Obelisk Privacy Policy

Effective date: November 1, 2026

This policy explains what information the Obelisk Discord bot and its web dashboard ("Obelisk", "the service") collect, why, where it is stored, how long it is kept, and how to have it deleted. Obelisk is operated by the Obelisk team.

Contact: [email protected]

Obelisk is a moderation and server-protection bot. It only processes data to provide those features. We do not sell data, share it with advertisers or data brokers, or use message content to train machine-learning or AI models.

1. Who this applies to

• Members of Discord servers where Obelisk is installed. Obelisk processes some of your data automatically because a server administrator added it to that server.
• Server administrators and moderators who install Obelisk, configure it, or sign in to the web dashboard.
• Anyone who submits an appeal through Discord or the web dashboard.

2. Discord permissions and privileged intents

Obelisk connects to Discord with these gateway intents:

• Message Content (privileged): to read the text, links, embeds, and attachments of messages so they can be checked against the server's moderation rules.
• Server Members (privileged): to see members joining, their account creation date, avatar status, and username, for join screening, verification, honeypot, and anti-raid features.
• Guilds and Moderation: to see server, channel, and role structure, and moderation events such as bans and audit-log entries (for example, who added a bot).

Obelisk asks for moderation permissions (manage messages, timeout, kick, ban, manage channels and roles) so it can carry out the actions a server configures.

3. What we process and why

3.1 Messages (processed, mostly not stored)

When a message is posted in a channel Obelisk monitors, it checks the message in memory for things the server has enabled. These include advertising or spam images, Discord invite links, blocked words, malicious or adult-content links, mention and emoji spam, repeated messages, and webhook abuse.

• Message text is not saved to our database. It is checked and then discarded.
• Image attachments and image links are downloaded temporarily and compared against the server's reference images using image-similarity techniques (feature matching and perceptual hashing). The downloaded image is not saved. A short-lived in-memory cache keeps a fingerprint (hash) of recently checked images and the result, for about an hour, so the same image is not checked twice. The cache is cleared whenever the bot restarts.
• If a rule is triggered, Obelisk may delete the message and take the action the server configured (see 3.3).

3.2 Reference images uploaded by servers

Server staff can upload "known spam" reference images through the dashboard. These are stored on our server in a folder for that server (Training-Data/guilds/<server ID>/). Obelisk also uses a shared set of reference images maintained by the Obelisk team. Reference images are used only to recognize the same or similar spam images. They are not used to train an AI model. Despite the folder name, nothing is "trained": Obelisk compares images directly.

3.3 Moderation records

When Obelisk acts on someone (deleting a message, muting, timing out, kicking, banning, or a join-gate or honeypot action), it stores records that include:

• Discord user ID and username, server ID, channel ID, and message ID
• the rule or reason that triggered (for image matches: which reference image matched and the similarity score)
• the action taken, the offense count (strikes), and timestamps

These records power the server's moderation history, escalating punishments (for example, mute on the first offense and kick on the third), and the dashboard's statistics. Obelisk may also post a summary of the action (username, user ID, avatar, channel, reason) to a log channel the server chooses, and may send the affected user a direct message explaining the action and how to appeal.

3.4 Appeals

If you appeal a moderation action, we store your user ID, username, the server ID, the text of your appeal, its status, and when you submitted it. Your appeal is posted to the server's appeals channel so its staff can review it.

3.5 Join screening, verification, and honeypots

• Join gate: when you join a server, Obelisk may check your account age, whether you use the default avatar, and whether your username matches patterns the server has blocked (such as invite links). Obelisk may then act on your account, for example by timing you out, kicking, or banning you.
• Verification / captcha: if a server requires verification, Obelisk may send you a captcha by direct message or in a channel. While verification is pending, Obelisk stores your user ID, the server ID, the expected answer, the number of attempts, and timestamps. That record is removed when verification ends.
• Honeypot channels: a server can create "trap" channels that ordinary members are told not to post in. If an account posts there, Obelisk assumes it is a spam bot or compromised account. It can ban, soft-ban, kick, or time out the account and delete that account's recent messages across the server (up to 7 days of history). The trap channel names may rotate on a schedule.

3.6 Server configuration and backups

For each server we store its settings: enabled features, channel, role, and user IDs used in allow/deny lists, punishment rules, word and link lists, premium tier, and setup progress. If a server uses the backup feature, we store snapshots of the server's structure: roles, channels, categories, and permission overwrites (which can include individual user IDs). Backups do not include message content.

