and articles you connect are fetched and indexed so the bot can answer from them. Credentials for integrations (for example a Notion token) are encrypted at rest with AES-256-GCM.

Knowledge gaps. On paid plans, Thea looks once a week at the questions it declined to answer for lack of confidence and the questions behind answers that were rated down, and groups similar ones so a server's admins can see what their docs are missing. Each group quotes a representative question and up to five more, word for word. If an admin turns a group into a draft help-center article, an AI model writes an outline from those questions and the draft quotes them; from then on it is the server's own help-center content.

Billing. Payments are processed by Stripe. We store your subscription status and plan — never card numbers.

Feedback. If you send us feedback from the dashboard, we keep what you wrote, the topic and rating you chose, and the page you were on, linked to your account, so our team can read and act on it.

Security logs. Actions taken in the dashboard, and moderation actions taken through Thea in a server, are written to that server's audit log with who took them and what changed. That includes the reason a moderator types when they warn, time out, kick or ban someone with Thea's commands — the member is also sent that reason in a direct message, and it is posted to the server's AutoMod log channel — and the labels ticket triage gives a ticket. That log is how a compromised account gets investigated, and how a server's staff see what was done in their name. Actions Thea's own staff take on reports, appeals and enforcement are recorded in a separate staff log, which names the staff member and identifies what they acted on.

Diagnostics. Server logs and error reports (via Sentry) that may include message IDs and error context, used only to keep the service working. When a Thea page — a public help center included — tries to load something our security policy does not expect, the visitor's browser may send Sentry a short report with the page address and what was flagged, and Sentry receives the browser's IP address and user agent with it. We use those reports only to find security bugs.

Notices to our team. When you sign up, or a server adds or removes Thea, we post a short notice in a private, staff-only channel of our own Discord server: for a signup, your Discord ID, username, display name and avatar; for a server, its name, ID, icon and member count.

How We Use It

To operate the service: answering questions, syncing sources, running the moderation and protection features a server enables, measuring invite campaign performance, showing you analytics about your own community, and billing. To keep the free plan from being farmed, when someone first runs /setup on a free server we check how old their Discord account is (worked out from the Discord ID) and how many free servers they have already set up: an account under 30 days old, or one that already has two free servers, cannot activate another. We do not sell personal data, and we do not use your content to train foundation models. The one model trained on what happens in servers is the Scam Defense Network's scam model, described above, and it learns from numbers, not content.

Who Processes It

We use a small set of subprocessors:

  • LLM providers (OpenAI, Anthropic, Google, via Vercel's AI Gateway) — receive what is needed to write an answer (see Answers), the messages, images and server rules AutoMod's AI classifier judges, ticket messages for triage, the questions an admin turns into a draft article, and the text we turn into embeddings for search and duplicate questions;
  • OpenAI Moderation API — called directly rather than through the AI Gateway; receives the text and images we safety-score: messages AutoMod scans, screened names, questions and answers, and text submitted to us or through the dashboard, such as synced knowledge sources, reports and appeals;
  • Fly.io — runs the Discord bot and our background workers, which process the messages and events Thea receives;
  • Vercel — hosts the website, the dashboard, and public help centers, so it handles every page request, including the visitor's IP address;
  • Supabase — hosts the Postgres database, authentication, and uploaded files;
  • Stripe — payment processing;
  • Resend — delivers the emails described above;
  • Upstash — rate limiting, keyed on Discord, server and account IDs and, on public pages, on the visitor's IP address (see Cookies);
  • Sentry — error reporting, and the browser security reports described under Diagnostics.

Our servers and database run in Singapore, and several of these providers also process data in the United States. Where the GDPR or UK GDPR applies, those transfers are covered by standard contractual clauses or, for US providers that participate in it, the Data Privacy Framework. Each tenant's data is isolated with Postgres row-level security; one server's content is never retrievable from another server's context.

