Privacy

You are about to let a bot read every message in your server. This page says what it does with them. The three answers most people actually want are first; everything under them is the detail, for the member who asks and for the regulator.

Privacy notice for the hosted jevmod bot for Discord and for this site, effective 2026-09-19. Each statement about the code points to the line it comes from; the list is in CLAIMS.md and the code is on GitHub. Where something is not settled yet this page says so, marked "still missing", instead of pretending.

The short answers

Will it delete my members' messages?

Not unless you turn that on. Every category starts at flag, which reports the message in your log channel and does nothing to it; the bot deletes or times out only for a category or rule you set to delete or timeout yourself.

With everything turned on, the worst it can do is delete a message and time a member out for 10 minutes. It has no code path that bans anyone: the only actions it knows are off, flag, delete and timeout.

Who can see what my members wrote?

For each message it judges, the bot sends the message text and the topic of the channel to Jev, the model run by TypeSafe. It does not send the author's name, the author's id or the server's name.

Then it forgets the text. The decision record has a text column, but the hosted bot runs with JEVMOD_KEEP_TEXT_CHARS set to 0, so that column is always empty. What is left in the operator's database is ids, categories and probabilities, and that is also all the operator can read.

The readable copy is the one inside your own server: the flag the bot posts goes to a log channel created with the everyone role unable to read it. Your moderators can read it, Discord holds it, and you can delete it.

How do I get rid of it?

Decision records are kept for 30 days and then deleted, whether you ask or not.

To not wait, /mod forget deletes everything stored about your server now, and kicking the bot out does the same thing. /mod forget_user does it for one member.

Deleting your data does not cancel your subscription. /mod forget deletes the subscription row in jevmod's database and never calls Stripe, so a subscription that is still live in Stripe keeps being charged. Cancel in Stripe first, then delete.

The rest of this page: who is responsible, what goes to the model, what is stored, what stays in your Discord, your rights and the commands that deliver them, what you owe your own members.

Who is responsible

The hosted bot and the demo on this site are run by one person, not a company.

• Omar Hernandez, working as a sole trader (autónomo) in Valencia, Spain.
• Email for privacy requests: omarhernandezbastos@gmail.com

For this site, for the demo and for anyone who buys Pro, Omar Hernandez is the data controller. There is no data protection officer; the law does not require one for an operation this size, and appointing one would be a claim without substance.

Inside someone else's Discord server the roles change, and this page reads differently depending on which of two people you are.

• A member of a moderated server. Your messages get judged because the server's owner set that up. The owner is the controller and jevmod is their processor. If you run a Discord server is about that relationship.
• A customer. You pay for a server's subscription, or, once sign-in ships, you hold a dashboard account. For that account Omar Hernandez is the controller, not a processor acting on somebody else's instructions. Signing in and your account is about that one.

A server owner who also pays is both.

What the hosted bot sends to the model

The judging request itself is in the short answers: message text and channel topic to TypeSafe, no name, no id, no server name. Messages are numbered by position inside the request and nothing else identifies them. Two more things are true about it.

The author's id is kept only in the bot's own log, so that erasure requests can be honoured.

Messages from members who can manage messages, and from roles you mark as trusted with /mod trust, are never sent to the model at all.

A message a local rule catches, a blocked link, word, pattern or raid hit, is decided by the bot's own code and never reaches the model either. This runs on every plan, including Free, which never sends anything to the model at all.

TypeSafe processes what it receives under its own terms: typesafe.ai. That request leaves the EU; see sending message text to the United States.

What the hosted bot stores

The bot writes a record only when a message crosses one of your thresholds and gets an action (flag, delete or time out).

A message that passes is not written anywhere.

Each stored record holds: the message id, the author id, the first 80 characters of the channel topic, the category, its probability, the action taken, the probability of every category asked, a request id and a timestamp.

The store cuts the message text to the number of characters it is configured to keep before writing it, and with 0, which is what the hosted bot runs, nothing of the text is written. A test in the repository checks that setting.

Per server and per calendar month the bot also counts judged messages, model requests and tokens, for the quota.

Records older than the 30 days above are deleted before every batch is judged.

Your settings (thresholds, actions, rules, trusted roles, channel topics, the id of the log channel) are stored for as long as the bot is in your server.

A message can say something sensitive about the person who wrote it, about their health, their beliefs or their sexuality. The self-harm and hate categories exist precisely to catch that kind of message. The hosted bot keeps none of that text in its own database, but the flag it posts into your log channel does contain the message, and that copy is yours to manage. Read what stays in your Discord before you turn on a category that will collect that.

