TrinketBot Dashboard

1. Summary

The short version, if you don't read the rest:

We store server configuration (channel IDs, message templates, toggles) for the features you turn on.
Signing in to the dashboard uses Discord OAuth; we never see or store your Discord password.
The only personal access tokens we store are for a TikTok account link, a Patreon link, and the Twitch account the chat bot speaks as (TrinketBot's own, or a TrinketChad streamer's separate bot account — never a streamer's own login) — all encrypted at rest.
Activity-log entries and ticket transcripts are delivered straight to a Discord channel you control, and we don't keep a permanent copy of them. The one thing kept temporarily: if a server turns on message logging, the text of recent messages is held for up to 7 days so edits and deletions can be logged with what was actually said — see Activity logs & ticket transcripts below.
Birthdays are stored as day + month only, once per person rather than once per server — a server that has birthdays switched on can announce the birthday of anyone in it who set one. We never ask for or store a birth year. See Birthdays below.
Leveling, sticky and timed roles, reminders, forms, suggestions, modmail and similar features store a Discord user ID next to the small amount each one needs (an xp total, a role list, a reminder you wrote) — never what someone said in chat — see Leveling, roles, reminders & other member features below.
When an admin saves a change to a module's settings in the dashboard, TrinketBot keeps for 90 days (and for at most the latest 300 changes of a server) that admin's Discord user ID, the module, which settings changed by name, and for the modules where a change can be put back, a snapshot of the module's settings before and after (the server's own configuration, which can name people the admins listed in it), so the change can be put back — see Settings history under Leveling, roles, reminders & other member features below.
If an admin makes a share code (Share a setup, on the Settings page), TrinketBot keeps the settings they chose, with channels and roles as names and no ids and nothing about members, tokens or files, together with the name they gave it and their Discord user ID, for 30 days or until they revoke it — see Server configuration data below.
The exceptions to "we don't store message content": short-lived message copies for servers with message logging on (above), and reporting a message (via the "Report Message" action), which stores that specific message's content so moderators can review the report — see Moderation records below. (Scam Shield, Message Filters and word commands read messages as they arrive and keep none; Scam Shield's alerts can quote up to 1,000 characters of a flagged message in a Discord channel the server chose.)
If TrinketBot is removed from a server, its stored data is deleted automatically — after a 3-day grace period by default, or instantly if that server's admins chose that option in advance — see Retention & deletion below.
You can delete your own dashboard account, and every session signed into it, yourself, at any time, from Settings — no need to contact us for that specifically. An account that hasn't been logged in to for a year and has nothing active is deleted automatically — see Retention & deletion below.
A few features need TrinketBot to hold the broader "Manage Server" Discord permission — Auto Moderation (including Scam Shield's own rule), Server Templates, pausing invites and direct messages, and Invite tracking — see Server configuration data below for exactly which, and what that does and doesn't let it do.
Scam Shield is the one safety feature that is on by default, in every server: it reads each new message to judge whether it looks like a scam and can delete it and time out or ban the sender. Nothing it reads is stored, and a server's admins can switch it off — see Scam Shield below.
Message Filters and word commands read each new message as it arrives to check it for the words and rules you configured, but the message isn't stored — only your configuration is.
If you are a streamer and log in with Twitch to use the chat bot, TrinketBot keeps your Twitch name and picture and what you set up (commands, timers, quotes, events, optional links), but no token of your own Twitch account and none of your chat — see Twitch chat bot (streamers) below. You can delete all of it yourself at any time, and an account that has sat unused for a year is deleted automatically. Events can also be handed to the automations of one Discord server you manage, but only the ones you switch on, one by one. The one thing that stays is a Discord server's own go-live alert for your channel, including one you switched on from your channel page: it belongs to the server.
Auto Moderation rules aren't stored by TrinketBot at all — every view or edit reads from and writes directly to Discord's own API, in the moment.

2. Dashboard account data

Logging in to the web dashboard uses Discord's OAuth login. We receive and store your Discord user ID, username, display name, and avatar hash — the same information your Discord profile already shows to anyone in a shared server. We also record when you last logged in.

At login we take a one-time snapshot of the servers your Discord account belongs to (name, icon, whether you own it, your permission level), so the dashboard can show which servers you're allowed to configure — the servers you own, or where you have the Administrator permission. This snapshot is replaced every time you log in — it's not accumulated into a history — and it's used only to build that list and, on My page (described under Leveling, roles, reminders & other member featuresbelow), the list of servers you and TrinketBot are both in, never to look anything up elsewhere. Your Discord OAuth access token itself is never stored; it's used once, at login, to fetch the information above, and then discarded.

Your dashboard session is a random token stored in an HttpOnly cookie that JavaScript can't read, restricted to same-site requests, and (in production) sent only over HTTPS. We never store that token itself in our database — only a one-way cryptographic hash of it, the same way a password should be stored, so a database compromise alone can't be used to impersonate a session. Sessions expire automatically after 30 days, and expired ones are deleted from the database once a day. We also record each session's browser user-agent string (e.g. "Chrome on Windows") purely so the Settings page can show you a human-readable list of what's currently signed in — never an IP address or precise location. You can review and revoke any of your own sessions individually, or all of them at once, from that page at any time.

This site also keeps two small cookies of its own. The first, trinketbot_known, holds no token and no personal data, only a marker that this browser has signed in to the dashboard, so that opening the site takes you straight to your servers instead of showing the front page first. It is removed when you sign out or when your session ends, and lasts 30 days at most.

The second, trinketbot-lang, holds only the code of the language you chose for the site (such as fi or de), so that the pages can be drawn in it from the first moment. It holds no token and no personal data, lasts one year, and is sent to this site with each page you open. If you never choose, the site uses the language your browser asks for and keeps nothing.

The site also remembers a few choices in your own browser's storage, on your device only, and never sends them to TrinketBot: the light or dark theme and the reduced-motion choice (trinketbot-theme, trinketbot-motion), which rows of the sidebar are open (trinketbot-nav-open-rows), the newest What's new note you have read (trinketbot-whats-new-seen), the emoji you picked lately and your skin tone (trinketbot-emoji-recent, trinketbot-emoji-tone), how far you got in the setup wizard of a server, the kind of server you said it is, which setup steps you put aside or hid there, and whether you finished it (trinketbot-setup- and trinketbot-goals: followed by the server's ID), and that you closed the card about the Twitch chat bot (trinketbot-twitch-chat-bot-card-dismissed). While you sign in, the tab's session storage also holds the time you started, so that a stuck sign-in is not started again at once. Clearing the site's data in your browser removes all of it, and nothing stops working if your browser refuses to keep it.

3. Server configuration data

When a server admin sets up a TrinketBot feature, we store the settings needed to run it: which channel to post in, which role to ping, message and embed templates, and similar configuration. Message templates and any custom text you write into them (e.g. a custom "new video" announcement) are stored as you wrote them so the Bot can reuse them.

A few features store a Discord user ID, because that is the thing being configured. Join Roles can hold a list of specific people (by user ID) who should get extra roles when they join — each entry is removed once its roles have been given, unless the server chooses to keep it, and can be removed by the server at any time. When a server delays join roles, the joining member's ID is kept for the length of that delay and deleted once the roles are given (or the member leaves). Reaction roles, welcome, welcome DM, goodbye, boost and role messages store only settings (channels, roles, templates), not anything about individual members, with one exception: a join message that a server set to wait until the member passes Verification keeps the new member's user ID and the time they joined until they verify, so that the message can be sent then; the note is deleted at that moment (or after 30 days, or with the server's data). The welcome DM is sent to a new member directly through Discord; TrinketBot keeps no copy of it and no record of who received one. A welcome picture or a dynamic image attached to a message is drawn from the member's name and avatar at the moment the message is sent and is not kept; the pictures a server uploads for its own designs are stored for that server, like the pictures in its messages, and are deleted with its data.

Invite tracking, when a server turns it on, records for each person who joins: their Discord user ID, the user ID of the member whose invite they used (if it could be worked out), the invite code, when they joined, and when they left if they did. It exists so the server can see who brings people in and reward them. Bots aren't recorded, and only one record is kept per person — a later join replaces the earlier one. A server can erase all of it at any time with Reset leaderboard on that page, and it is deleted with everything else when TrinketBot is removed from the server (see Retention & deletion). The page's table of links, Where people come from, is worked out from those same records and shows only numbers (how many joined through each invite link, how many are still here and how many left), never who. An admin can also give an invite link a name and a role; that holds no member, only the link's code, the name and the role the admin typed, and it is deleted with the server's data. Nothing more is stored about a person for it. A server's welcome message can say who invited a new member only if its admin writes that into the message.

The staff digest, when a server turns it on, keeps counts and nothing else about activity: for each 15-minute interval, how many people joined and left, and how many messages were sent in each channel (bots excluded). It never stores what was said, who said it, or who joined or left — only the numbers — and it deletes counts after about two weeks. Its settings hold the Discord user IDs of the staff members the admin chose to also receive it by direct message; each is checked to still be in the server before every send, and they can be removed at any time. Two optional sections, Waiting for staff and Handled by the bot, are worked out from the records the server's other modules already keep (how many appeals, tickets and the like are waiting and how old the oldest is, and how many actions the bot took on its own) at the moment the digest is made; they show numbers and times, never what anyone wrote, and nothing for them is stored. Counts and settings are deleted with everything else when TrinketBot is removed from the server (see Retention & deletion). The separate break alerts on the same page, which can message the server's owner, are described under Leveling, roles, reminders & other member features below.

Disable DMs & invites, when a server turns it on, switches on Discord's own Pause DMs and/or Pause invites for the server and sets them again every day. It stores only whether each is on, when the pause it set ends, when it last set it, the latest problem (for example, that TrinketBot lacks the Manage Server permission it needs) and the Discord user ID of the admin who turned it on — nothing about any member or any message. It is deleted with everything else when TrinketBot is removed from the server (see Retention & deletion), and Discord lifts the pause by itself within a day.

The commands a server sets up — its custom slash commands, its word commands, and which of TrinketBot's built-in commands are switched off — are stored as settings (names, words, the actions to run, the message template to reply with, channels and roles), along with the Discord user ID of the admin who created each one. Custom commands are also registered with Discord for that server. A custom command can have options, replies for chosen roles, a counter and the server's variables: the options are only the questions it asks (what a member types into one is used to fill in the reply and is not stored), a reply for a role is the role's ID and a message, the counter is one number for the command (how often it was used, with nobody named), and a variable is a name and a text an admin wrote.

FAQ, when a server's admins switch it on, stores the entries they write: a title, keywords, a category and the message that is the answer, with the Discord user ID of the admin who wrote each one, and their two settings. For each entry it keeps one number, how many times its answer was given, so the admins can see what their members need. That number holds nothing about who asked or when: TrinketBot does not keep which member looked up which entry, and the words a member types into the topic box while searching are used to find entries and are not stored. TrinketBot does not read members' messages to suggest an answer. It is deleted with everything else when TrinketBot is removed from the server (see Retention & deletion). The FAQ's settings and entries are part of the backup an admin downloads, with each entry's title, keywords, category and the name of its answer's message, and never the Discord user ID of the admin who wrote it or the number of times it was answered.