How Long We Keep It

  • Conversation transcripts age out automatically: 30 days on Free, 180 days on Pro, 365 days on Business, counted from the conversation's last activity. A conversation whose support ticket is still open, or that is held as evidence under a legal hold, is kept until the ticket closes or the hold is released. Everything stored with a conversation goes with it: internal staff notes on its ticket, answer ratings, the rating and comment from the survey sent after a ticket closes, triage labels, question fingerprints, and the safety-check records for its questions and answers (unless one of those is itself held as evidence).
  • Knowledge gaps are on the same plan clock as transcripts, counted from the last week the question came up. A draft article an admin made from one is the server's own help-center content, kept until its staff delete it or the server is deleted.
  • Ticket transcripts sent to the member: when a support ticket closes, the person who opened it is sent a copy of that ticket's own conversation as a file in a Discord direct message (a server can turn this off). That copy is theirs, held by Discord in their direct messages, and is outside the retention windows above — we cannot retrieve it or delete it. It contains only what was said in that ticket; internal staff-only notes are never included.
  • Ticket transcripts downloaded by a server's staff: the dashboard lets staff who can already read a server's tickets download one as a file, and tells them to do it before the conversation window above closes if they need the record for a dispute or a chargeback. Once downloaded, that file is on their computer and outside our clock in the same way a server log channel is: we cannot retrieve it, delete it, or say how long it is kept. We record every download in the server's audit log, so its staff can see which transcripts left, but the copies themselves belong to them and an erasure request for one has to go to them.
  • AutoMod scan records are kept for 90 days and then deleted automatically. A record still waiting on a moderator's review, or one a member has asked to have reviewed, is kept until that is settled — deleting it would erase the only thing a decision could be written against. A member's review request, the moderator's ruling, a step-up check, and the numbers the shared scam model learns from all go with the record; the record that a member passed a step-up check is kept like a raid challenge pass, below. A finding that became a report follows Reports, and what AutoMod posted to the server's log channel is outside our clocks, like a server log.
  • Temporary bans keep the member's Discord ID, when the ban ends and when it was lifted until the server is deleted.
  • AutoMod's campaign markers stop counting 15 minutes after they are made and are deleted within about an hour after that.
  • Moderator notes and the watchlist, raid challenge passes (step-up check passes included) and raid summaries, and the record that a member finished an onboarding form are kept while the server is connected and deleted with it. A server's staff can also remove a raid challenge pass themselves.
  • Scam Defense Network records are deliberately short-lived. Unreviewed server-to-network references and pseudonymous observations expire 14 days after their last sighting; a human review can extend the relevant evidence to 90 days so a correction is not lost. Contained or dismissed incidents and dormant campaign metadata are deleted after 180 days. Inactive learned-model versions are also deleted after 180 days. The published Network Pulse snapshot is generated from eligible live records rather than persisted as another copy of the underlying events. When a server turns contribution off, the numbers it stored for the shared scam model are deleted.
  • Global blacklist signals stop counting after 90 days and are then deleted. A listing is removed sooner if enough signals are revoked or a source server opts out. We retain the minimal listing reference, generation, dates, aggregate outcome, and staff decision so an overturned generation is not silently recreated from the same old signals. Per-server action receipts remain with that server and follow its removal clock. Appeal text is deleted as soon as staff decide it unless it is under legal hold; the appeal outcome and review provenance remain.
  • Security and audit logs are not on a clock of their own. A server's audit log — every configuration change, export and enforcement recorded against it, moderators' typed reasons and ticket triage labels included — is kept for as long as that server is connected, and is deleted with the server by the 14-day removal clock below. Deleting your account does not delete it, because the record belongs to the server rather than to whoever installed the bot; what it does delete is the link back to your account. Our own staff log is kept indefinitely, so decisions about people stay reviewable.
  • Moderation records downloaded by a server's staff: the dashboard lets staff who can already see a server's AutoMod queue and audit log download those records as a spreadsheet. For AutoMod findings and the rulings on them, it tells them to do it before the 90-day window above closes if they need the record for a Discord Trust & Safety report; the audit log has no such deadline, and the button there says so rather than inventing one. The file contains categories, severities, content hashes, the Discord IDs of the members involved and of who moderated them, and the notes and reasons moderators typed. It contains no message text — AutoMod's records hold none — and never what a member wrote when asking for a review. Once downloaded it is on their computer and outside our clock in the same way a server log channel is: we cannot retrieve it, delete it, or say how long it is kept. We record every download in the server's audit log, so its staff can see which records left, but the copies themselves belong to them and an erasure request for one has to go to them.
  • Onboarding form answers are not kept at all: they are posted to a channel the server chose and never stored here, so they are outside every clock above in the same way a server log channel is. The record that a member was asked is deleted 30 days after they were asked; the record that they finished is kept while the server is connected.
  • Invite campaign records are kept while the server is connected, including closed or revoked links and their join sessions so historical attribution remains available. They are deleted with the server under the 14-day removal clock below.
  • Knowledge sources are kept until you delete them or remove the bot. Deleting an uploaded file's source deletes the stored file with it. When a removed server's data is deleted, its uploaded files are removed from storage afterwards by a regular cleanup sweep, which works through stored files in batches and can take several days to reach them.
  • Uploaded welcome backgrounds are deleted once no server's settings use them any more. Replacing or removing one in the dashboard's welcome settings deletes it straight away. Any other way it stops being used — turning the welcome card off with /config welcome off in Discord, replacing it by importing or copying a configuration, an upload that was never saved, or the server's data being deleted — leaves it to a regular cleanup sweep, which skips images uploaded in the last day so one still being set up is not lost, and works through stored images in batches, so it can take several days to reach one.
  • Product feedback you send from the dashboard is kept until you delete your account.
  • Removed servers: kicking the bot starts a 14-day clock, after which the server and everything belonging to it is permanently deleted — uploaded files and images follow by the cleanup sweeps described above. Two things make it wait: a paid subscription for that server that is still active (kicking the bot does not cancel billing, so cancel it from the server's Billing tab), and any report from that server held as evidence under a legal hold, whether it is about the server or about one member's message in it. Deletion happens once neither applies. Re-adding the bot within the window keeps your setup intact.
  • Deleted accounts: confirming an account deletion (see Your Rights) starts a 7-day clock, after which the account is permanently erased. A deletion cannot be requested while the account has an active paid subscription or an active restriction from us, such as a ban, and it waits if a paid subscription is started during the window. A Thea staff account that has acted on reports or enforcement is kept, so those actions stay attributable.
  • Dead-letter job records (sync failures kept for debugging) are pruned automatically.
  • Server log channels are outside all of the above. What server logging posts into a server's own channel is held by Discord for that server, not by us; we cannot retrieve it, delete it, or put a clock on it. See Server logs. The same is true of what AutoMod and Thea's moderation commands post into a server's AutoMod log channel.
  • Notices to our team about signups and servers are posts in our own staff Discord channel, held by Discord. They are not on a clock, and deleting an account or a server does not remove them.
  • Enforcement records: if we act against a user, server, or account under the Acceptable Use Policy — a warning, a restriction, a suspension or a ban — we keep a record of it: the Discord ID, the server's ID and name where there is one, what we decided and why, our staff's summary of the evidence, who decided and when, and whether it was contested, lifted or voided. These records are never deleted: not when the action ends or is lifted, not when the rest of the data is deleted, and not when the account is deleted. Without this, a ban could be undone by deletion, and a decision we got wrong could not be shown to have been corrected.