What stays in your Discord

Every flagged message is posted to a log channel as an embed that contains the first 500 characters of the message text. That embed also mentions the author and the channel.

That embed is a message in your server: Discord holds it, not jevmod. To remove it, delete the message or the log channel like any other content in your server.

When a message is deleted or a member is timed out, the member receives a direct message from the bot with the server name, the channel, the category and the confidence, and a note to contact the server's moderators.

Decisions made without a person looking

When you set a category to delete or time out, the bot acts on a probability without anyone reading the message first. That is an automated decision, and two things limit it.

The effect stays inside one Discord server: a deleted message and a time out of a few minutes. No account is closed, no money moves and nothing follows the person anywhere else.

There is a human at the end of it. The direct message the member receives tells them to contact the server's moderators, and the moderators can undo the time out and change the setting. If you enable deleting or timing out, tell your members that automated moderation is in use and that they can ask a moderator to look again.

Your rights, and the commands that deliver them

Under the GDPR you can ask for access, rectification, erasure, restriction, portability, and you can object. Here is what each one means here and how to actually get it.

• Access. In a Discord server, ask a moderator: /mod recent shows the last decisions with their probabilities. For an API tenant, GET /v1/decisions returns them. /mod recent shows the last 10 decisions, and GET /v1/decisions returns up to 500. Once sign-in ships, the dashboard is a third way in: it shows you, directly, the servers you administer, their plan and their usage, without asking a moderator. If a moderator will not answer, write to the operator.
• Rectification. A decision record holds a probability, not a statement of fact about you, so there is rarely anything to correct. What can be corrected is the setting that produced it: the two buttons under every flag move that category's line, and /mod set changes it directly.
• Erasure. /mod forget_user @member deletes that member's entries from the decision log. /mod forget, or kicking the bot out, deletes everything stored about the whole server. For an API tenant, DELETE /v1/tenant. Whatever is left goes by itself after 30 days. Once sign-in ships, deleting your account from the dashboard does this yourself, for the account itself, without writing to the operator.
• Restriction. Ask for the processing to stop while something is disputed. /mod set with the value off, /mod trust and /mod staff are the three commands that take people or categories out of judging.
• Objection. Where the basis is legitimate interest, you can object. In practice that means the same three commands, plus writing to the operator for the demo and for the analytics.
• Portability. It applies to data you provided under a contract or consent. For the decision log the practical answer is the same as access: /mod recent and GET /v1/decisions return it as text and as JSON.

The commands that change settings or delete data ask for the Manage Server permission; the ones that only show what the bot did need Manage Messages.

Exactly what /mod forget removes: the server's settings, usage counters, decision records, API keys and subscription row. /mod forget_user @member deletes that member's decision records and replies with how many were removed.

A request sent to the operator gets an answer within a month. There is no charge for it.

Two honest limits. The demo log holds no name and no address, only a hash, so a request about the demo usually cannot be matched to a row; those rows go by themselves after 90 days. And the embed in your log channel is held by Discord in your server, so only the server's own moderators can delete it.

If you run a Discord server

In your server you are the data controller and jevmod is your processor. You decide that your members' messages get judged, which categories are on and what happens when one crosses the line. jevmod only carries that out. Three things follow.

• Telling your members that automated moderation is in use is your job, not the operator's. The bot is in your server on your invitation, and the notice your members will look for is yours.
• A request from one of your members about their data comes to you first. The commands under your rights are the ones that answer it.
• If your community is large, or you are a company, or you are in a regulated field, you will want a written processing agreement under article 28 of the GDPR before you use jevmod for real.

The agreement. The article 28 processing agreement is published at /dpa/. It is written by the operator rather than by a lawyer and is offered as it stands; if your organisation needs its own wording or a signed copy, write and say so.

Why this is allowed

Each thing the bot does rests on a different part of article 6 of the GDPR.

• Judging messages in a server. The server owner adds the bot and chooses the settings, relying on their legitimate interest in keeping the community usable, article 6(1)(f). jevmod judges on the owner's instructions and for no other purpose. The bot judges nothing while the server's policy is inactive, so nothing happens in a server that did not ask.
• The decision log. The same legitimate interest: the owner needs to see what the bot did, answer a member who complains and correct a setting that is wrong. Thirty days, then deleted.
• Payment. Performing the contract you enter when you buy Pro, article 6(1)(b), and keeping the records Spanish tax law requires, article 6(1)(c).
• Your account, once sign-in ships. Creating and keeping a dashboard account, its session and the list of servers tied to it rests on performing the contract you accept by signing up, article 6(1)(b). Deleting the account is the same basis running in reverse.
• The demo on this page. You choose to type the text. Keeping the log of what was tried rests on legitimate interest, article 6(1)(f): stopping abuse of an endpoint that costs money to run, and staying inside the monthly spend cap.
• Site analytics. Legitimate interest, article 6(1)(f). Nothing is stored on your device and no cookie is set, so there is no consent banner to click.