Collectible drops, when a server's admins switch them on, store the settings the admins chose (up to three channels, how far apart drops come, how many a member can catch in a day, and a role and some points for completing a set), the items the admins made (a name, an emoji and a rarity) and the Discord user ID of the admin who saved the settings. For each drop TrinketBot keeps the item, the channel and the message, and the Discord user ID of the member who caught it, for 7 days after it ends. For each member who has caught or been given anything it keeps their Discord user ID, each item they hold and how many, how many drops they caught on the current UTC day, and which sets they were rewarded for. For each trade offer it keeps the two members' user IDs and the two items for 7 days after it ends. TrinketBot knows a channel is busy only by the time in the id of its last message, and does not read any member's messages. A member can erase everything it keeps about them in a server with /collection forget (it asks first, and leaves the messages already posted in the channels, a role they were given and the note of which sets they were rewarded for, member and set only, which is what makes a set pay once and goes with the server's data), and all of it is deleted with everything else when TrinketBot is removed from the server (see Retention & deletion). Drops are not part of a backup.

Polls posted from the dashboard are Discord's own polls — the votes live in Discord, and TrinketBot never sees who voted. To list your recent polls, follow their results and end them early, TrinketBot keeps the newest 50 per server: the channel, the message ID, the question, when it ends and the Discord user ID of the admin who posted it. Events are Discord's own scheduled events, read and written directly in Discord; TrinketBot doesn't keep a copy of them. If you set up reminders for an event, TrinketBot stores what it needs to post them: the event's ID, the channel, the role and message to use, the times to post and the Discord user ID of the admin who set them up. They are deleted when the event is cancelled or deleted, or a while after it has passed.

Sign-ups for an event, which an admin switches on for one event at a time (off for every event until they do), keep for that event: the ID of the event, the channel and the ID of the message TrinketBot posted, the number of places the admin set, the Discord user ID of the admin who switched it on, a random secret that the link to the event's calendar file carries, and the options the admin chose for it (all off until switched on): whether members may answer Maybe, a role to give to the members who have a place, a deadline for signing up, a discussion thread, and whether those going are sent a private message if the event is cancelled. For each member who presses Going it keeps their Discord user ID, in the order they pressed, on the list of those going or, when the event is full, on the waiting list, and for each member who presses Maybe, where the admin offers that answer, on the list of maybes. No name, nickname or picture is stored: the message shows the display names Discord gives at the moment it is drawn. When the admin has chosen a role for those going, TrinketBot gives it to a member who gets a place and takes it back when they give the place up, leave the server, or the event ends or is cancelled; the role is recorded with its end time in the same list as the other timed roles (see Sticky and timed roles below), and is deleted with it. When the admin has chosen the private message, TrinketBot writes once to the first 100 members on the list of those going if the event is cancelled or deleted, and keeps no record of it. A member can always press Not going, which takes their ID off at once, and a member who leaves the server is taken off every list in it. The IDs are deleted 7 days after the event ends or is cancelled, or at once if the admin turns the sign-up off or someone deletes its message or its channel, and with everything else when TrinketBot is removed from the server (see Retention & deletion). A repeating event starts its lists again for each occurrence, and the IDs of the one before are deleted then. The calendar file holds only the event's own title, description, times and place and Discord's link to it, nothing about any member, and anyone who has its link can open it. When a place opens up for the first member of the waiting list, TrinketBot posts one line in the channel that mentions that member. Sign-ups are not part of a backup.

The looking-for-group board keeps, for each group a member looks for, the Discord user ID of the member who posted it, the game they picked, the words they typed (when to play and a note), the Discord user ID of each member who joined together with the display name they had in the server at that moment (it is what the post shows, written as plain text so that nobody is mentioned by it), and when the post was made and when it ended. For an availability poll it keeps who asked, the times they listed and the Discord user ID of each member who pressed each time. A post or a poll is deleted 7 days after it ends, and with everything else when TrinketBot is removed from the server (see Retention & deletion). TrinketBot never reads what members write in the channel. The board's settings and the list of games are in a backup; the posts and the polls are not.

Themes and rhythm stores no information about members. It keeps the server's settings, its themes and the rules of its channels, each with the Discord user ID of the administrator who made it. For each time a theme has run it keeps what the settings it changed held before and what the theme set them to (colours, texts and the IDs of the automation rules, welcome messages and message templates concerned), for 30 days after it ends; for a channel it has closed at set hours, it keeps what @everyone was allowed to do there until the channel is opened again. TrinketBot never reads what members write in a channel. All of it is deleted with everything else when TrinketBot is removed from the server (see Retention & deletion). The settings, the themes and the channel rules are in a backup; what a theme did and what a rule did to a channel are not.

Live boards store no information about members. For each board a server keeps TrinketBot stores which board it is, the channel, how many places it shows, how often it is refreshed, the ID of the message it keeps up to date, a fingerprint of what that message shows (so that it is edited only when the list changed), when it was last looked at and what was wrong, if anything, together with the Discord user ID of the administrator who made it. The names and numbers on a board are read, each time it is drawn, from the module that owns them (levels, points, the Trinket, games, trivia or thanks), left out for anyone that module leaves off its own board, and are kept nowhere. TrinketBot never reads what members write in a channel. All of it is deleted with everything else when TrinketBot is removed from the server (see Retention & deletion). The boards' settings are in a backup; the message and its fingerprint are not.

Predictions, which a server's admins switch on, keep, for each bet a member places, the member's Discord user ID, the outcome they chose, how many points they put on it, what it paid out when the prediction ended and when. For each prediction they keep its question and outcomes, the Discord user ID of the staff member who opened it and of the one who ended it (empty when TrinketBot did), the times it opened, closed and ended, and the sums (the pot, what was paid out, the number of winners and what the rounding left over). The points themselves are the Points feature's own data. A prediction that is over is deleted 90 days after it ended, with its bets, and with everything else when TrinketBot is removed from the server (see Retention & deletion). The settings and the predictions are not part of a backup.

Contests, which a server's admins switch on, keep, for each entry a member makes, the member's Discord user ID, the text or the link they gave (a caption, a note or the link of a clip), the number of the entry, how many votes it has and the place it won. A picture is never stored by TrinketBot: it is uploaded again as a file of TrinketBot's own message in the contest's channel, and stays there in Discord. For each vote, TrinketBot keeps the voter's Discord user ID and the entry they voted for, only so that nobody votes twice and a vote can be taken back; a vote is never shown to anyone, not to the members and not to the server's staff. For each contest it keeps its name, description, channel, times, rules and prizes, and the Discord user ID of the administrator who made it. A member can take their own entries back at any time with /contest withdraw, which deletes them with the votes on them, and a staff member can take an entry down by deleting its message. A contest that is over or cancelled is deleted with its entries and votes after the number of days the server chose (30 unless it changes it, from 7 to 90), and with everything else when TrinketBot is removed from the server (see Retention & deletion). The results message TrinketBot posted in the channel stays in Discord until someone deletes it. Contests are not part of a backup.

The code hunt, which a server's admins switch on, keeps, for each code an administrator adds, its label, the secret code itself, its limits and reward, and the Discord user ID of the administrator who added it; the code is shown to the server's administrators in the dashboard and to nobody else, and is never written to a log. For each code a member redeems, TrinketBot keeps the member's Discord user ID and when they found it, so that nobody finds a code twice and so that a member can see their own finds with /hunt me and the best finders can be listed with /hunt top (which lists the members who are still in the server). A guess that is not a code is not kept: TrinketBot only counts, in memory and for at most a day, how many wrong guesses a member has made, and a restart of TrinketBot forgets it. A find is kept until the server deletes the code it belongs to, until the member asks for their data to be deleted, or until TrinketBot is removed from the server (see Retention & deletion). The code hunt is not part of a backup.

Stream bingo, which a server's admins switch on, is played while a streamer who chose that server is live. For each round TrinketBot keeps the streamer's Twitch account ID and channel name, the squares of the round (the streamer's own written squares and the automatic ones) and when each was called, and the Discord user IDs of the first three members to make a line. For each member who takes a card it keeps their Discord user ID and the squares on their card. Nothing a viewer wrote on Twitch is ever kept or passed on: a square is marked from the kind of event and, for some, a number (the bits of a cheer, the gifts at once, the level of a hype train). A round and its cards are deleted 7 days after the round ends. For the server's board TrinketBot keeps, per member and month, how many rounds they won and how often they were in the first three, for 12 months. A member erases their cards and board rows with Forget my scores in the Activity; everything goes when TrinketBot is removed from the server (see Retention & deletion). The streamer's switch and written squares are kept with their TrinketBot channel account. Stream bingo is not part of a backup.

The question of the day and this-or-that, which a server's admins switch on, post a question or a this-or-that in a channel every day. For each post TrinketBot keeps its text, when it was posted, and for a this-or-that its final counts. When a member votes on a this-or-that, TrinketBot keeps their Discord user ID and the option they pressed, only until the result is shown (a day after it was posted), and then deletes it; that record is what stops a second vote. A post is deleted 90 days after it was made, and with everything else when TrinketBot is removed from the server (see Retention & deletion). A post can open a public thread; TrinketBot only opens it and never reads what is said in it or in the channel. The settings and the items a server wrote are not part of a backup.

Confessions and Ask-me-anything, when a server's admins switch them on, keep the following for that server only. Every confession or question waits for the server's staff, and TrinketBot keeps its words only until it is posted, rejected, taken down or closed (a posted one is then only in the public message, which has no author in it, and the words are deleted from TrinketBot). One that nobody decides on for 14 days is closed and its words are deleted. Alongside the words TrinketBot keeps the Discord user ID of the member who sent it, for 30 days after the decision, so that the staff can act on abuse; after that the ID is cleared by a daily clean-up. That ID is never put in a message, in the dashboard, in a log line or in a backup. It is shown to a member only if the server's admins chose a role that may see authors (with none chosen, nobody can), after a confirmation, and every such reveal is written down, with the Discord user ID of the member who asked and the number of the post (never the author), in a reveal log kept for a year and as a card in the server's moderation log. A member who reports a posted entry has their Discord user ID kept with the report for 30 days (it is what lets a post be reported once by each member), and is never shown to the staff; the staff who decide on a submission or a report are recorded by their user ID. To make the wait and the daily limit work, TrinketBot keeps for each member when they last sent one and how many they sent in the day, with no link to what they sent, and deletes it 2 days after the last. A member can press /confess forget to cut, at once, the link between them and everything they sent in that server (a report keeps its ID for its 30 days); the posted words stay, because they have no author in them. The block list holds the Discord user ID of each blocked member (an entry made by Reject and block is not shown by ID in the dashboard) until the staff take it off, and is not touched by forgetting. An Ask-me-anything session keeps its title, channel, who answers, who opened it and when it ends, for 90 days after it ends; a question asked in a session that shows its askers is posted with the asker's name. Before a text reaches the staff it is held against the server's own filters and Scam Shield, and mentions and invite links in it are made harmless. What is said in the staff's review channel is not copied to the message log. TrinketBot never reads anyone's messages for this: it reads only what a member types into the form. Everything is deleted with the rest of the server's data when TrinketBot is removed from the server (see Retention & deletion), and none of it is part of a backup.

