Privacy policy

Sprok is a Discord bot and a companion dashboard at sprok.umbleh.dev, operated by umbleh. This policy says what they collect, why, how long it’s kept, and how to get rid of it. The short version: the bot keeps what it needs to run the features a server turns on, never sells or shares it, and deletes it when the server or you say so.

What the bot collects

Server settings

Per-server configuration: the command prefix, which features are on, channel and role ids the server picked, and the settings for each feature. Stored for as long as the bot is in the server.

Voice recaps

Voice audio is captured only during a session someone explicitly starts with record start, announced in the channel, and only from members who acknowledged inclusion. Raw audio is deleted the moment transcription finishes. The transcript and an AI-written recap are kept for the server’s retention window (90 days unless the server changed it) and are used only to produce, search, and show recaps in that server. Transcription runs locally; the recap is produced by one request to an AI provider that receives the transcript and nothing else about you. A per-server count of recorded minutes is kept for quotas. optout permanently excludes your audio in a server.

Anti-brainrot

In servers that turn this on, messages in the channels the server opted in are checked against a word list. Only numbers are stored: a heat score, counters, timestamps, and an activity log of what the bot did (a warning, a mute, a pardon, a settings change) with the ids of who was involved. Message text is never stored, not even in logs.

What the dashboard collects

Signing in uses Discord’s OAuth2 with two permissions: identify (your Discord id, username, and avatar) and guilds (the list of servers you’re in, with your permissions in each). That list is used only to show which servers you can manage and which ones could add the bot. It is kept in the dashboard’s memory for about a minute and is not written to a database. The dashboard has no database of its own.

The session cookie

One cookie, sprok_session, holds your Discord id, username, avatar, the access token Discord issued, and its expiry. It is encrypted, only sent over HTTPS, not readable by scripts, and expires when the Discord token does (about a week). Signing out deletes it. A second, ten-minute cookie exists only while a sign-in is in progress. There are no analytics or advertising cookies.

Actions you take

When you change a setting or pardon someone from the dashboard, the bot records that you did it (your Discord id, the time, and the change) in the same activity log the commands use, and posts a short note to the server’s mod log channel if one is set. Server admins can see this. It contains no message text.

Who can see what

Server admins (members with Manage Server) can see their own server’s settings and anti-brainrot data. Recaps are visible to the server according to its own settings. Nobody outside the server sees any of it. The operator can access the database for maintenance and does not read or analyse content beyond that.

Third parties

• Discord — the platform itself; everything the bot does goes through Discord’s API under Discord’s own policies.
• An AI provider for voice recaps (Anthropic, or Cloudflare Workers AI while testing) — receives a session transcript to write the recap, nothing else.
• Cloudflare — sits in front of the dashboard as a proxy and sees the web traffic like any CDN.

Nothing is sold, and nothing is used for advertising or profiling.

How long, and how to delete

• Recaps and transcripts: the server’s retention window, or recap delete for one session.
• Anti-brainrot numbers: pruned automatically once they have decayed; the activity log keeps 30 days.
• Everything for a server: deleted when the bot is removed from that server.
• Your dashboard session: sign out, or wait for it to expire.

To ask for anything else, use the report command in any server with the bot, or the contact details on umbleh.dev.

Changes

If this policy changes in a way that matters, the date above changes with it and the bot’s privacy command links here.