Where legitimate interest is the basis, you can object. See your rights.

Who else receives data

Four companies are involved today, and no others. Each one gets a different slice.

• TypeSafe gets the text of the messages being judged and the channel topic, and nothing else. It never gets a name, an id or the name of your server.
• Hetzner rents the machine the bot and this site run on, so everything jevmod stores sits on their hardware. They do not use it for anything. That machine is in Germany, so everything the bot stores stays inside the EU.
• Stripe gets what you type on their payment page when you buy Pro. Card details go to Stripe and never reach jevmod.
• Umami counts page views on this site. It is not a company here: it is Umami's software, self-hosted by the same operator on the same machine.

Three more join once sign-in ships, and only for people who use the parts that need them.

• Resend sends the account's sign-in link, receipts and other account mail.
• Sentry collects errors from the web app, on its free Developer plan.
• Crisp carries the support chat between you and the operator, on its free two-seat plan, once support ships.

better-auth, which runs the sign-in itself, is not one of them: it is a self-hosted library, and the session it keeps and the Discord OAuth token it stores sit in the same database on the same Hetzner machine as everything else jevmod stores, not with a third party.

Not decided yet. Sentry can capture request data, including parts of a request, inside an error's stack trace. The plan does not yet say what gets scrubbed before an error reaches Sentry, so until this page says otherwise, treat an error report as a place your account data could end up.

Discord is not in this list, because Discord is not a recipient of anything jevmod sends. Discord already holds every message in your server, before jevmod sees it. What jevmod posts back into your server, it posts as a message in Discord like any other.

Nothing is sold, and nothing is shared with anyone for advertising.

Sending message text to the United States

The one thing that leaves the EU is the judging request: the text of the messages being judged and the channel topic go to TypeSafe's API.

TypeSafe's own privacy policy says "The Services are hosted in the United States". So the message text is processed in the United States, which is a transfer outside the EU. TypeSafe also states in writing: "We will not train or fine tune any artificial intelligence or machine learning models on your prompts or other Input." That is their commitment, quoted from their terms, not a promise jevmod can keep on their behalf.

Still missing. The operator does not yet have a data processing agreement or standard contractual clauses signed with TypeSafe. Today the transfer happens under TypeSafe's published terms alone. That is the honest position: there is no extra safeguard in place to point at. The operator has to obtain those clauses, and this page will say so when they exist.

If that gap matters to your community, there are two ways around it. Run jevmod yourself with your own TypeSafe key, so the decision is yours and not the operator's. Or do not send the affected channels: mark the roles or channels you care about as trusted so they are never judged.

Once sign-in ships, one more transfer joins this. Resend, which sends the account's email, is a United States company: even when sending is routed through its EU region, the account data itself is stored in the United States. Unlike the gap above, Resend's own data processing addendum is already signed for every account, automatically, and it covers this transfer under Standard Contractual Clauses and the EU-U.S. Data Privacy Framework, so there is a safeguard to point at from the day it is turned on.

Sentry and Crisp do not add a transfer, as planned. Sentry offers a European data region, in Frankfurt, on its free plan; the plan is to select it. Crisp is a French company and keeps its own data inside the EU. Both will be confirmed on this page once they are actually configured, the same way this section will be updated when TypeSafe's own safeguard exists.

Signing in and your account

This section is about the customer, not the server member. None of it exists yet. It describes what becomes true the day sign-in ships, from the plan it is being built against, so this page does not need rewriting the week it matters.

Registering creates an account from one thing: your email address. jevmod sends a link to it and a working link is the whole proof, so there is no password here to store, to leak or to reset.

Connecting Discord to that account is a separate step, and only servers need it. Doing it stores your Discord user id and the list of servers Discord says you administer, refreshed each time you connect. Buying the API and never touching Discord means jevmod never learns you have an account there.

That list is only a shortcut for the dashboard's own server picker. Every time the dashboard reads or changes a server's settings, jevmod re-checks the Manage Server permission against Discord directly, the same check the bot already makes before it answers a slash command; the cached list by itself never grants access to anything.