Wrapped, which a server's admins switch on, makes a recap of a member's season, year or all time when the member asks for it, and a recap of the server that is posted in a channel. It reads only what the features described on this page already keep (levels, game scores, trivia answers, badges and thanks, tournament results, invites and the Trinket) for the features the server has switched on, and it stores nothing about members: a recap is worked out when it is asked for, kept for fifteen minutes in the bot's memory, and then forgotten. The one thing it can read that is not about members is the record Live status keeps of finished streams (see Live status above), for a server that has Live status switched on. A member who asked to be left off a leaderboard, or hid their badges, is not named in the server's recap and cannot post their own. When a member shares their recap, or the server posts its own, the card and its text become an ordinary message in the channel. For the server, TrinketBot keeps its settings and one small record for each recap it posted (which period, when, the channel and the message), with no member in it, until TrinketBot is removed from the server (see Retention & deletion). The settings and the records are not part of a backup.

A server's owner and its Administrators (the people who can open its dashboard) can download a backup of it — everything described on this page for that server, as a JSON file, including configuration and history (moderation case history, ticket records, recent notification history, each capped at a few thousand entries) — and later restore it to that server or any other server they manage. Backups never include secrets (no OAuth tokens), the message-report content described under Moderation records below (that stays scoped to your own server's moderators, on purpose, never in a downloadable file), or premium status (tied to the dashboard account that assigned it, not portable between servers by design — see Premium & Patreon in the Documentation), or the Twitch channels streamers have set up to post into the server (those belong to each streamer's own page, and so does what they hand to the server's automations), or where the clip check had got to and which clips it has already posted, or when its weekly most-watched clips post last ran, or the highest viewer count noted for a go-live alert, or the on/off switches of Disable DMs & invites, which change Discord settings for the whole server and so are never switched on by a restore, or the settings history (who changed which setting, below), or, of the break alerts (below), the choice to message the server's owner, how the last message went and which problems were announced (only the on switch and the choice to post in a channel travel, with the Staff digest's settings, so that a restore never starts messaging a person). A backup's case history names the moderator on every case, even when the server hides moderators from other staff on screen with case visibility: that setting changes what the dashboard shows, not what an administrator can download. Once you download a backup file, it exists outside TrinketBot's systems like any other file you save — this policy no longer covers what happens to that copy, so treat it with the same care you'd give any file containing your server's setup and its moderation history.

An admin can also make a share code from chosen parts of a server's settings (Share a setup on the same page), so that an admin of another server can look at it and apply it. TrinketBot keeps, for the code, the settings you chose with their channels and roles as names and without any ids, and the words and links you wrote in them as they are, the name you gave the setup, the Discord user ID of the admin who made it, when it was made, when it ends and how many times it was applied. It holds no member, case, ticket record, token, webhook address or uploaded file, and it never holds the parts that belong to one connected account or one person. Anyone who has the code and manages a server TrinketBot is in can read what it holds. A code is deleted when it expires after 30 days, when an admin revokes it, and with everything else when TrinketBot is removed from the server that made it (see Retention & deletion); what another server applied from it is that server's own setting and stays there.

The same page can also generate a Discord Server Template — a link that recreates a server's channel, category, and role structure. That's a request we make directly to Discord's own API; the resulting template lives on Discord's servers, not ours, and we don't store a copy of it beyond briefly holding the link to hand back to you.

A server's admins can also ask to be listed in the public community directory (/community setup, or the Public listing page on the dashboard). A listing holds the description and categories they wrote, a Discord invite link, and the Discord user IDs of whoever submitted it and, once decided, of the TrinketBot team member who reviewed it, with when, and a reason if it was turned down. Nothing is listed until it has been reviewed, and any edit sends it back for review. What the public page shows for an approved listing is that description, the categories and the invite, together with the server's name, icon and current member count, which TrinketBot reads from Discord when the page is loaded rather than storing. The page needs no login. A server can withdraw its listing at any time, and it is deleted with the rest of the server's data when TrinketBot is removed (see Retention & deletion).

The Auto Moderation page (its own sidebar entry, not part of Settings) manages Discord's own native Auto Moderation rules for a server — spam, keyword, and mention filters that Discord itself detects and enforces. TrinketBot doesn't store any of it: every rule you view or change there is read from and written directly to Discord's API in the moment, the same as editing it in Discord's own Server Settings. There's nothing here to include in a backup, and nothing for this policy to say we retain, because we never have a copy in the first place.

A handful of features need TrinketBot to hold the Manage Server permission in a server — broader than most of what it asks for, which is scoped to specific channels, roles or moderation actions. They are: Auto Moderation(creating and editing Discord's native rules, including the one rule Scam Shield keeps), Server Templates, pausing invites and direct messages (Raid lockdown, where it is optional, and Disable DMs & invites), and Invite tracking (reading a server's invites to see which one a member used). Manage Server would also let TrinketBot see that server's audit log or change server-level settings; our own code uses it only for the features above, never for anything else, and a feature that needs it says so on its dashboard page. A server that added TrinketBot before one of these features existed won't have granted this permission automatically.

4. Live-notification features

Twitch, YouTube, Kick, and Spotify notifications work from public information only — the broadcaster, channel, or artist ID you point the Bot at, and public data those platforms already expose about that account (live status, latest upload, latest release). Setting these up does not require you, or the streamer/creator/artist, to log in or connect a personal account, and we don't store any personal access token for these four platforms. A server's Twitch connection is normally made by its admins by typing the channel's name; a streamer who has linked a Discord account that manages the server can also make it from their own channel page, and then it is the server's connection like any other — see Twitch chat bot (streamers) below.

A server can have TrinketBot tidy a go-live alert once the stream is over, by marking it as ended (with how long the stream ran and, where the platform saved it, a link to the replay) or by deleting it. A new Twitch connection starts on marking it as ended; a Kick or YouTube connection, and a server that connected before, leave it as it is unless the server chose otherwise. The admins can change the choice at any time. To do this TrinketBot checks, from the same public information, whether the stream is still going, and it edits or deletes only its own message; apart from the recap described next, it keeps no more than that it did so, and when.

A server can also have the ended note carry a recap, which is off until its admins switch it on: the highest viewer count TrinketBot saw while the stream was on and, on Twitch only, buttons that open the stream's most-viewed clips. To show the first, TrinketBot reads the platform's public stream information that it reads anyway (Twitch's stream data and Kick's channel information once a minute while the alert is open, and the viewer count YouTube gives with a live video at its regular check) and keeps that one number with the alert's record, only for a server that switched the recap on; it goes with the server's data. The clips are read from Twitch when the alert is edited, shown with the titles their makers gave them, and not stored. No streamer's token is used for either.

A server on Twitch can also have TrinketBot keep a go-live alert up to date while the stream is on, which is off until its admins switch it on. About every five minutes TrinketBot edits the alert's own message to show the stream's current title, category and viewer count, read from the same public stream data it already reads once a minute; none of that is stored. The alert's record keeps only when the next edit may be made, a short fingerprint (a hash, not the text) of what the last edit showed, whether Discord stopped accepting edits of that message and the address of the streamer's public Twitch picture, which the alert shows beside the name. They go with the server's data.

Followed channels let a server follow other Twitch channels besides its own, for the go-live alert only. For each followed channel TrinketBot keeps the channel's public Twitch ID, login and display name; the Discord channel and the role the server chose for its alerts; whether the alerts are on and how an alert ends when the stream does; when it last posted an alert for it, the ID of the stream that alert was for, and the last error (the text of a post that failed); and the Discord user ID of the admin who added it (kept with the follow and not shown on the dashboard). It keeps nothing else about the channel itself: no picture and no statistics. It uses the same public Twitch information as a server's own channel, and no streamer's token. A followed channel is deleted when an admin removes it, or with everything else when TrinketBot is removed from the server (see Retention & deletion). The alerts posted for it are recorded in the server's notification history like any other go-live alert, with the channel's Twitch ID, and stay there after the channel is removed, until the server's data is deleted. The list of followed channels is not part of a backup, but a backup's notification history can carry a followed channel's Twitch ID.

TikTok is the exception: because TikTok notifications require an authorized connection to a specific creator's account, connecting one stores that account's OAuth access and refresh tokens. Those tokens are encrypted at rest (AES-256-GCM, a unique key/tag per token) before they ever touch the database — see Security below. We also store the connected account's public display name and avatar URL, exactly as TikTok's own API returns them.

For a connected TikTok account TrinketBot also keeps a record of each video it has seen — its ID, title and description, its link, the link to its cover picture, how long it is and when it was posted — so a notification can be built from it. A notification is, by default, TikTok's own link and an information card, and nothing is downloaded. Only when a server's admins turn on Play the video in Discord (it is off unless they do) does TrinketBot, to show the video in Discord as a playable video instead of a bare link, downloads the video file from TikTok, attaches it to the post and keeps the file on its own server for up to 14 days, then deletes it. While it is kept the same file can also be fetched, with no login, by anyone who has the link, at /tiktok/<video id>/video.mp4 on TrinketBot's own address, and a small player page for the video is at /tiktok/<video id>. Those addresses only ever serve a video TrinketBot has already seen for a connected account — they cannot be used to fetch anything else. Disconnecting the TikTok account removes its video records; any file copies are gone by the end of the 14 days.

5. Moderation records

Every moderation action taken through TrinketBot (warn, timeout, kick, ban, and their reversals) is recorded as a case: the target's and moderator's Discord user IDs, a username snapshot at the time of the action (for readability — it's never used to look anyone up), the action type, an optional reason text the moderator writes, and duration where applicable. This is the same kind of record most moderation bots keep, and it exists so a server's mod team has a shared history instead of relying on memory or scattered DMs. Automatic actions are recorded the same way when they go through the Moderation module (Message Filters, word commands, Join Guard, Raid lockdown). Scam Shield is the one exception: while a server has switched the Moderation module off — it is on unless an admin turns it off — a timeout or ban Scam Shield carries out is not made into a case, and is recorded instead in the post it makes in the server's alert channel; see Scam Shield below.

A server's admin can also switch on Record actions made in Discord (off until they do, and it needs the View Audit Log permission). Then a ban, kick or timeout that a moderator makes in Discord's own menu is recorded as a case too, from Discord's audit log: the same fields as above, with the moderator's and the member's Discord user IDs, the reason the moderator typed in Discord, and a label saying where it came from. Nobody is messaged about it.

A moderator can pardon a single warning (the case stays on the record, marked as voided, with the pardoning moderator's user ID and the time) and can correct a case's reason (the case then keeps the time and the correcting moderator's user ID, not the words it replaced). The Cases page can export the cases it shows as a CSV file for the moderators who can already see them.

A server can optionally set an immune-roles list (roles moderation actions can't be used against) and a library of reusable, named predefined reasons — both are plain server configuration, covered by Server configuration data above, not personal data about any individual.

User Reports is one of two deliberate exceptions to this policy's "we don't store message content" rule elsewhere on this page (the other is the short-lived message copies used by activity logging, described in Activity logs & ticket transcripts). A server can let members file a report via a slash command, a right-click menu on a member or a message, or by reacting to a message with a chosen emoji — a report always records who filed it, who (or what message) it's about, and a reason: either text the reporter typed, one of the server's predefined reasons, or, for a reaction-filed report, a fixed system reason (reactions can't prompt for typed text). When a report is tied to a specific message, that message's text and attachment links are captured once, at the moment the report is filed — never a running log of anyone's messages. A server can optionally have new reports also posted to a Discord channel it chooses, with an optional role ping; that post goes through Discord like any other message the Bot sends, and isn't additional storage on our side beyond the report record itself. Report content is visible only to that server's moderators (the same dashboard users who could already see moderation cases). The captured text and attachment links of a reported message are deleted as soon as the report is resolved or dismissed, and in any case 90 days after the report was filed; the report record itself (who filed it, who it is about, the reason and how it ended) is kept for as long as the server keeps its moderation records. You can request deletion the same way described in Retention & deletion below. A server can also restrict who's allowed to file a report to specific roles — that restriction, like the immune-roles list above, is plain server configuration, not personal data.