Cookies

The dashboard uses session cookies for authentication. A private blacklist link is exchanged for a separate one-day, HttpOnly cookie restricted to the /blacklist path so the affected person can view and appeal that listing without creating or signing into an account. There are no advertising or cross-site tracking cookies, which is why there is no cookie banner. Public help centers set no cookies at all, and the helpful-vote on an article is stored without any identifier; your own browser keeps a note of your vote so you can change it. To stop abuse, when you search a help center, vote on an article, or open or appeal a private blacklist link, your IP address is used briefly as a rate-limit key at Upstash — for a few minutes on help centers and up to about two hours on blacklist links — and is never stored with what you searched, voted on, or wrote.

Your Rights

You can delete knowledge sources from the dashboard at any time, and removing the bot from a server starts the deletion clock for everything that server holds (see Removed servers). You can also delete your account from the dashboard settings: we confirm the request with a code sent to your email, then permanently erase the account after a 7-day window — long enough to catch a deletion you did not authorise, and cancellable until it runs out. An active paid subscription has to be cancelled first, and an account with an active restriction from us cannot be deleted while it stands, because the notice thread you would appeal through goes with the account.

Some copies are out of reach of these controls, because they are already somewhere else:

  • Anything server logging has already posted into a server's own log channel: we never held a copy of it, so there is none for us to erase — see Server logs. Ask that server's staff.
  • Anything AutoMod or Thea's moderation commands have posted into a server's AutoMod log channel — notices naming members, attachment names, the text of messages held back for review, flagged names, watchlist notices, and moderators' reasons. Discord holds these for that server, on the same footing as server logs, so ask that server's staff.
  • Anything you typed into a server's onboarding form, for the same reason and with the same answer: it went straight to a channel in their server and we never stored it.
  • A ticket transcript already delivered to the member who opened it: it is their own conversation, sent to them, and it lives in their Discord direct messages where only they can delete it.
  • A ticket transcript a server's staff have downloaded from the dashboard: deleting the conversation here does not reach a file already saved on someone's computer, so that request has to go to that server's staff too.
  • A moderation-record export a server's staff have downloaded: the records here go on the clocks described above — AutoMod findings after 90 days, audit entries with the server itself — but a spreadsheet already saved on a moderator's computer is theirs, and that request goes to them.

For data export, deleting data sooner than the clocks above, or any other request, email support@thea.gg and we will respond within 30 days. If you are in the EU/EEA or UK, these rights include access, rectification, erasure, and portability under the GDPR.

Some enforcement decisions — for example suspending a user or server for abuse — may be made by automated systems. You can always contest one by emailing support@thea.gg; appeals are reviewed by a person, as described in the Acceptable Use Policy. For a global-blacklist listing, use the private link in Thea's Discord message; it accepts one appeal for that listing generation without requiring sign-in. What a server's own AutoMod, raid protection or moderators do to you in that server — removing a message, timing you out, kicking or banning you — is that server's decision, made with settings its staff chose; ask its staff to review it.

Children

The service is intended for users who meet Discord's minimum age requirement (13, or higher where local law requires).

Changes

If this policy changes materially we will give notice on the dashboard or by email before the change takes effect.