Privacy Policy

1Who we are

Lunar ("Lunar", "we", "us") is a Discord bot and web dashboard operated by Krislyz. This policy covers the bot, the dashboard at thelunarbot.com, and the related services we run. Lunar may also operate on other community platforms in the future; where it does, this policy applies there too.

Krislyz is an independent developer who builds and runs Lunar. You can find Krislyz on the web at krislyz.com, on GitHub at github.com/krislyz, and on Discord as @krislyz.

Lunar runs on Discord, and your use of Discord is also governed by Discord's own privacy policy and terms. We are not affiliated with or endorsed by Discord.

2What we collect

When you sign in to the dashboard

Signing in uses Discord's standard OAuth flow. We ask Discord for two things: your identity (the identify scope) and your list of servers (the guilds scope). From that we store your Discord user ID, your username, your display name, your avatar reference, and your locale, plus the servers you belong to with your roles and whether you own or administrate each one. We use the server list to show you only the servers you are allowed to manage.

We do not request or store your email address.

Your dashboard session

When you sign in we create a session and set a cookie so you stay signed in. Alongside the session we keep, on a best-effort basis, your IP address and browser user-agent for security and audit purposes. Sessions last up to 30 days and are refreshed as you use the dashboard.

What the bot stores per server

Where a server's admins add Lunar and turn features on, the bot keeps the data those features need, scoped to that server:

• Leveling and activity. Per-member experience and level, the time of last activity, and voice session times. To power leveling and analytics, Lunar records that a message was sent (the server, channel, author, message ID, and time). This activity record does not include the text of your messages.
• Edit and delete logging. When message logging is enabled, Lunar caches recent messages, including their text and attachment details, so that an edit or deletion can show what changed. This cache is short-lived and pruned on a schedule.
• Moderation. Moderation cases (warnings, timeouts, kicks, bans, and tempbans): who was actioned, by whom, the reason, the type, timing, and a case reference. This includes cases imported from a server's existing Discord ban list.
• Case images. Staff who manage a server can attach images to a moderation case as evidence, such as a screenshot of a message. Lunar stores the image, its dimensions and size, the original filename, who uploaded it, and when. Location data is stripped from photos on upload. These images are private to that server and shown only to staff allowed to view the case.
• Server logs. A record of server events worth keeping, such as message edits and deletions, invites, and moderation actions, with the actor and relevant details.
• Configuration you set. Role groups, automod rules, welcome and leave messages, module on/off switches, fun-command settings and any gif links a server adds, and permission grants made from the dashboard.
• Role group breakdowns. If a server uses role groups, Lunar reads which members currently hold which of those roles to show aggregate counts for each group in the dashboard, such as how many members have a given role. It shows totals, not a published list of who holds what, and a server admin is asked to acknowledge this in the dashboard before the feature is turned on for that server.
• Identity cache. So that an ID in a log can be shown as a name, the bot keeps a basic identity record (ID, username, display name, avatar reference) for users it sees post, even if they never sign in to the dashboard.

Operator notifications

So the operator can keep the closed-alpha service healthy, certain events generate a notice to the operator and are recorded in the dashboard: when an approved user signs in, when someone who is not approved tries to, when Lunar is added to or removed from a server, and when permission grants are made. A sign-in notice includes the username and user ID involved.

3How we use it

We use the data above only to provide and operate Lunar: to run the features a server enables, to keep you signed in, to show the right information in the dashboard, to secure the service against abuse, and to let the operator respond to operational events during closed alpha. We rely on our legitimate interest in running the service you asked for, and on Discord's authorization that you grant at sign-in.

4What we never do

• We do not sell, rent, or trade your data.
• We do not show ads, and we do not let anyone pay to influence what Lunar does.
• We do not use your data, your messages, or anything Lunar stores to train, fine-tune, or evaluate AI or machine-learning models.
• We do not share your data with anyone except as described in the next section.

5Sharing and third parties

Lunar is intentionally light on third parties:

• Discord. Lunar is built on Discord, so data necessarily flows to and from Discord to make the bot and sign-in work. Discord's handling of that data is governed by Discord.
• Cloudflare. Traffic to the site passes through Cloudflare, which acts as our content delivery network, reverse proxy, and security layer. To route, cache, and protect requests, Cloudflare processes connection data such as your IP address, and may set strictly-necessary cookies for its security features.
• Our infrastructure. Lunar's application data is stored on infrastructure operated by Krislyz.
• Content delivery. The dashboard loads fonts and icons from public CDNs, and shows Discord avatars from Discord's CDN. Loading those assets exposes your IP address to those providers, as it does on any website.
• Legal. We may disclose data if we are required to by law, or to protect the safety, rights, or property of Lunar, its users, or the public.

Some features still on the roadmap, such as music or an AI you can talk to, would involve sending limited data to a provider to work. We will update this policy and disclose any such provider before a feature that needs it ships.

6How long we keep it

Sessions expire after up to 30 days. The message cache used for edit and delete logging is short-lived and pruned on a schedule. Other per-server data is kept while Lunar is active in that server so the features keep working.

During closed alpha, removing Lunar from a server does not yet automatically erase that server's stored data. If you want a server's data, or your own data, removed, contact us and we will delete it. An automatic cleanup when Lunar leaves a server, and a self-serve opt-out, are planned.

7Your choices and rights

Providing your data to Lunar is your choice: you choose whether to sign in, and a server's admins choose whether to add Lunar and which features to turn on. The trade-off is simply that without the relevant data a given feature, or the dashboard itself, cannot work for you. You can ask us what personal data we hold about you and to review it, ask us to correct it if it is wrong, incomplete, unclear, or out of date, and ask us to delete it, by emailing the address below; on request we can provide the information we hold about you in Hebrew, Arabic, or English. Server admins can already remove much of the per-server data directly from the dashboard, and can remove Lunar from a server at any time. Depending on where you live, you may have additional rights over your personal data, and we will honor valid requests to the extent the law requires.

8Security

We take reasonable measures to protect your data. The dashboard is served over HTTPS, session cookies are HttpOnly, signed, and marked Secure in production, sign-in is gated, and database queries are written to avoid injection. No system can be guaranteed perfectly secure, but we aim to collect little, keep it scoped, and guard it sensibly.

If a security breach affects your data, we will take appropriate steps to address it and provide any notifications required by the law that applies to you. If you think you have found a security problem, please report it through our Security page rather than disclosing it publicly.

9Age

Lunar is used through Discord, and you must meet Discord's minimum age for your country to use Discord at all (13 in many places, higher in some). Lunar is not directed to children under that age, and we do not knowingly collect their data. If you believe a child has provided data to Lunar, contact us and we will remove it.

10Where data is handled

Lunar is operated from Israel, and your data may be processed there and wherever the underlying platforms (such as Discord) operate. By using Lunar you understand your data may be handled in locations outside your own country.

11Changes

While Lunar is in closed alpha, we may update this policy at any time without prior notice, and the updated version applies from the date it is posted. Once Lunar leaves closed alpha, we will give notice of material changes in advance. The "last updated" date at the top always reflects the current version.

12Contact