A server can optionally turn on a DM notification sent to a user when they're warned, timed out, kicked, or banned. That message is sent directly to the user and isn't stored anywhere by us — only whether the setting is on or off is configuration we keep. It is only sent to someone who is in the server or whom the server has dealt with before (an earlier case about them): a moderator typing in an ID the server has never met gets the action done, not a message sent in the server's name.

When TrinketBot is added to a server it sends one welcome message to the person who added it (found from the server's audit log when that permission is granted, otherwise the server's owner), with links to get started. The message is sent directly through Discord and isn't stored; the only thing we keep is a timestamp on the server saying it was done, so it is not sent again. Servers that were already using TrinketBot are not sent one.

A server can also set case visibility to hide which specific moderator issued a case from other staff on the dashboard (the case itself, and who it targeted, are still visible to authorized staff either way) — this only changes what's displayed to your own server's moderators, not what we store.

6. Activity logs & ticket transcripts

The activity-logging feature (message edits/deletes, channel/role changes, bans, member joins/leaves) and the ticket transcript feature both work the same way: when the event happens, the Bot reads the relevant content directly from Discord and posts it straight to a Discord channel you've configured — a log channel, or a ticket's transcript channel. Generated transcripts, and the log entries themselves, are not stored in TrinketBot's own database — the only trace kept on our side is whether each feature is enabled and which channel it posts to; the log content lives in your Discord server, subject to Discord's own retention and your own channel permissions. The only other thing kept on our side is, when a feature cannot do its job in a server (it lacks a permission, Discord refused a rule), a short note saying so — the reason, never anything a member wrote — which the dashboard shows that server's admins until the feature works again or they dismiss it, and which is deleted with the server's data. With the Moderation cases category on, each moderation case (its number, the member, the reason and — unless the server's case-visibility setting hides it — the moderator) is posted there the same way; a private moderator note never is.

Two things a server can switch on for its tickets add a destination, and nothing on our side. With Send the transcript to the person who opened the ticket on, when a ticket is closed the Bot also sends that member the transcript as a file, in a direct message from the Bot; the file is made for that moment, goes through Discord to that member only, and is not kept by us. If their direct messages are closed, nothing is sent and the server's log entry says so. With Ask why a ticket is closed on, the person closing a ticket may type a short reason, which is shown in the ticket's closing message, at the top of the transcript made then and in the log entry, and is not stored by us anywhere else. Likewise, a server can give its ticket types an opening form of up to fifteen questions, asked five to a pop-up: the member's answers (and any files they attach) are written by the Bot into the ticket's channel, in a message under the welcome message (more than one for a long form), and are not stored in our database; they stay in those Discord messages for as long as the ticket's channel does. While a member is in the middle of a form of several pop-ups, the pages they have sent are kept in the Bot's memory only, for at most 30 minutes after the last one, and are forgotten when the ticket opens or the Bot restarts. The only thing we keep about a type is which one a ticket was opened from (a short ID), which decides which of the server's roles looks after it, and it is deleted with the ticket and with the server's data.

Two more things a server can switch on for its tickets store a little, and this is exactly what. With Staff can claim a ticket on, the staff member who presses Claim is recorded on that ticket — their Discord user ID and the time — for as long as the ticket's record lives (until the ticket is deleted or the server's data is); the button shows their name in that server, which the Bot reads from Discord and does not keep. With Ask the person who opened a ticket to rate the help on, when a ticket is closed the Bot sends the member who opened it a private message with the numbers 1 to 5. An answer is only counted: the server's data holds, for each ticket type, how many times each number was given, and no member, no ticket and no time is stored with an answer, so an answer cannot be traced to a person. The ticket's record notes only that the question was sent (the time), so that closing and reopening it does not ask again — not what was answered. While a question waits for its answer the Bot also keeps a short random code with the server and the ticket type, so that the answer can be counted once; it holds no member and no ticket, is deleted when the member answers, and any that is still there after 14 days is deleted when the next question is asked. If the member's direct messages are closed nothing is sent and that code is deleted at once. The counts are shown to that server's admins on the Tickets page and are deleted with everything else when TrinketBot is removed from the server (see Retention & deletion). They are not part of a backup.

One deliberate, time-limited exception: message logging. Discord never tells a bot what a deleted message said, so when — and only when — a server has activity logging and its Messages category turned on, the Bot keeps a temporary copy of each new message's text, attachment links, sticker names and embed contents, along with the author's Discord ID and username. It exists for one purpose: so the edit/delete log entry can show what the message actually said. The copy is handled strictly:

Kept for at most 7 days, then deleted automatically. A server's copies are also capped at 100,000: past that the oldest are dropped first, so in a very busy server (or one being flooded) the copies cover a shorter time.
Deleted immediately when the message is deleted, right after the deletion has been logged.
Deleted immediately when the server turns off logging or the Messages category, or adds that member or channel to the logging ignore list — and never stored at all for ignored members, for members who have an ignored role, or for ignored channels.
Never stored for what is said in a modmail conversation or a ticket channel.
Deleted with everything else when TrinketBot is removed from the server (see Retention & deletion).
Never shown anywhere except that server's own log channel, and never used for any other purpose, analytics, or training.

Servers that don't turn on message logging never have any message text stored. Message reporting, described in Moderation records above, is a separate, narrowly-scoped capture.

7. Message Filters & Join Guard

Message Filters (spam, mentions, links, capitalization, and similar rules) works by checking each message against your server's configured rules as it arrives. To detect rate-based behavior — for example, "5 messages in 10 seconds" — the Bot keeps a short-lived, in-memory count of recent message timestamps per member, which is automatically discarded after about an hour and is never written to TrinketBot's database. Matched messages trigger whatever action you've configured (delete, warn, timeout, kick, ban, or an alert), using the same moderation system described in Moderation records above — so an automated warn or timeout from Message Filters shows up in your case history the same way a manual one does. The rules themselves (which categories are enabled, their thresholds, and their exempt roles/channels) are stored in our database like any other server setting; message content itself is not stored beyond the moment it's checked.

Word commands work the same way: each new message is compared with the words a server has set up, as it arrives, and the message text isn't stored. The short cooldown that stops a reply repeating is kept in memory per word and channel — not per person — and is discarded on restart. When a word's actions include a warn, timeout, kick or ban, it uses the same moderation system as a manual action, so it appears in your case history like any other; giving or removing a role and deleting the message happen directly in Discord.

Join Guard checks new members at the moment they join, using only information Discord already sends with the join event — account creation date and whether the member has a custom avatar set. No additional lookups or storage happen beyond your configured settings (minimum account age, avatar requirement, and the action to take); the Bot doesn't retain a history of who was flagged.

Raid lockdown is the one place this part keeps who joined, and only for a server that switches on Remember who joins during a lockdown (it is off until then). While a lockdown is running, the Discord user ID of each member who joins, and the moment they joined, are stored so that the server's staff can time out, kick or ban those members afterwards, with a confirmation first; the members who made up the spike that started an automatic lockdown are stored too. Bots are not. At most the newest 500 are kept for a server, and they are deleted 24 hours after the lockdown ends (earlier for a member the staff have already dealt with, or for everyone when the server switches the setting off; a new lockdown replaces the previous list). Nothing else about them is stored, and a time-out, a kick or a ban made from the list is a case in the server's moderation history like any other (see Moderation records). User IDs pasted into the Ban these ids box of the same page are used to ban those people and are not stored; the cases they make are the record.

8. Scam Shield

Scam Shield is the one safety feature that is on by default in every server — every other module is off until a server's admins turn it on. It is on because scam accounts reach a new server first, and a protection that waits to be set up arrives too late. A server's admins can switch it off completely on its dashboard page.

While it is on, it reads each new message, and each edit, in the channels TrinketBot can see — the way Message Filters do — to judge whether it looks like a scam: lure phrases, links, attachments, whether the same message has appeared in several channels, and how new the sender's account and membership are. The message is not stored. What it holds is in memory only: for each member, a reduced copy of what they posted in the last 15 minutes (at most 40 messages), kept so it can recognise the same message in several channels and delete what a scammer posted in a burst. It is never written to the database and is gone after at most 15 minutes or when the bot restarts. For a link, the domain name alone — never the message, the sender or the server — is looked up in the public RDAP domain registry through rdap.org to see how recently it was registered, and the answer is remembered for a day.

What it can do, in order of confidence:

a message that only looks a little suspicious is posted to the server's alert channel, and nothing is removed;
a likely scam is deleted;
an almost certain scam is deleted, along with what the member posted in the last 15 minutes, and the member is timed out for 24 hours;
only an account that is both brand new and scores very high is banned — and only where staff can review it afterwards: the server has an alert channel TrinketBot can post in, or has the Moderation module on. Otherwise the member is timed out instead.

A server's first 48 hours with Scam Shield are alert-only: it posts what it would have done and removes nothing. A new member's first minutes in a server (ten by default; 1 to 1,440, or off) are a probation in which they can chat but not post other links, invites, files, @everyone or many pings; a message that breaks it is removed and the member is told so in a short note, which mentions them and deletes itself. Members who can manage messages, manage the server or moderate members, and any roles the server marks as trusted, are never checked.

What is kept is settings only, per server: whether it is on, the alert channel, the probation length, the websites the server marked as safe, the trusted roles, when the alert-only start ends and the ID of the Discord rule described below. Nothing is kept per member or per message. An alert posted in the alert channel quotes up to the first 1,000 characters of the flagged message, names its sender and says why it was flagged; it is a normal message the Bot sends through Discord, and TrinketBot keeps no copy. When the Moderation module is on, a timeout or ban Scam Shield carries out is recorded as a case and the member is notified like any other moderation action; when it is off, no case is made, and the action is recorded in the alert post — and, if the server has no alert channel, a brief note in the channel says that a message was removed (naming nobody), which deletes itself.

When Scam Shield is active TrinketBot also keeps one Discord-native Auto Moderation rule, named TrinketBot Scam Shield, in the server, holding only patterns that are a scam on their own. It is written to Discord, not stored by us beyond the rule's ID, and needs the Manage Server permission (see Server configuration data).

9. Birthdays

The birthday feature stores a user's day and month, and the timezone used to determine "today" for them — never a birth year. We also keep a record of which year we last posted a birthday message for someone, purely so the Bot doesn't post twice in one year.

A birthday belongs to the person, not to a server. It is saved once, under the person's Discord user ID, whichever server they set it in, and it is not tied to any server. Every server that has birthdays switched on, and that the person is a member of, can announce it on the day, in that server's own channel and words; to know whether the person is a member, TrinketBot checks each such server by looking the person up by user ID, which does not read the member list. A server's admins can see counts only — how many of their members have set a birthday, and in which months — never who or exactly when, apart from the announcement itself. /birthday remove, or the Remove button of /me, deletes the birthday, and with it every server's ability to announce it. Setting a birthday says this in its confirmation.