3.7 Web dashboard accounts and sign-in

• Sign in with Discord (OAuth2): we request the identify and guilds scopes only. From these we receive your Discord user ID, username or display name, and the list of servers you are in, along with your permissions in each. We use that list to show only the servers you are allowed to manage. We do not request your email address. Your Discord access and refresh tokens are stored on our server (not in your browser) and are deleted when you log out. We also remember which server you last selected, keyed by your Discord user ID.
• Username and password accounts: a small number of staff accounts can sign in with a username and password. Passwords are stored only as salted hashes.
• Adding the bot: the "add to server" link uses Discord's bot and applications.commands scopes.
• Cookies: the dashboard uses one essential, signed session cookie to keep you signed in. It is HTTP-only and lasts until you close your browser or log out. We do not use analytics, advertising, or tracking cookies.
• IP addresses: to slow down password guessing, the server temporarily keeps the IP addresses of failed password logins in memory for about 10 minutes. Like most web servers, our hosting may also record standard request logs.

3.8 Operational logs

The bot writes a technical log file used to debug problems. It can include usernames, user, server, and channel IDs, attachment file names, the first part of image links that were checked, and actions taken. We also keep an internal audit trail of settings changes and administrative actions (who changed what, and when). Neither is shared outside the Obelisk team.

3.9 Premium and payments

If a server has premium features, we store its tier (free, premium, or VIP), the source of that tier (manual grant, trial, or a Discord purchase), whether its one-time 7-day trial has been used, and when it expires. We do not receive or store payment card details. Purchases made through Discord are processed by Discord, and Discord tells us only which entitlement a server or user has.

4. Where data is stored

Obelisk's bot, database, files, and dashboard run on a server hosted by DigitalOcean in Toronto, Canada. Data is stored there in files on that server. The Obelisk team is located in the United States, so data may be accessed from the US. By using Obelisk, you understand that your data is processed in Canada and the United States.

5. Third parties

We share the minimum needed with these services:

We do not sell, rent, or share data with advertisers, data brokers, or other monetization services. We may disclose information if required by law, or to protect the safety of users or the service.

6. How long we keep data

When Obelisk is removed from a server: the server's data is kept for 7 days, so an accidental removal can be undone by re-adding the bot. After 7 days, Obelisk automatically deletes that server's settings, moderation records, appeals, detection events, strikes, pending verifications, backups, setup jobs, and uploaded reference images. Server owners and admins can also trigger this deletion immediately from the dashboard.

7. Your choices and deleting your data

• Server owners and admins can remove Obelisk at any time (this starts the 7-day deletion described above), delete data immediately from the dashboard, clear individual moderation records, or turn features off.
• Members can ask for a copy of their data, or ask for it to be corrected or deleted.

To make a data request: email us at the contact address above from any address. Include your Discord user ID, which server(s) the request is about (if known), and what you want: access, correction, or deletion. We may ask you to prove you own the Discord account, for example by sending us a direct message on Discord or a code we provide. We will respond within 30 days. Note that:

• Deleting a moderation record does not undo a ban, kick, or other action a server applied. Ask that server's staff to reverse it.
• We may keep a minimal record when needed to prevent abuse (for example, to stop someone who was banned for spam from wiping the record and repeating it), to comply with law, or to resolve disputes. We'll tell you if that applies.
• Data that Discord itself holds (your messages, account, Discord's own audit log) is controlled by Discord, not by us.

Depending on where you live (for example in the EU/UK, Canada, or certain US states), you may have additional rights, such as objecting to processing or complaining to a data-protection authority. The legal basis for processing is our and server administrators' legitimate interest in keeping communities safe from spam, scams, and abuse.

8. Security

Discord tokens, API keys, and secrets are kept in server-side configuration, not in the code. The dashboard uses HTTPS, signed HTTP-only cookies, hashed passwords, and rate limits on login attempts. Dashboard access is limited by your Discord permissions: you can only see servers where you are the owner or have Administrator or Manage Server permissions. No system is perfectly secure. If we learn of unauthorized access to your data, we will notify affected users and Discord as required.

9. Children

Obelisk is not directed to children. Like Discord, it is only for people who are at least 13 years old, or the minimum age required in their country if that is higher. If you believe a child under that age has provided us data, contact us and we will delete it.

10. Changes to this policy

We may update this policy as Obelisk changes. We will update the effective date above. For significant changes, we will give notice through the dashboard or the bot's support channels. Continuing to use Obelisk after a change means you accept the updated policy.

11. Contact

Questions, data requests, or reports of misuse:

Contact: [email protected]

The Obelisk team