Your data, kept to a minimum.

Last updated: 26 September 2026

This Privacy Policy explains how the Zora Discord bot and its website and dashboard (the "Service") handle information when you use them. It applies to everyone who adds Zora to a server, uses any of its commands, or signs in to the dashboard. Definitions used here have the same meaning as in our Terms of Service.

1. Our principle: keep as little as possible

Zora is designed around data minimisation. Every feature was built to work from Discord IDs and the settings an administrator chose, rather than from personal information. If a piece of data is not needed to make a feature behave as you configured it, we do not collect it, and if we do not need it any more, we remove it.

2. Data we do not store

None of the following is collected or stored by the Service:

• Message content. Command text, chat messages, attachments and embeds are never written to a database. A message is held in memory only for as long as it takes to respond, evaluate auto-moderation, or fire a trigger, and is then discarded. Message history cannot be reconstructed from anything we keep.
• Personal information. No names, no email addresses, no phone numbers, no postal addresses, no dates of birth, no payment or billing information of any kind.
• Credentials. We never see or hold your Discord password, email or token. The dashboard signs you in through Discord's own OAuth flow; we receive only the basic profile Discord returns, and only while you are signed in.
• Your server's contents. No message history, no full member lists, no uploaded files, no voice or audio.
• Your raw IP address. Visitor counting keeps only an irreversible hash — see section 7.
• Location, device fingerprints, advertising identifiers, or behavioural profiles.
• Special-category data. We do not ask for, and do not wish to receive, information about your health, beliefs, politics, ethnicity, sexuality or any other sensitive category.

3. Data we do store

To work, the Service keeps a small amount of configuration, all of it scoped to a Discord ID:

• Server settings. Your prefix; the channels and roles chosen for welcome, farewell, logging, auto-moderation, anti-nuke, join-to-create, reaction roles and similar features; feature on/off switches; thresholds and durations; custom message templates you write; auto-react triggers and emojis; and auto-moderation word lists.
• Moderation records. Case entries such as warnings, mutes, kicks, bans and temporary roles, including the affected user ID, the moderator's ID, the reason and the time — kept so your staff can review actions and appeal fairly.
• Member-scoped feature data. Data a member created and would expect to persist: AFK status and reason, to-do lists, music favourites and playlists, a profile description and background, no-prefix grants, and temporary voice-channel state.
• Giveaway data. Entries and winners, by user and message ID, for as long as the giveaway exists.
• Abuse-prevention records. A blacklist of user or server IDs, with a reason, used only to keep the Service and its users safe.
• Dashboard session. While you are signed in, a session record identifies you to the dashboard; it ends when you sign out or it expires.
• Visitor count. A salted hash of the IP address and a date, used solely to count unique daily visits.

4. How we use what we store

Stored configuration is used only to operate the features it belongs to. In particular, we do not use it to build advertising profiles, to train AI models, to infer anything about you, or to contact you. It is never sold, rented, shared or traded.

5. How your messages are handled

Zora necessarily receives the messages in servers where it can read them, and treats them as transient: a message is read only to decide whether it is a command, whether it trips auto-moderation, or whether it matches a trigger you configured; if a reply is needed, the relevant text produces the reply and is not retained afterwards; nothing is written to storage. If you enable a feature that sends text to a third-party service, only the text needed for that single request is sent (section 8).

6. Legal bases

Where a legal basis is required, we rely on our legitimate interest in operating, securing and improving the Service, on the performance of our agreement with you under the Terms, and on your consent where a feature asks for it. You can withdraw consent at any time by turning the relevant feature off, which also removes the data it used.

7. Cookies, sessions and visitor counts

The public site sets no advertising or tracking cookies. It uses:

• A session cookie when you sign in to the dashboard, so you stay signed in while you use it. It is essential to the login and disappears when it expires or you sign out.
• A visitor count. To know how many people visit, the site stores a salted SHA-256 hash of the incoming IP address together with the date. The raw IP is never stored and the hash cannot be reversed to recover it. It is used only to count unique daily visits.

8. Third-party services

Some features rely on services outside Zora. When you use them, the minimum information needed is sent to that provider under its own privacy terms:

• Discord — all bot and login functionality;
• Music infrastructure (Lavalink nodes) — the track query or URL you ask for;
• AI providers — the prompt you send to an AI command;
• Lyrics and search providers — the song title or search term you supply;
• Image-generation providers — the prompt you supply to an image command.

We do not control these providers. Each can be turned off on your server at any time, which stops the corresponding transfers.

9. Retention and deletion

We keep data only while it serves the feature it belongs to:

• clearing a setting in the dashboard, or turning its feature off, removes or empties the stored configuration;
• ending a giveaway, or removing its entry, removes the associated entries;
• removing Zora from a server stops all processing for that server immediately.

When data is no longer needed for its purpose, it is deleted. Where deletion is triggered through the dashboard, it is immediate; where a request is made to us, we action reasonable requests within a reasonable period.

10. Your rights

Subject to applicable law, you have the right to:

• Access — ask what data is held about your user ID or server;
• Rectification — have inaccurate data corrected or cleared;
• Erasure — ask us to delete the data associated with your user ID or server;
• Restriction and objection — ask us to limit or stop a particular processing;
• Portability — receive the data you provided in a usable form;
• Complaint — lodge a complaint with your local data-protection authority.

You can exercise most of these yourself: turn off a feature to remove its data, or remove Zora from your server to stop processing entirely. For anything else, contact us in the support server and we will help. We may need to verify that you control the server or account the request concerns before acting. We keep the minimum record necessary to honour a deletion request and to prevent abuse.

11. Security

We take reasonable technical measures to protect what we hold, starting with not holding much: visitor addresses are hashed, and only the data listed in section 3 is stored at all. No internet service can promise perfect security, so please do not send the Service anything you would not want stored, and never share your Discord password or token with anyone, including us — we will never ask for them.

12. Children's privacy

The Service is not directed to children below Discord's minimum age (13, or older where local law requires). We do not knowingly store personal information from anyone below that age. If you believe a child has used the Service, contact us and we will remove any associated data.

13. Where data is held

Data is stored on the servers that host the bot and dashboard, which may be in a country other than your own. Wherever it is held, it remains limited to the categories in section 3 and is protected as described here.

14. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above and, for material changes, give notice on this page or in the support server. Continuing to use the Service after a revision takes effect means you accept the updated policy.

15. Contact

Questions about this policy, or requests about your data, are welcome in the support server. See also the Terms of Service for the rules that govern your use of Zora.