Wishes, the birthday role and anniversaries. A server can also put a Send wishes button under a birthday announcement, give the person a role for the day, and announce how long members have been in it. Each is off until a server switches it on, and each is kept per server:

A wish is what a member typed in the form (up to 200 characters), kept with their Discord user ID and the name they had, until 48 hours after the announcement, when it is deleted by TrinketBot's next round; it is also shown under the announcement, in a thread or in a message of the server's own channel, which TrinketBot does not delete. A wish that holds a word of the server's blocked-word list is refused. TrinketBot reads nothing of what anyone else writes in the channel for this.
The birthday role is recorded as a row per person and server: the role, the year, when it is to be taken back and whether it has been. The row is deleted three days after the role was taken back.
Anniversaries are counted from the day a member joined the server, which Discord tells TrinketBot. A milestone that was announced is recorded as a row (the member's user ID and the milestone) for a week, so it is not announced twice. Anyone can ask not to have their milestones announced with the Hide my milestones button under /birthday show: that keeps their Discord user ID, once for every server, until they press Show my milestones.

All of this is deleted with the server's data (see Retention & deletion), except the list of people who hid their milestones, which belongs to the person and is not tied to a server.

10. Leveling, roles, reminders & other member features

Several features keep a small amount of information about individual members, always as a Discord user ID next to just what that feature needs, and never the text of anything said in a chat channel. Each is off until a server turns it on (except your own reminders and timezone, which you set yourself), and the per-server ones are deleted with that server's data — see Retention & deletion.

