DONDA · Legal

Privacy Policy

A scam filter has to look at what gets posted in order to work. You should know exactly how far that goes, so this page lists what DONDA reads, what it keeps, what it never touches, and who can see any of it.

Last updated 12 August 2026

The short version

DONDA looks at messages and image attachments in servers it has been added to. Nothing is stored unless a message trips a detection rule.

When something does trip a rule, the message and who posted it are recorded so the catch can be reviewed and so the same scam is recognised next time. Those records are deleted after 30 days.

Ordinary conversation is not logged, not read by a human, and not used to train anything.

The rest of this page is the same thing in detail. The operator is one person, reachable as @xraid on Discord, and is the party responsible for the data described below.

What it reads

To detect a scam posted as a picture, the bot has to be able to see message content. It therefore uses Discord's Message Content privileged intent, along with the server and member intents.

In a server it has joined, DONDA processes, in memory, at the moment the message arrives:

The text of the message, including text inside embeds.
Image attachments, which are run through OCR to extract any text in them, checked for QR codes, and hashed.
Any links found in either of those.
The Discord user ID and tag of the author, and the server and channel it was posted in.

If none of the checks fire, all of that is discarded as soon as the check finishes. Nothing is written down.

It also runs one check that isn't about messages: when a member joins a server, their Discord username is looked up against a public spam database. See outside services.

What gets stored on a catch

When a message is flagged as a scam, a record of that interception is written to the operator's database:

Author: The Discord user ID and the user tag of whoever posted it.
Message: The text content of the flagged message.
Where: Server ID and name, channel ID and name.
Verdict: Which rule fired, whether it was automatic or a manual /donda scan, the timestamp, and whether the operator later confirmed or dismissed the call.
Attachment: A copy of the flagged image saved on the operator's server, its original Discord CDN link, and the text OCR pulled out of it.
Fingerprint: A fuzzy hash of the image, and any malicious domain found — the two things that let a repeat of the same scam be caught immediately.
Counter: A per-user tally of how many times that Discord ID has been flagged, and when it was last seen.

A record is only created by a detection firing. There is no background collection, no analytics, no tracking of members who never trip a rule.

What it stores per server

Independently of any catch, DONDA remembers your configuration so it behaves the way you set it up:

Your server ID and name, and the ID of the log channel chosen with /donda setup.
Whether auto-moderation and softbans are on, and your lookalike-domain sensitivity.
Keywords added with /donda addkeyword, and domains blocked or trusted with /donda adddomain.

This is settings data, not content. It contains nothing anyone said.

What it never stores

Ordinary conversation. A message that doesn't trip a rule is never written to the database, in any form.
Direct messages. The bot ignores anything that isn't posted in a server.
Other bots' messages. They are skipped before any check runs.
Message history. Nothing is backfilled or scraped; only messages posted while the bot is online and present are seen at all.
Voice, presence, or profile data. No voice audio, no online status, no email addresses, no IP addresses, no payment details — there is nothing to pay for.
Anything from a server it isn't in. Removing the bot ends all processing immediately.

Why any of it is kept

Every field in section 3 exists for one of three reasons, and for nothing else:

To act on the scam — delete the message, log it to your channel, and apply a softban if your server enabled it.
To let a bad call be found and undone. Keeping the message and the reason is what makes it possible to see that a detection was wrong, and to delete what that mistake taught the bot.
To recognise the same scam again, in your server and in every other server the bot protects.

None of it is sold, rented, shared with advertisers, or used to build a profile of anyone. There is no revenue model here to make that tempting.

What "learning" means here

DONDA does get better over time, and it's worth being precise about how, because "the bot learns from your messages" can mean something much larger than what happens.

What it learns from a confirmed catch is two things: the fuzzy hash of the scam image, and the malicious domain. Both are fingerprints. Neither one can be turned back into the original message or tells anyone who posted it.

The language classifier runs locally on the bot, on the operator's own machine. No message, image, or OCR text is ever sent to an AI provider, and nothing is used to train any third-party model.

If the operator reviews a catch and decides it was wrong, the interception is marked as dismissed and the hash and domain it created are deleted, so the mistake isn't carried forward.

Outside services

Two external services are involved. This is the complete list.

Discord

The bot runs on Discord's platform, so everything it sees comes through Discord and every action it takes happens there. Discord's own Privacy Policy governs that, and is outside the operator's control.

StopForumSpam

When a member joins a server, their Discord username is sent to StopForumSpam to check it against known spam accounts. Only the username is sent — no ID, no server, no message. Results are cached for an hour to keep lookups down.

Separately, the bot periodically downloads a public list of known Discord phishing domains from a GitHub-hosted repository. That is a plain download: no data about you or your server goes out with it.

How long it's kept

30 days: Interception records — author, message text, server, channel, reason. A cleanup job runs once a day and deletes anything older, automatically.
Until removed: Image hashes and malicious domains. These are the fingerprints that make the bot useful across servers, so they outlive the record that produced them. They identify a scam, not a person.
Until removed: Saved copies of flagged images on the operator's server, and the per-user violation counter.
Until removed: Your server's settings, keywords and domain lists, for as long as the bot is in your server.

"Until removed" means there is no automatic expiry on those, and they are deleted on request — see your choices.

Who can see it

One person: the operator, through a private dashboard that is password-gated and bound to the local machine rather than exposed on the internet. It is a separate application from this website and shares no code with it.

Beyond that, the only place a catch surfaces is your own log channel, in your own server, visible to whoever you gave access to it. That entry names the poster, the rule that fired, what was done about it, and shows the flagged image itself — so choose a channel your moderators can see and your members can't.

Nothing intercepted is ever published. The scam poster shown on the landing page is a drawn recreation, not a real intercepted image, and no real one will ever appear there.

Where it lives

Data is stored in a local database file and a local folder on a single private server operated by one person, not in a managed cloud database and not with a third-party analytics provider.

Reasonable care is taken — access is restricted, the dashboard is not publicly reachable, and credentials are kept out of the codebase. But this is a free side project, not an audited service, and no system can be promised to be secure. Please do not treat it as suitable for storing anything sensitive.

Your choices

Stop all processing: remove the bot from your server. Nothing further is read from it, in that moment.
Reduce what gets flagged: trust the domains your community actually uses with /donda adddomain, so legitimate posts stop being caught.
Wait it out: interception records delete themselves after 30 days without anybody doing anything.
Ask for deletion: message @xraid on Discord with your Discord user ID or server ID and what you want removed, and it will be deleted from the database. You can also ask what is currently held about you.

Depending on where you live, you may have further rights over your personal data — such as access, correction, erasure, or objecting to processing. The route to all of them is the same: message @xraid. One person handles these, so allow some time.

Age

Discord requires its users to be at least 13, or older where local law sets a higher minimum. DONDA is not directed at children and does not knowingly hold data about anyone below that age. If you believe it has, ask for it to be deleted and it will be.

Changes to this policy

If what the bot collects changes, this page changes with it. The current version always lives at this URL, dated at the top. Continuing to use DONDA after an update means you accept it.

Contact

@xraid on Discord — for privacy questions, deletion requests, or anything on this page that doesn't match what you're seeing.