Deleting the account removes this row and the list of servers with it; nothing in the plan keeps either afterward.

Staff accounts, which means Omar and anyone working with him, sign in the same way and additionally need a passkey on the device. That is a deliberately higher bar than a customer clears: a staff account can read any server's flagged messages.

A server's page also offers to email you: ticking that box stores the address you signed in with against that one server, for the monthly-limit notice and nothing else. Unticking it deletes the row, and so does the server's data being deleted.

Visiting a server's dashboard page also records, against that server, the language its interface was showing you at the time -- so a payment-failed or over-the-limit notice, which a webhook or a scheduled check sends and neither carries a browser to ask, can go out in that language instead of always defaulting to English. A server nobody has ever opened the dashboard for simply gets English; nothing errors for that.

Live since September 2026. Sign-in, the Discord connection and the dashboard are running. This section describes the account as it is, not as it was planned.

Payments

Payments run through Stripe. Card details go to Stripe and never reach jevmod, which stores only the Stripe customer id and subscription id against your server. A copy you run yourself has no billing at all.

Payment for the Pro plan happens on a Stripe Checkout page opened from /mod upgrade. Managing or cancelling the subscription happens in Stripe's billing portal, reached through the same command.

jevmod stores, per server: the Stripe customer id, the subscription id, the price id, the subscription status and the end of the current period.

Stripe notifies jevmod of changes through a webhook; when a subscription is cancelled or stops being active the server goes back to the Free plan.

Card numbers are entered on Stripe's pages. See Stripe's privacy policy. Stripe is also outside the EU for some of its processing, under its own terms; the operator does not control that part. Invoices and the records tax law requires are kept for as long as Spanish law says, which is longer than the 30 days that apply to a decision record.

What you get back if you change your mind, and who answers when you ask, are on the terms page.

The demo on this site

The text you type into the demo is sent to Jev, the model run by TypeSafe, in the same way as a message judged in a server.

The demo on the front page accepts up to 300 characters of text.

Each check is logged by the operator with the text, the category, the probabilities, a hash of your IP address, the country header set by the proxy, and the number of tokens it cost. The IP address is hashed with SHA-256 and a salt before it is stored; the address itself is not kept.

Each address may run 6 checks per minute and 40 per day. The demo also has a monthly spend cap, $0.50 by default, and answers with an error once it is reached.

Demo records are deleted 90 days after they are written; the deletion runs when the demo is used.

The demo does not use the bot's database, and unlike the bot it does keep the text. Do not type anything into it that you would not want kept for 90 days.

Analytics

A self-hosted Umami instance at analytics.hernandezbastos.es counts page views; it does not use cookies.

It runs on the same machine as the rest, so the page view counts do not leave the operator's server.

Self-hosted installs

If you run jevmod yourself, none of the above applies: the database is on your machine and the operator of this site never sees it. You are the controller and, for the judging request, you deal with TypeSafe directly under your own key.

One difference is worth knowing: a self-hosted copy keeps up to 300 characters of each flagged message by default, where the hosted bot keeps none. Set JEVMOD_KEEP_TEXT_CHARS=0 to keep none.

Discord permissions the bot asks for and why

• View Channels: to receive the messages it judges.
• Send Messages: to post decisions in the log channel.
• Manage Channels: to create the private #jevmod-log channel the first time it needs it.
• Manage Messages: to delete a message, only when you set a category or rule to delete or timeout.
• Moderate Members: to time a member out, only when you set a category or rule to timeout.
• Embed Links: the log entry is an embed.
• Read Message History: to fetch the log entry you reacted to, so it can adjust the threshold.

The invite link asks for those seven permissions and no others.

Separately from the permissions above, the bot has Discord's Message Content intent enabled; without it Discord does not deliver message text to bots.

If a permission is missing the bot does nothing to the message, and the log entry says which permission is missing and where to fix it.

Complaining

If you think this is being handled badly, you can complain to a data protection authority. The operator is in Spain, so that is the Agencia Española de Protección de Datos, the AEPD, at aepd.es. You can also complain to the authority of the country you live in. Writing to the operator first is faster, but it is not a condition of complaining.

Changes to this notice

When this notice changes, the date at the top changes with it, and the previous version stays in the repository history. Nothing here is quietly rewritten.

Contact

Privacy requests, including access and erasure: omarhernandezbastos@gmail.com, to Omar Hernandez, in who is responsible.

Everything else, including bugs and questions about the code: github.com/ohernandezdev/jevmod/issues. A GitHub issue is public, so do not put a request that names a person in one.