Leveling — per server and member: their xp, their current streak (days in a row they earned xp) and the last day they did (the server's day: UTC, or the timezone its admins chose for its days on the Games page), and whether they asked to be hidden from the public leaderboard or to be shown on it (/rankprivacy). Once you have xp, the time TrinketBot saw you leave the server is noted too, so you hold no place on the leaderboards while you are away; your xp is kept, and the note is cleared when you return or earn xp again. Xp for chatting and for time in voice is worked out as it happens; neither the messages nor the time spent are kept, only the xp. For the weekly leaderboard (/leaderboard period:week and a Live board) TrinketBot also keeps, for each member who earned xp, how much of it they earned in each of the last eight weeks (a week begins on Monday, UTC): their user ID, the week and the xp. A week is deleted once it is more than eight weeks old, when a server's admins reset that member's or the whole server's xp, and with the server's data. If a server switches on its public leaderboard page, anyone with its link can see the top 100 members' display name, avatar, level and xp — not members who have left, bots, or anyone who chose to be hidden, and, in a server whose page lists only members who choose to be on it (the way a newly set up server starts), only the members who chose to be shown — and the page isn't listed on search engines. When a season ends, the top 25 (member ID and xp) are archived — the last 24 seasons are kept, and the page shows the winners of the last three the same way — until a server's admins delete a season or leveling data. The pictures drawn for /rank and for a server's welcome messages use the member's public Discord avatar, fetched from Discord when the picture is drawn, and aren't stored. A server's community goals are measured from totals that are already there (the xp of the members who are here, how many are at a level, the rounds of Ping-Pong and Snake played) or, for a points-earned goal, from one number for the whole server, the points members have earned since the goal began, which is a sum and holds nobody's share; when a goal that gives a role or points to the members who contributed is reached, TrinketBot notes which members it has paid (their user ID, once each, until the goal is deleted) so nobody is paid twice. The channel xp rules and boost windows a server sets hold no member data.
Sticky and timed roles — for a member who has left, which of the server's chosen roles they held and when they left, kept for the retention time the server sets (1–365 days) or until they return; for a timed role, who has it, which role and when it ends, until it is taken back.
Custom roles — where a server has switched it on, a member can make a role of their own with /myrole. TrinketBot stores, per server and member, the link between their user ID and that role's ID, when it was made, and the day they stopped meeting the server's requirement (or left), which starts the seven days after which the role is deleted. The name and colour live on the role in Discord and aren't copied. The link is deleted with the role (when the member, a moderator or the seven days delete it, or it is deleted in Discord) and with the server's data. To decide who qualifies it looks at the member's level, points balance, roles and whether they boost the server, as they are, and keeps none of it.
Reminders and timezones — these belong to you, not to a server. /timezone stores your timezone; /remindme stores your user ID, the text you wrote, when it is due, and the channel it was asked in (as a fallback if your direct messages are closed), and deletes it once delivered. You can see and cancel your reminders with /reminders and remove your timezone with /timezone at any time; they are not removed when a server removes TrinketBot, because they were never the server's.
Forms — who submitted a form and how it was settled (pending, accepted, denied, and by whom), kept for three months once settled — and nothing they wrote: the answers are posted straight to the server's staff channel through Discord and TrinketBot keeps no copy.
Tournaments — off until a server's admins switch it on. For each tournament, TrinketBot keeps who joined (their Discord user ID and the server name they had when they joined, which the sign-up list and the bracket show, so a member who later leaves still has a name there), their seed, whether they checked in and whether staff disqualified them; for each match, its two players, what each of them said about who won, the winner and how it was decided (by their answers, by staff, by a disqualification or by a bye); the Discord user ID of the staff member who created the tournament and of the one who set a result; and the messages it posted. A player can leave until sign-ups close, which deletes their entry. A finished or cancelled tournament, with its players and matches, is deleted a month after it ends, and when it finishes TrinketBot keeps its result for 12 months: the tournament's name and game, how many played, and the winner and the runner-up with their user IDs and the names they had. Everything is deleted with the rest of the server's data when TrinketBot is removed from the server (see Retention & deletion). The settings are part of a backup; tournaments, players, matches and results never are.
Staff applications — off until a server's admins switch it on. For each application TrinketBot keeps who applied (their Discord user ID), which kind of application it was, what they answered (with the names and addresses of any files they attached), when they applied, each reviewer's vote (the reviewer's Discord user ID and the vote), who decided it (a Discord user ID, or “the votes”), the note the decider wrote to the applicant if there was one, and whether the result message and the role went through. It is kept so that the reviewers can read it and so that the wait after a denial can be counted. It is deleted 90 days after the decision (a clean-up that runs every day), at once if the server deletes that kind of application, and with the rest of the server's data when TrinketBot is removed from the server (see Retention & deletion). Answers typed but not yet sent (an application of more than five questions is sent in pop-ups of five) are held in the bot's memory for up to 30 minutes and are not written to the database. TrinketBot reads nothing from anyone's messages. The settings and the kinds of application are part of a backup; applications, answers and votes never are.
Forum helper — off until a server's admins switch it on. It stores no information about members: the server's settings, the forums it works in and what it does in each, and, for a post it has acted on, the post's ID, the IDs of the messages the helper itself posted there, when a person last wrote in the post (a time, never the words), and when the helper reminded, warned or marked it solved. It reads the post's owner and its last message from Discord when it needs them and keeps neither. It never reads what members write in a post. A post's record is deleted with the post, or 90 days after the post was made, and with the rest of the server's data when TrinketBot is removed from the server (see Retention & deletion). The helper's settings (the switch, the staff role and each forum's rule) are part of the backup an admin downloads; the records of its posts are not.
Suggestions — who made each suggestion, its status, which Discord message it is, and each member's vote (up or down). The suggestion's text lives only in the Discord message.
Modmail — a record of each conversation (which member, which staff channel, open or closed, who closed it, and, if the server switched on Staff can claim a conversation, which staff member claimed it and when) and the list of members a server has blocked from it. Messages are relayed through TrinketBot between the member's direct messages and the private staff channel, and a transcript is posted to a channel the server chose when it closes; TrinketBot keeps none of the message text.
Insights — counts only: messages, joins and leaves per hour, messages per channel per day, and how many of the people who joined on a day have since left. No member, no message and no name is in them, and they are deleted after 90 days.
Live status — which server member is the streamer (a user ID) and which streams are live right now. When a stream ends, a short record of it is kept for 400 days, so the weekly digest and the yearly recap of Wrapped can say how many streams there were, for how long and how many people watched at most: the platform, when the stream began and ended and the highest viewer count seen. It has no title, no chat, no viewer and no person in it, and it is deleted with everything else when TrinketBot is removed from the server. Feeds, the stream schedule, counter channels and setup templates store settings only, with the user ID of the admin who set them up.
Webhooks and automations — a server's admins can have TrinketBot send events (a stream going live, a video, a feed post, a Twitch raid, a new Twitch clip and, if they choose them, a member joining, leaving or levelling up) to a web address they control. The member events carry the member's Discord user ID, username and display name (and, for a level-up, their level and xp); a raid carries the two channels' Twitch names and the number of viewers, and a clip its title, game, length, link and picture and the Twitch name of whoever made it. TrinketBot signs each delivery but can't control what the receiver then does with it, and the server's admins are responsible for choosing one they trust. Automation rules act on the same events inside Discord (posting a message, giving or taking a role) and store only the rules themselves. A rule can also start from an event on a Twitch channel that the streamer chose to hand to the server — see Twitch chat bot (streamers) below. Those events are only ever heard by rules, never sent to a web address.
Brand-new website filter — if a server's admins switch on this message filter, or for any server that has Scam Shield on (it is on by default), the domain name of a link in a message (never the message, the sender or the server) is looked up in the public RDAP domain registry through rdap.org to see when it was registered, and the answer is remembered for a day. Scam Shield asks only about links that are neither well known nor already suspicious, and at most a few per message. The message itself is only read, as every message filter does, to find the link.
Points & shop — if a server's admins switch points on, TrinketBot keeps each member's balance (their Discord user ID and a number), when they last claimed the daily amount and, for the daily streak, how many claims in a row they have made and their longest run in that server (two numbers, deleted with the balance), and counts a message or a minute in voice towards it as it happens (only that it happened — never what was said). Nothing about how the points were earned is kept. Any member can look up another member's balance with a command, or see a list of the ten largest balances in the server (each member's server name and balance, only for members still in the server, shown only to the member who asked); there is no way to opt out of either, because a balance has always been open to every member. Staff with Manage Server can change balances. If a server's admins add rewards (things the staff give by hand), each purchase also keeps an order: the member's Discord user ID, the reward's name, the price paid, when it was ordered and whether it is waiting, done or refunded, and for a finished one when, and the Discord user ID of the staff member who finished it. The order is also posted as a message that names the member in the channel the admins chose for their staff, and the member is told in a private message when it is done or refunded (nothing is kept if their private messages are closed). A finished order is deleted 90 days after it was finished, one still waiting is kept, and all of it is deleted with everything else when TrinketBot is removed from the server (see Retention & deletion). There is no separate button for a member to have their orders deleted sooner: ask using the details at the end of this page. The rewards a server sells and its fulfilment channel are part of a backup; the orders are not.
Recognition (badges and thanks) — if a server's admins switch it on, TrinketBot keeps, for each badge a member has earned, the server's ID, the member's Discord user ID, which achievement it is, the date it was given and, if an admin took it away, the date it was taken away. A season champion's badge of Games is kept the same way even while Recognition is off (see Season champions, below). For each member it keeps how many times they have been thanked in all, whether they chose to hide their badges, and when the helper role was given to them. For each thanks given with /thanks it keeps the server's ID, the Discord user IDs of the member who thanked and the member thanked, and the day and time, for 8 weeks and then deletes it. The reason typed with /thanks is shown once in the message posted in the channel and is not kept. The numbers a badge is judged from (level, points, wins, days in a row, invites, right Trivia answers, tournaments and giveaways won, days of the Lucky Roll, the Trinket's level) are read from the features that already keep them; nothing new is kept for them. Any member can see another member's badges with a command unless that member hid them, and anyone can see who has been thanked the most (only members still in the server, shown as mentions that ping no one). Staff with Manage Server can give a badge or take one away. It is deleted with everything else when TrinketBot is removed from the server (see Retention & deletion).
Trinket — a shared pet, off until a server's admins switch it on. For the server, TrinketBot keeps the Trinket's name, its size in soup bowls, how many meals it has had, what is in its pot, the channel and message it lives in, and the server's settings for it (sleeping hours, the roles to ping and to leave out, whether it takes part in the ranking) and, if its admins set one up, the items its shop sells. For a member it keeps their Discord user ID in up to five places of its own, one point each below (a timed role bought in the shop adds one more, in the server's timed-role list, which the shop point names).
- First, the log of turns: when they cooked or served, what they added and the Trinket's size afterwards, for 400 days; that is how the message can say who cooked and who served, and how many people fed it today.
- Second, the Trinket itself keeps the IDs of whoever is cooking and of whoever cooked and served last, to name them in the message (petting keeps only the time, not who); these stay until a newer turn replaces them, the Trinket hatches again, the member erases them, or the server's data is deleted.
- Third, only if the server's admins switch on caretaker stats (off by default): the member's total number of turns, their turns in each calendar month (UTC), and the dates of their first and latest counted action. A cook and a serve are turns; with levels or coins on, a stir, a seasoning, a taste, a pat, a Wash, a Play, a Tuck in or an answer to an event is counted as an action too, though not as a turn. Unless the bot's owner turns the streak off (it is on by default), the same record also holds the number of days in a row the member cooked or served and the last day that counted (UTC). Counting starts when the admins switch it on, and earlier turns are not counted. A member's total is deleted after 400 days without taking part (cooking or serving, or any other action the Trinket counts for them), and a month's count once that month is more than 12 months back (the current month and the 12 before it are kept), so a member who has left the server keeps these until then. Switching caretaker stats off stops the counting but does not delete what was counted, and it can be turned off only while levels and coins are off; the admins can delete every member's counts, and the XP and coins on the same record if the server keeps them, with Reset caretaker stats, which leaves the log of turns and the IDs on the Trinket alone.
- Third, continued: levels. If the admins also switch on levels (off by default; it needs caretaker stats), each member's row also holds their XP, the XP of each calendar month, the XP earned today (so XP can slow past a daily limit) and, if they chose it, a mark that hides them from the leaderboards. Levels and titles are worked out from the XP. The leaderboard shows members who are in the server and have not hidden themselves; the admins can still see hidden members, marked, on the dashboard. Earlier turns are not converted to XP. /trinket top shows the listed members, with their level and XP, privately to whoever asks, and the dashboard shows the admins every member who is in the server and has XP; the display names and pictures there are read from Discord when the page opens and are not stored. This is deleted after 400 days without taking part (cooking, serving, stirring, seasoning, tasting, patting, looking after the Trinket's needs or answering an event), a month's XP once that month is more than 12 months back, by Forget my data, and by Reset caretaker stats, though a reset keeps only each member's choice to hide from the leaderboards (that choice then lasts 400 days from the reset unless the member takes part again). If the admins also use the Trinket XP feed of Leveling (off by default), the same row holds one more number, how much of the member's XP has already been passed on to Leveling, so that the one-time button for existing XP adds only the rest; it is deleted with the row. The Leveling XP itself belongs to Leveling, under its own rules above, and is not taken back by Forget my data or the reset.
- Third, continued: coins. If the admins switch coins on (off by default; it needs caretaker stats), a coin balance and that day's tally are kept on the same record. They are deleted with it: by Forget my data, by the admins' reset, or after 400 days without taking part. Coins can't be bought, given, traded or cashed out. Admins see only two figures about coins, how many members hold some and one rounded total of them, and only when at least 10 members hold some; never a member's balance. If the admins also switch on the upgrades (off by default; they need coins), a member's coin balance goes down by what they put in, and the server's four upgrade levels, the coins put toward the next level and how many times coins were put in are kept for the server, with no record of who put them in; Forget my data and the admins' reset leave them as they are, and they are deleted with the server's data. The one exception is a member who chooses, with a button of /trinket me, to be thanked by name on the upgrades panel: the total they put in is then kept on their own row, with their other numbers, and shown by name on the panel (never pinging them), until they switch the choice off, use Forget my data or the admins reset the stats; nobody is thanked who did not choose it.
