LOGISBOT Privacy Policy
Privacy Policy

How Logisbot
handles your data

Logisbot collects only what it needs to operate role management, XP tracking, community governance, and fraud prevention. This document explains what that data is, how it is stored, and the controls you have over it.

GDPR Art. 17 Discord Dev Policy §2.c CCPA HMAC-SHA256 Vault
§1

Information We Collect

Logisbot operates across Discord servers, Telegram integrations, and a web dashboard. Data collection is limited to what is necessary for the features you use.

1.1 — Collected automatically

  • Discord identifiers — your Discord User ID (snowflake), the Guild ID of each server where you interact with the bot, and the Channel IDs where commands are invoked.
  • Activity telemetry — XP transactions, community vote submissions, quiz attempts, and timestamps for voice-stage attendance and chat milestones.
  • Technical logs — ephemeral error traces, command interaction status, and interaction timestamps. Not linked to your identity beyond the session.

1.2 — Provided voluntarily by you

  • Wallet addresses — EVM, Solana, Bitcoin, Ronin, ImmutableX, Aptos, and Sui addresses submitted via /profile edit or the web dashboard.
  • Social media handles — X/Twitter, Telegram, Instagram, TikTok, Facebook, and Steam usernames entered into your community profile.
  • OAuth identity links — when you connect a third-party platform via the web portal, we receive your public username, platform ID, and avatar URL. Passwords are never requested or stored.
§2

How We Use Your Information

We use collected data exclusively for the following purposes:

  • Server progression — calculating XP, assigning earned Discord roles, maintaining tier hierarchies, and operating community giveaways and votes.
  • Identity verification and sybil prevention — ensuring that rewards, roles, and voting weight are distributed to unique participants and preventing multi-account abuse, credential spoofing, and automated farming.
  • Auditing and support — troubleshooting technical issues and providing server administrators with governance audit trails.

We never sell, rent, monetize, or trade your personal data to third parties, advertisers, or data brokers.

§3

Data Retention & Cryptographic Vault

Cleartext data
ACTIVE PARTICIPATION
Retained while you are active in servers using Logisbot, or until you request deletion.
Cryptographic hashes
INDEFINITE
One-way HMAC-SHA256 hashes retained under GDPR Art. 17(3)(e) fraud-prevention legitimate interest.

3.1 — Cleartext personal data

Wallet addresses and social media handles stored in profile fields are retained only while you remain an active participant in servers using Logisbot, or until you invoke your right to erasure (see §4).

3.2 — Anti-sybil cryptographic vault

To protect communities against multi-account farming and identity reassignment attacks, Logisbot maintains an append-only cryptographic security ledger called sybil_credential_vault.

Credential hash function
HMAC-SHA256( key = SecretPepper, msg = fieldKey + ":" + normalizedCredential ) → 64-char hex digest (irreversible)
  • The pepper is a confidential server-side secret never stored in code or committed to version control.
  • The resulting hash cannot be reversed or decrypted to recover your original wallet address or social handle.
  • Under GDPR Article 17(3)(e) and Discord Developer Policy §2.c, these pseudonymized hashes are retained indefinitely for fraud prevention, even after a cleartext data purge.
  • The vault prevents credential rotation as a sybil evasion tactic — a deactivated account's hash continues to block re-registration of the same credential on a new account.
§4

Your Rights & Data Controls

You have full control over your personal data. The following rights apply and can be exercised at any time.

Access & Portability
Use the web dashboard export tool to download a complete record of your XP transactions, submissions, profile entries, and quiz logs.
Rectification
Update or correct any voluntary profile field at any time using /profile edit or the web dashboard field editor.
Erasure
Run /privacy purge-my-data in Discord to trigger an automated purge. This permanently deletes cleartext profile fields, redacts audit history, removes cached identity data, and unlinks OAuth platform accounts. Cryptographic hashes in the sybil vault are deactivated but retained (see §3.2). For manual purge requests, contact taris@tarisresh.com.
Objection
You may object to the processing of your data for any purpose other than core fraud prevention at any time by contacting us at taris@tarisresh.com.
§5

Security Measures

  • DB Database isolation — PostgreSQL 16 hosted in isolated virtual networks with restricted administrative access and no public endpoint exposure.
  • SQL Parameterized queries — all database access uses strict prepared statements throughout the codebase, preventing SQL injection at the framework level.
  • HSH HMAC-SHA256 hashing — credential-sensitive values are one-way hashed with a confidential server-side pepper before storage. The plaintext never persists.
  • INT Minimal Discord intents — only the privileged intents required for bot operation are active: Guild Members (XP and role assignment) and Message Content (message exports). The Presence intent is explicitly disabled. All commands use Discord's native snowflake verification to prevent identity spoofing.
§6

Third-Party Services

Logisbot interfaces with the following external platforms. Each operates under its own privacy terms.

Discord Inc. Core platform. All interactions pass through Discord's infrastructure and are governed by the Discord Terms of Service and Discord Privacy Policy.
OAuth Providers X (Twitter), Telegram, and Steam are accessible only when you explicitly link your account through the web portal. We receive only public profile data — username, platform ID, and avatar URL — and never your credentials or private data.
§7

Children's Privacy

Logisbot is not directed to individuals under the age of 13 (or under 16 in the European Economic Area), in accordance with Discord's own Terms of Service minimum age requirements. We do not knowingly collect personal data from children below these ages.

If you believe a minor has submitted data to the bot, please contact us at taris@tarisresh.com and we will delete the data promptly.

§8

Changes to This Policy

We may revise this Privacy Policy as Logisbot's features evolve or as regulatory requirements change. When significant updates occur, the "Last Updated" date at the top of this document will be updated and users will be notified via community release notes or the /privacy policy command in Discord.

Continued use of Logisbot after a policy update constitutes acceptance of the revised terms.

§9

Contact

If you have questions, concerns, or data requests relating to this Privacy Policy, please contact the bot operator directly: