Cassie

Privacy Policy

Last updated: October 30, 2026

1. Data Controller

Cassie ("the Bot") is operated by an individual developer. The Bot and its database are hosted on hardware owned and operated by the developer. No cloud hosting providers are used for data storage or processing. For privacy-related inquiries, contact the operator through the support server or via Discord direct message.

2. Lawful Basis for Processing

We process your personal data under the following lawful bases as defined in Article 6 of the GDPR:

• Legitimate Interest (Article 6(1)(f)) — for core Bot functionality: storing guild settings, tags, reminders, todo lists, AFK status, command overrides, economy data, level/XP data, moderation cases, and activity statistics. This processing is necessary to provide the service you intentionally use.
• Consent (Article 6(1)(a)) — for AI chat history and persistent AI memory. You provide consent by actively using the AI chat feature. You may withdraw consent at any time by ceasing to use AI features or requesting deletion of your data.
• Legal Obligation (Article 6(1)(c)) — where we are required to retain or disclose data by applicable law (e.g., reporting illegal content to authorities).

3. Data We Collect

The Bot collects and stores the following data when you use its features:

3.1 Identity Data

• Discord User ID — used as the primary identifier for all user-specific features.
• Discord Username — stored for display purposes and user lookups.
• Discord Avatar URL — cached for display in rank cards and dashboard.
• Account Creation Date — used in AI context and anti-raid age checks.

3.2 Server Data

• Discord Guild (Server) ID — used to store server-specific settings.
• Guild Settings — custom prefix, disabled commands, command overrides (per-channel, per-role, per-user), tags, and feature configurations.
• Guild Statistics — member count, channel count, role count, command usage counts.

3.3 Activity Data

• Message Count — per-member count of messages sent in each server. Used for XP/leveling and auto-role eligibility.
• Voice Time — cumulative seconds spent in voice channels per server. Used for XP/leveling and auto-role eligibility.
• Command Usage — which commands are used, in which server, by whom, and when. Used for statistics and diagnostics.

3.4 User-Created Content

• Tags — custom text snippets you create in servers.
• Reminders — your scheduled reminders (content, time, channel preference).
• To-Do Lists — your personal task items.
• AFK Status — your AFK message and since-when timestamp.
• Timezone — your configured timezone for time commands.
• Custom Prefix — your personal command prefix override.
• Time Capsules — messages scheduled to be sent to you at a future date.

3.5 Economy Data

• Balance — your virtual currency balance per server.
• Transaction History — record of all currency earned, spent, and transferred.
• Work/Daily Streaks — streak tracking for daily claims and work commands.
• Vote Streaks — tracking for bot listing site vote rewards.

3.6 Level & Progression Data

• XP and Level — your experience points and current level per server.
• Voice Time — total voice seconds contributing to XP.
• Role Rewards — roles automatically assigned at level milestones.

3.7 Moderation Data

• Moderation Cases — records of bans, kicks, timeouts, warns, and other actions taken against users, including the moderator, target, reason, and timestamp.
• Strike Counts — auto-moderation strike counts per user per server.
• Invoke Templates — custom message templates configured by server admins for moderation actions.

3.8 Ticket Data

• Ticket Records — support tickets including channel, owner, status, priority, subject, and form responses.
• Ticket Messages — messages sent within tickets.
• Ticket Notes — staff notes on tickets.

3.9 AI Data

• Chat History — messages you send to the AI chat, stored to provide conversational context.
• AI Memory — a persistent memory (~1000 words) that the AI reads and writes during your conversations. This is per-user and global (not per-server).

3.10 Web Dashboard Data

• Session Cookie — an HTTP-only session cookie (connect.sid) for authentication. Contains your Discord User ID, username, avatar, and OAuth access token. Expires after 7 days of inactivity or on logout.
• IP Address — logged temporarily during invite click tracking for fake account detection, and recorded in web server access logs for security, abuse prevention, and aggregate visit statistics.
• User Agent and Browser Data — the browser user agent and derived browser, version, operating system, and device type are recorded in web server access logs.
• Request Data — requested path or route, HTTP method, response status, response time, referrer, language preference, and country code from proxy headers (when available).
• Account Link — if you are signed in through Discord, the logged visit may be associated with your Discord User ID.

Web visit logs are used only for security, performance monitoring, and aggregate site analytics. The analytics dashboard is password protected and restricted to the Bot operator. We do not use third-party analytics or advertising scripts.

3.11 Invite Tracking Data

• Invite Codes — tracked invite codes and their use counts.
• Join/Leave Records — which invite was used to join, and when the user left.
• Fake Account Flags — accounts flagged as likely fake or alt accounts.

3.12 Other Data

• Boost Streaks — server boost streak tracking per user.
• Court Cases & Votes — community court cases and associated votes.
• Ideas & Votes — feature ideas submitted and voted on.
• Vote Reminders — scheduled reminders for bot listing site votes.
• Reaction Roles — reaction role configurations per server.
• Starboard Entries — starred messages and their star counts.
• Temporary Voice Channels — created VoiceMaster channels and their settings.
• Echo Messages — queued anonymous messages in echo chambers.
• Announcement Preferences — which servers have subscribed or opted out of announcement broadcasts.

4. How We Use Your Data

Your data is used exclusively to provide the Bot's functionality:

• Processing commands and applying your settings
• Tracking economy, levels, and activity for gamification features
• Enforcing moderation actions and auto-moderation rules
• Providing AI chat with conversational context and persistent memory
• Displaying statistics on the web dashboard
• Detecting and preventing fake accounts and raids
• Generating moderation case logs for server administrators

We do not use your data for advertising, profiling, or sale to third parties.

5. AI Data Processing

The Bot's AI features are powered by a locally-hosted language model (Ollama, running on the developer's own hardware). Your messages are processed locally and are not sent to third-party cloud AI services.

The AI has access to read-only database tools. To protect your privacy:

• User-scoped data (todos, reminders, economy, chat history, memory) is only accessible to the user making the request. The AI cannot read other users' personal data.
• Server-scoped data (tags, level config, starboard, etc.) is filtered to the current server.
• Blocked data — the AI cannot access sessions, moderation configs, admin settings, IP addresses, or any security-related data.
• The AI has no write access to the database beyond your personal chat memory.
• The AI cannot send messages, execute commands, or perform actions on your behalf.

The AI's web search tool sends search queries to the LangSearch API (api.langsearch.com). Only the search query text is transmitted; no personal data is attached.

6. Third-Party Services

We use the following third-party services:

• Discord API (discord.com/api) — for OAuth2 authentication, fetching your guild list, sending webhooks, and serving avatars. Subject to Discord's Privacy Policy.
• LangSearch API (api.langsearch.com) — used by the AI's web search tool. Only search queries are sent. No personal data is attached.
• OpenAI Moderation API (api.openai.com/v1/moderations) — used to screen feature idea submissions for policy violations. Only the submitted idea text is sent.
• Bot Listing Sites (top.gg, discordbotlist.com, discordlist.gg) — receive guild counts for listing purposes and send vote webhooks when users vote. Vote webhooks are cryptographically verified.
• APIs for Images — api.bunnies.io and api.thecatapi.com are used for random animal images. No personal data is sent.
• GitHub Webhooks — the Bot receives repository event webhooks (push, PR, etc.) for development tracking. Webhook signatures are HMAC-verified.

Not a third-party service: Ollama (the AI inference engine) runs locally on the developer's hardware. No data leaves the developer's machine for AI processing.

7. Data Storage & Retention

All data is stored in a PostgreSQL database on hardware owned and operated by the developer. We retain data for as long as it is needed to provide the Bot's functionality:

• Guild settings, tags, economy, levels, moderation cases, activity statistics — retained until you request deletion or remove the Bot from your server.
• User content (todos, reminders, AFK, timezone, time capsules) — retained until you request deletion.
• AI chat history and memory — retained until you request deletion or use the c.optout command.
• Web dashboard sessions — deleted after 7 days of inactivity or on logout.
• Invite click tracking (IP, user agent) — not stored long-term; used temporarily for matching joins to invite links.
• Web visit analytics (IP, user agent, browser/OS/device, route, status, timing, referrer, language, country) — retained for 30 days by default, then pruned automatically. The retention window is configurable by the Bot operator.

8. Data Sharing

We do not sell, trade, or share your personal data with third parties. Data is only accessible to the Bot operator for support, maintenance, and legal compliance purposes. The web dashboard uses self-hosted visit analytics; we do not use third-party analytics, advertising, or tracking services.

9. International Data Transfers

The Bot and its database are hosted on servers located in the United States. If you access the Bot from the European Economic Area (EEA), the United Kingdom, or other regions, your personal data will be transferred to and processed in the United States.

10. Data Security

We take reasonable measures to protect your data, including encrypted database connections, secure session handling with HTTP-only cookies, CSRF protection on OAuth flows, and cryptographic verification of webhooks. However, no method of electronic storage or transmission is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform affected users.

11. Your Rights

You have the following rights regarding your data:

• Right of Access — You can export all your stored data at any time using the c.mydata command in Discord. This returns a JSON file with all data the Bot holds about you.
• Right to Erasure — You can request full deletion of your data (see Section 12).
• Right to Withdraw Consent — You can opt out of AI data processing using the c.optout command, which disables vote thank-you DMs and can be used to request AI data removal.
• Right to Data Portability — The c.mydata command provides your data in a machine-readable JSON format.

To exercise any right not available through the above commands, contact us through the support server or via Discord DM. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

12. How to Request Deletion

To request full deletion of your data:

• Option 1: Send a direct message to the Bot operator on Discord detailing your request.
• Option 2: Join the support server and open a ticket.

Please include your Discord User ID (right-click your profile → Copy ID) to help us locate your data. We will confirm receipt within 72 hours and complete the deletion within 30 days. Note that some data may be retained if required by law (e.g., records of illegal content reports).

13. Children's Data

Cassie is not intended for children under 13, in line with Discord's Terms of Service. We do not knowingly collect data from children below the applicable age. If we become aware that a child's data has been collected without appropriate consent, we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted here and the "Last updated" date will be revised. If significant changes are made, we will notify users via the support server. Continued use of the Bot after changes constitutes acceptance of the updated policy.

15. Contact

For privacy-related inquiries, deletion requests, or any questions about this policy:

• Support server: Join the server
• Discord DM: Message the Bot operator directly