- Third, continued: the shop. If the admins also open the shop (off by default; it needs coins), members can spend coins on roles the admins set up. TrinketBot keeps no list of purchases. While a purchase goes through, the member's record holds the item, its price, a random code and a timestamp until the purchase is settled, which takes a few seconds as a rule (longer if the bot was interrupted, and for as long as Discord cannot say whether the role arrived, because the bot then looks again every five minutes); the code and the timestamp stay until the daily upkeep clears them; all of it is deleted with the record by Forget my data, by the admins' reset, or after 400 days without taking part. A role bought in the shop stays after Forget my data. A timed role also has a record in the server's timed-role list (who has it, which role, when it ends) until it ends, for at most a year and up to 30 days more if Discord will not let TrinketBot take it back; if the server keeps an Activity log, it may post a line about the role being added to its log channel, and Discord's own audit log notes it, and TrinketBot cannot erase those. Nor can it reach short-lived technical logs, which can name the member when a timed role fails to be given or taken back.
- Fourth, the pot's own records. While a pot is on, the Trinket also keeps who stirred, seasoned or tasted it and when. This is kept whether or not the admins keep caretaker stats, and is deleted when the pot is served or the Trinket hatches again, after about a day if nobody serves it, and by Forget my data. Reset caretaker stats leaves it alone, because it belongs to the pot and is not a statistic.
- Fifth, the records of events. Now and then, after a stir, an event (a butterfly, a shooting star or a rainbow) runs on the pot for a couple of minutes. When a member presses its button, the Trinket keeps that they took part in an event, under their Discord user ID, so that each member can answer an event only once. This is kept whether or not the admins keep caretaker stats, and is deleted when the pot is served or the Trinket hatches again, after about a day if nobody serves it, and by Forget my data. Reset caretaker stats leaves it alone, because it belongs to the pot and is not a statistic, and it is not in a backup.
- Sixth, the cosmetics. When a member dresses up their card (/trinket style) or chooses to keep it from /trinket visit (/trinket hide), the Trinket keeps their Discord user ID, the tint and the accessory they chose (one short word for each), the seasonal accessories they have unlocked by wearing them while they were out (a short word for each, none for a member who never did), whether they keep their card to themselves, and the time of their last change. This is kept whether or not the admins keep caretaker stats. Other members see the tint and accessory on /trinket visit and as an emoji by the member's name on /trinket top, unless the member keeps their card to themselves. It is deleted by Forget my data, after 400 days without a change, and with the server's data. Reset caretaker stats leaves it alone, because it is a choice and not a statistic, and it is not in a backup.
- Any member can see their numbers, or erase their own data, with /trinket me and its Forget my data button, which deletes their counts (with the XP, coins and choice to hide on the same record, if the server keeps them), their entries in the log of turns for that server, their stirs, seasonings and tastes and their part in an event on the pot that is on, the tint and accessory they put on their card and their choice about showing it, and their ID on the Trinket, and has the Trinket's message edited so it no longer names them (if Discord refuses the edit, the member is told; if the message is too old to edit it is posted again and Discord is asked to delete the old one, and a server that logs deleted messages may then hold the old text in its log channel). The Trinket's size and meals belong to the server and are not reduced, and neither the reset nor Forget switches counting off, so while caretaker stats are on, a turn taken afterwards is still counted, from the start. Forgetting does not reach copies that a server's own Activity log feature may have kept (up to 7 days, and any line already posted to that server's log channel) or short-lived technical logs. Nor does it take back what a purchase in the shop left: a role bought in the shop stays after Forget my data, and for a timed one the server's timed-role list keeps a record of who has it until it ends, while the line the Activity log feature may have posted when the role was added and Discord's own audit log are out of its reach too. A member who has left the server, or whose server has turned the /trinket command off, cannot open /trinket me: they can ask that server's admins to reset the stats (which deletes the counts, and the XP and coins if the server keeps them), or contact us. The Trinket doesn't read messages (members press buttons), so nothing from anyone's message text is kept. All of it is deleted with the server's data.
- A Trinket's size is used, anonymously, to work out a rank number: its place by size among the Trinkets of the servers that take part, recalculated every ten minutes, and shown as a number in the footer of that Trinket's own message (the footer shows only its place). The server's admins also see, on the Trinket page of the dashboard, how many Trinkets are ranked in all: a count, nothing about any of them. No server name, ID, Trinket name or size is ever shown to another server, and there is no public list. Trinkets nobody has fed for 30 days aren't counted, and a server's admins can turn the ranking off, which hides the line and leaves that Trinket out of everyone's count.
Games — a server's admins can switch on a leaderboard of the Ping-Pong game, which is played as a Discord Activity, for their own server (off until they do). The board is a season, a calendar month in UTC, and a player has one place on it, tied to their Discord account. For each member who scores in a server, TrinketBot keeps, for that server only: their Discord user ID, their best score of all time and when they set it, how many rounds they played, the season of their latest score (its key, such as 2026-10) and their best score of that season and when they reached it, and the same three numbers for the season before that one (its key, their best score of it and when they reached it), which stay on the row for the month after a season ends so that its results can be taken (see Season results, below). It keeps no name, no avatar and no list of rounds in that row: a name is looked up from Discord when the board is shown (the member's nickname in the server, else their Discord name), and a member who has left shows as a former member. A score under 10 is not kept. Only the season's best is shown on the board; the best of all time and the number of rounds are not shown anywhere. An earlier version of the board also kept a best score of the week; those numbers are no longer shown or used, and they are deleted in the same ways as the rest of a member's row, below. To know who is playing, and in which server, the Activity sends the access token Discord gave it, and TrinketBot asks Discord whose it is and whether that person is in the server; the token is never stored or logged, and only a short-lived answer (the member's Discord ID, filed under a hash of the token) is held in memory, for a few minutes. When a player opens the Activity, Discord also asks for one extra permission, rpc.activities.write: with it the Activity can ask Discord to show “Playing Ping Pong against AI” on the player's Discord profile while they are in a round. Whether and how Discord shows it is up to Discord, and nothing about it is sent to or kept by TrinketBot. A round in progress is remembered in memory for at most thirty minutes and is not stored. The Activity's sounds can be muted and their volume set, and those two settings (muted or not, and the volume) are saved only on the player's own device, in the browser's storage under the key trinketbot.activity.sound, and are never sent to TrinketBot. A member's scores are deleted when a server's admins remove them or reset everything (resetting only the season clears the season's numbers and keeps the rest), when the member presses Forget my scores in the Activity (which removes their scores in every server at once), and with everything else when TrinketBot is removed from the server (see Retention & deletion). The game runs in the player's own browser, so a score can be cheated; the boards are for fun. The switches and the scores are not part of a backup. A server's admins can also take a member out of Games on their server (at most 200 members): TrinketBot then keeps, for that server only, the member's Discord user ID and the day they were removed, so that nothing they play there is counted and the boards leave them out, until an admin allows them again. Their scores are not deleted by this. Forget my scores does not delete this entry, because deleting it would lift the removal; it is deleted when an admin allows the member again and with everything else when TrinketBot is removed from the server. To keep a member who has left a server off that server's boards, TrinketBot also keeps, for a server that uses Games, their Discord user ID and the day they left, until they join again, until they press Forget my scores in the Activity, or for 12 months at most; it keeps no name. These entries are not part of a backup either.
Ping-Pong against a friend — part of Games, in the same Discord Activity: in Ping-Pong's menu, Play a friend opens a table where two members take the two seats and the first to 7 points wins, and anyone else in the Activity can watch. It works in a server where Games and Ping-Pong are both switched on. For each pair of members who play each other in a server, TrinketBot keeps, for that server only: the server's ID, the two members' Discord user IDs, each side's number of wins, the number of matches they played and when they last played. It keeps no name, no avatar and no history of single matches or points: a name is looked up from Discord when a record is shown (the member's nickname in the server, else their Discord name), and a member who has left shows as a former member. While a match is played, the Activity sends the position of the player's paddle to TrinketBot's server, which runs the match; that position is not kept, and the match itself lives only in memory and is gone when it ends or when TrinketBot restarts. A pair's record is deleted when a server's admins remove it or reset all of them on the Games page (removing a member's score there also deletes the records that member is in), when either member of the pair presses Forget my scores in the Activity (which removes every record they are in, in every server at once), when the pair has gone 12 months without a match, and with everything else when TrinketBot is removed from the server (see Retention & deletion). To know who is playing, and in which server, the Activity works as it does for the rest of Games: it sends the access token Discord gave it, TrinketBot asks Discord whose it is and whether that person is in the server, and the token is never stored or logged. While a player is at a table, Discord can show “Playing Ping Pong against” and the opponent's name on their profile, and while a member watches, “Watching Ping Pong”, using the same extra permission as the rest of Games; nothing about it is sent to or kept by TrinketBot. The records are not part of a backup.
Trinket Word — the daily five-letter word game that is part of Games, in the same Discord Activity; a server's admins can switch it on or off for their server on the Games page (on once Games is on). Everyone gets the same word each day, and a player has one puzzle a day, tied to their Discord account, whichever server they open the Activity from. For each player and day, TrinketBot keeps their Discord user ID, the day, the guesses they typed for that day's word and for any bonus word (extra words for paid plans, played for fun after the day's word), whether they solved it, how many tries it took and when they finished. For each server where a finished puzzle is shown on a board, it also keeps, for that server only, the player's Discord user ID, the day, the result and when they finished. It keeps no name and no avatar: a name is looked up from Discord when a board is shown (the member's nickname in the server, else their Discord name), and a member who has left shows as a former member. A member sees the daily board only after finishing their own puzzle. All of this is kept for 62 days and then deleted by a daily clean-up; bonus words are deleted after 3 days. A member's Trinket Word data is deleted when a server's admins remove them from the board or reset it (which deletes that server's results; the puzzle itself stays with the member's account until the time above runs out), when the member presses Forget my scores in the Activity (which removes their Ping-Pong scores and, in every server at once, their Trinket Word results and their Trinket Word puzzles of earlier days; today's puzzle stays, so that a day's puzzle cannot be played twice: a finished one is kept without the guesses until the next day's clean-up, and one still being played is left as it is), and with a server's results when TrinketBot is removed from the server (see Retention & deletion). To know who is playing, and in which server, the Activity works as it does for Ping-Pong: it sends the access token Discord gave it, TrinketBot asks Discord whose it is and whether that person is in the server, and the token is never stored or logged. While a player is in the word game, Discord can show “Playing the daily word” on their profile, using the same extra permission as Ping-Pong; nothing about it is sent to or kept by TrinketBot. The results are not part of a backup.
Table games — tic-tac-toe, four in a row and rock-paper-scissors, which are part of Games, in the same Discord Activity: a member picks a game in the Activity's picker, two members take the two seats, and anyone else in the Activity can watch. A server's admins can switch them on or off for their server on the Games page (on once Games is on). For each pair of members who play a game against each other in a server, TrinketBot keeps, for that server only: the server's ID, the game, the two members' Discord user IDs, each side's number of wins, the number of draws, the number of matches they played and when they last played. It keeps no name, no avatar and no history of single matches or moves: a name is looked up from Discord when a record is shown (the member's nickname in the server, else their Discord name), and a member who has left shows as a former member. While a match is played, the Activity sends each move to TrinketBot's server, which runs the match; the moves are not kept, and the match itself lives only in memory and is gone when it ends or when TrinketBot restarts. A pair's record of a game is deleted when a server's admins remove it or reset all of them on the Games page, when either member of the pair presses Forget my scores in the Activity (which removes every record they are in, in every server at once), when the pair has gone 12 months without a match of that game, and with everything else when TrinketBot is removed from the server (see Retention & deletion). To know who is playing, and in which server, the Activity works as it does for the rest of Games: it sends the access token Discord gave it, TrinketBot asks Discord whose it is and whether that person is in the server, and the token is never stored or logged. While a player is at a table, Discord can show “Playing Tic-tac-toe against”, “Playing Four in a row against” or “Playing Rock-paper-scissors against” and the opponent's name on their profile, and while a member watches, “Watching” and the game's name, using the same extra permission as the rest of Games; nothing about it is sent to or kept by TrinketBot. The records are not part of a backup.
Sketch and guess — a drawing game for 3 to 10 players, which is part of Games, in the same Discord Activity; it is off until a server's admins switch it on on the Games page, even where Games is on, and it can only be switched on in a server that has a moderation log channel. While a turn is played, the drawer's drawing is sent to TrinketBot's server as points of lines, which it passes on to the other players and holds in memory for that turn only, until the next turn begins at the longest, so that a player who arrives during the turn sees it and a drawing can still be reported while its word is shown; it is never saved or logged by TrinketBot, it is drawn by TrinketBot only when a player reports it (see below), and it is gone when the next turn begins or when TrinketBot restarts. A guess passes through TrinketBot's server too: it is checked against the word and against the server's own word filters before the other players see it, and it is not kept or logged. The players' points live in memory for the game and nothing is put on a board. TrinketBot does not check drawings: the host of a game can remove a player or skip a drawing, and any player can Report a drawing. A report sends nothing but which turn it is about: TrinketBot draws a picture of the drawing from the points it holds for that turn and posts it at once in the server's moderation log channel with the Discord user IDs of the player who drew it and of the player who reported it, the word and the turn; TrinketBot keeps no copy, and from then on the picture is in that server's channel, under its staff, like the rest of its moderation records. In this game, as in Night in the Grove and the Trivia show, each player's name and the address of their Discord picture (an address on Discord's own servers; it holds their Discord user ID and the picture's hash, which anyone in a shared server can already see) go to the other players of the same game and are never stored or logged. To know who is playing, and in which server, the Activity works as it does for the rest of Games: it sends the access token Discord gave it, TrinketBot asks Discord whose it is and whether that person is in the server, and the token is never stored or logged. Discord can show “Drawing in Sketch and guess”, “Playing Sketch and guess” or “Watching Sketch and guess” and the round on the player's profile, using the same extra permission as the rest of Games, and never the word; nothing about it is sent to or kept by TrinketBot. The switch is not part of a backup.
Snake — a game for one person, which is part of Games, in the same Discord Activity; a server's admins can switch it on or off for their server on the Games page (on once Games is on). Its board works as Ping-Pong's does: a season is a calendar month in UTC, and a player has one place on it, tied to their Discord account. For each member who scores in a server, TrinketBot keeps, for that server only: their Discord user ID, their best Snake score of all time and when they set it, how many rounds they played, the season of their latest score (its key, such as 2026-10) and their best score of that season. It keeps no name, no avatar and no list of rounds: a name is looked up from Discord when the board is shown (the member's nickname in the server, else their Discord name), and a member who has left shows as a former member. A score under 3 is not kept. To check a score, TrinketBot gives each round a random number to start from, and when the round ends the Activity sends TrinketBot the round's moves (the list of turns, the number of steps and the score); TrinketBot plays the round back from that number, keeps the score only if it comes out the same, keeps the moves only in memory for that check and then throws them away. A round in progress is remembered in memory for at most thirty minutes and is not stored. To know who is playing, and in which server, the Activity works as it does for the rest of Games: it sends the access token Discord gave it, TrinketBot asks Discord whose it is and whether that person is in the server, and the token is never stored or logged. While a player is in Snake, Discord can show “Playing Snake” on their profile, using the same extra permission as the rest of Games; nothing about it is sent to or kept by TrinketBot. A member's Snake scores are deleted when a server's admins remove them or reset everything (resetting only the season clears the season's numbers and keeps the rest), when the member presses Forget my scores in the Activity (which removes their scores in every server at once), and with everything else when TrinketBot is removed from the server (see Retention & deletion). The switch and the scores are not part of a backup.
Rare Find — the daily guessing game that is part of Games, in the same Discord Activity: everyone gets the same five prompts each day, and the rarer a player's answer, the more points it scores. A server's admins can switch it on or off for their server on the Games page (on once Games is on). A player has one run a day, tied to their Discord account, whichever server they open the Activity from. For each prompt of a player's run, TrinketBot keeps their Discord user ID, the day, which run it is (the day's run, or a bonus run: extra runs for paid plans, played for fun after the day's run), which prompt it was, whether it is waiting, open, answered or missed, when it was opened and when it ended, how many wrong tries it took and, for an answer that scored, its points, its tier and the name of the answer in the game's list that it matched. What a player types is checked against the game's list and is not kept: a wrong try is only counted. For each server where a finished daily run is shown on a board, it also keeps, for that server only, the player's Discord user ID, the day, the points and when they finished. It keeps no name and no avatar: a name is looked up from Discord when a board is shown (the member's nickname in the server, else their Discord name), and a member who has left shows as a former member. A member sees the daily board only after finishing their own run. The runs and the results are kept for 62 days and then deleted by a daily clean-up; bonus runs are deleted after 3 days. After a prompt has ended, a player can suggest an answer they think the list was missing: TrinketBot keeps the prompt, the text of the suggestion (at most 40 characters) and how many times it was suggested, and no user ID and no server ID, so a suggestion cannot be traced to anyone; it is kept for 90 days after the last time it was suggested and is read only by TrinketBot's owner. To hold a player to five suggestions a day, TrinketBot counts them in memory under their Discord user ID, and that count is not stored. A member's Rare Find data is deleted when a server's admins remove them from the board or reset it (which deletes that server's results; the runs themselves stay with the member's account until the time above runs out), when the member presses Forget my scores in the Activity (which removes, in every server at once, their Rare Find results and their runs of earlier days; today's runs stay, so that a day's prompts cannot be played twice: a finished one is kept without the answers until the next day's clean-up, and one still being played is left as it is), and with a server's results when TrinketBot is removed from the server (see Retention & deletion). A suggestion names no one, so Forget my scores cannot find it; it goes when its 90 days are over. To know who is playing, and in which server, the Activity works as it does for the rest of Games: it sends the access token Discord gave it, TrinketBot asks Discord whose it is and whether that person is in the server, and the token is never stored or logged. While a player is in Rare Find, Discord can show “Playing Rare Find” on their profile, using the same extra permission as the rest of Games; nothing about it is sent to or kept by TrinketBot. The switch and the results are not part of a backup.
Trinket Sweeper — the daily board game that is part of Games, in the same Discord Activity: everyone gets the same board of covered cells each day, some of them hiding a thorn, and a player uncovers the safe ones. A server's admins can switch it on or off for their server on the Games page (on once Games is on). A player has one try a day, tied to their Discord account, whichever server they open the Activity from. The board itself is made by TrinketBot from a number drawn for the day, which names no one. For each player and day, TrinketBot keeps their Discord user ID, the day, which cells they have uncovered, whether they cleared the board or hit a thorn (and which cell that was), and when they uncovered the first cell and the last. The leaves a player puts on cells stay in the Activity on their device and are never sent. For each server where a finished board is shown on a board, it also keeps, for that server only, the player's Discord user ID, the day, whether they cleared it, how many seconds it took and when they finished. It keeps no name and no avatar: a name is looked up from Discord when a board is shown (the member's nickname in the server, else their Discord name), and a member who has left shows as a former member. A member sees the daily board only after finishing their own. All of this is kept for 62 days and then deleted by a daily clean-up. Free play (boards in three sizes, as many as a player likes) is played wholly in the Activity on the player's device, and nothing about it is sent to or kept by TrinketBot. A member's Trinket Sweeper data is deleted when a server's admins remove them from the board or reset it (which deletes that server's results; the board itself stays with the member's account until the time above runs out), when the member presses Forget my scores in the Activity (which removes, in every server at once, their Trinket Sweeper results and their boards of earlier days; today's board stays, so that a day's board cannot be played twice: a finished one is kept without the cells they uncovered until the next day's clean-up, and one still being played is left as it is), and with a server's results when TrinketBot is removed from the server (see Retention & deletion). To know who is playing, and in which server, the Activity works as it does for the rest of Games: it sends the access token Discord gave it, TrinketBot asks Discord whose it is and whether that person is in the server, and the token is never stored or logged. While a player is in Trinket Sweeper, Discord can show “Playing Trinket Sweeper” on their profile, using the same extra permission as the rest of Games; nothing about it is sent to or kept by TrinketBot. The switch and the results are not part of a backup.
Streaks and sharing a score — part of Games, for Trinket Word, Rare Find and Trinket Sweeper, in the same Discord Activity. A streak is the number of days in a row that a player solved the day's word, finished the day's run or cleared the day's board. TrinketBot keeps no streak of its own: it counts the days from the puzzles and runs it already keeps (above), which are kept for 62 days, so a streak is never counted past 62 days and shows as “62+” when it gets there. Bonus words and bonus runs do not count. Because the days are those records, Forget my scores in the Activity, which deletes the earlier days, resets a streak. A server's admins can choose, on the Games page, one channel where members may post their own scores; none is chosen until they do, and the channel's ID is saved with the server's other Games settings and deleted with the server's data. With a channel chosen, a player who has finished the day sees a Share button in the Activity. TrinketBot posts nothing for anyone by itself: only when the player presses the button, and only once a day for each game in each server, it posts one message in that channel with the player's name in the server (their nickname, else their Discord name), the game, the day, their score, their streak when it is 2 days or more, and a row of coloured squares that shows how each guess or each prompt went (Trinket Sweeper's shows the time instead, and no picture of the board). The message never shows the answer, a prompt or anything the player typed. TrinketBot keeps no record of the message: so that the button can be pressed once, it remembers in memory only the player's Discord user ID, the server, the game and the day, for 48 hours, and a restart of TrinketBot forgets that. Once posted, the message is in Discord, under Discord's rules and the server's: the server's admins and moderators can delete it, and because TrinketBot keeps no record of it, it cannot find it again, so Forget my scores cannot remove it. The scores channel is not part of a backup.
Season results — part of Games. When a season (a calendar month in UTC) ends, TrinketBot saves, for each server that has Games on, the top three members of each of Ping-Pong, Snake, Trinket Word, Rare Find and Trinket Sweeper for that month. For each place it keeps, for that server only: the game, the month (its key, such as 2026-09), the place (1 to 3), the member's Discord user ID, their score (their best score of the season, the days they solved the word or cleared the Sweeper board that month, or their Rare Find points that month), the time it was saved, and the name the member had in that server at that moment (their nickname there, else their Discord name, cleaned of invisible characters and cut to 32 characters; “A former member” when they were no longer in the server). This is the one place Games keeps a name: a result is history, so the name stays as it was and does not change when the member renames themselves. A member an admin removed from Games is left out when the places are saved and is hidden when they are shown, and shown again if the admin allows them back; a member who only left the server stays. Only the last three seasons are kept for each game: saving a new one deletes the oldest. The places are shown to the server's admins on the Games page (names and scores) and to members in the Activity, beside the Ping-Pong and Snake boards (names and scores, no ID). If a server's admins switch on Post the results when a season ends and have chosen a scores channel, TrinketBot also posts them there once, in one message that pings nobody, during the first day of the new month; it keeps a short state for each server (the month it last saved, and whether and how often the post was tried), with no member in it. A member's places are deleted when a server's admins remove them from a game's board or reset everything for that game, when the member presses Forget my scores in the Activity (in every server at once; their place is left empty and nobody moves up into it), and with everything else when TrinketBot is removed from the server (see Retention & deletion). A message already posted is in Discord, under Discord's rules and the server's: the server's admins and moderators can delete it, and Forget my scores cannot remove it. The places and the switch are not part of a backup.
Season champions — when the places of a season are saved, the member in first place of each game gets that game's champion badge, which is kept as a Recognition badge (the server's ID, the member's Discord user ID, which badge it is and the date; see Recognition above), whether or not the server has Recognition switched on; it shows only while Recognition is on, and a member who wins the same game again keeps the one badge. If the server's admins chose a champion role, TrinketBot gives it to the season's winners and takes it back from last season's winners who did not win again. To do that it keeps, for each server, one row per current or previous champion: the member's Discord user ID, whether they are a champion of the latest season, which season they last won, which role TrinketBot gave them and has not taken back yet, and when giving or taking it last failed (no name). The row is deleted once the member is no champion and holds no role from TrinketBot. A member an admin removed from Games is never a champion and has the role taken back. Forget my scores ends a member's champion status in every server (the role is taken back and the row deleted; the badge is Recognition's and stays, and a server's admins can take it away there), and everything goes with the server's data when TrinketBot is removed. The rows and the role setting are not part of a backup.
Lucky Roll and activity XP — part of Games, in the same Discord Activity. A server's admins can switch the Lucky Roll on or off for their server on the Games page (on once Games is on), and separately whether the Lucky Roll and the end of every game pay Leveling XP (off until they switch it on). Once a day, in each server, a member can roll a number from 1 to 999,999, which TrinketBot picks; the Activity only plays the animation. For each roll TrinketBot keeps, for that server only: the member's Discord user ID, the day (UTC, or the timezone the server's admins chose for its days), the number, the patterns it hit (which they are, where in the number, and the points each scored), the score (the sum of those points), the Leveling XP that the score's place among all the numbers that could have been rolled is worth, what was actually paid and, if nothing was, why (the XP switch is off, Leveling is off, or an admin removed the member from Games), and the time. These rolls are kept for 62 days. The first time a roll hits a pattern, the member earns a badge: for each badge TrinketBot keeps, for that server only, the member's ID, the pattern, the day and the number of the first hit, how many times it was hit and the day of the last hit; a member's badges in a server are deleted once the last day any of them was hit on is 12 months ago. Some badges are not for a pattern but for what the member has done (rolls made, days in a row, big rolls, finished sets, and the days of the calendar they rolled on), and they are kept the same way. For each member and server TrinketBot also keeps a few counters that those badges and the all-time board are made from: how many times they rolled, their current and their best run of days in a row, their total points, their best score, the most XP any of their rolls was worth, and the first and the last day they rolled. The counters are deleted once the member's last roll in that server is 12 months ago. Names are looked up from Discord when a board or a collection is shown and are not stored. With the XP switched on, a finished game pays a little Leveling XP, and TrinketBot keeps, for each paid session, for that server only: the member's ID, the day, the game, which session it was (the daily game, its number, or the other player's ID in a match against a friend), the XP paid and the time, for 3 days, because those rows are how a daily limit is enforced; the XP itself is added to the member's Leveling total, which is described under Leveling. A member an admin removed from Games rolls for fun: nothing is paid, kept as a badge, counted or shown on a board. A member's rolls, badges and counters are deleted when a server's admins remove them or reset the Lucky Roll on the Games page (a reset of the roll results empties the rolls and sets the points in the counters to zero; a reset of the badges deletes the badges and the counters), when the member presses Forget my scores in the Activity (in every server at once, together with the earlier days of the XP rows), and with everything else when TrinketBot is removed from the server (see Retention & deletion). Today's roll and today's XP rows stay when a member erases or an admin resets, the roll emptied of its number and patterns, so that a roll cannot be erased and made again, or a game paid again, the same day; they are deleted within the retention above. If a member shares their roll, TrinketBot posts the number, the score and where it placed, a comment about it, the most valuable patterns and the member's best five badges once in the scores channel the server's admins chose, in a message that pings nobody; a message already posted is in Discord, under Discord's rules and the server's, and Forget my scores cannot remove it. The rolls, the badges, the counters and the XP rows are not part of a backup.
Trivia — a question of the day and quiz nights, switched on by a server's admins. The questions are the server's own words, or built into TrinketBot, and are not about any member. When a member answers the daily question, TrinketBot keeps for that server their Discord user ID, which answer they pressed, whether it was right and when, only until the question is revealed (a day after it was posted, by default, and at most two days), and then deletes it; that record is what stops a second answer. For each member who has scored, TrinketBot keeps, for that server only, their Discord user ID and, for each month (its key, such as 2026-10), their points, how many answers were right and how many they gave, and their run of right answers to the daily question: its length, the best length and the day of the last question it counted. The daily question's post (the question and how many answered and how many were right, with no member in it) is kept for 90 days. A quiz night is kept for 30 days after it ends: the channel, the Discord user ID of whoever started it, the number of rounds and seconds, the category and the points of each player by user ID as of the last finished round; what a player pressed in a round is only in the bot's memory until the round ends. TrinketBot keeps no name and no avatar: a name is looked up from Discord when a board is shown (the member's nickname in the server, else their Discord name), and a member who has left the server is not listed, though their scores stay until they are deleted. If a server's admins set points for a right answer and switch Points on, a right answer is paid into the member's balance there, which is the Points feature's own data. A member's Trivia data is deleted when the member presses Forget my scores in /trivia me (their scores, run, what they pressed on any question still open and their place in the quiz nights that are kept, in that server only; that they answered a question still open stays until it is revealed, so it cannot be answered and paid a second time), when a server's admins reset all scores on the Trivia page, and with everything else when TrinketBot is removed from the server (see Retention & deletion); the points paid to the Points balance are not taken back. The settings, the questions and the scores are not part of a backup.
Quests — daily and weekly quests and a first-week checklist for new members, switched on by a server's admins. The quests themselves are not stored about anyone: they are worked out from the date and the server's settings. For each member who makes progress, TrinketBot keeps, for that server only, their Discord user ID and, for each quest, the kind, the day or week it is for, how many times they have done it, the number it was asked for and when they claimed it; the days in a row they finished and claimed every daily quest, with the best run and the last day it grew; and, for a member who joined while the first week was on, when they joined, the steps they confirmed with a button and when they finished it. It keeps no name and no avatar, and it never reads what a member writes: it only counts the actions that other features of TrinketBot already record (a soup cooked, a question answered, a round played). Progress is deleted 60 days after it last changed, a streak after 60 days without a new day, and a first week 60 days after the member joined. If a member claims a reward, it is paid into their balance of Points, into their XP in Leveling or as a role, which is those features' own data and is not taken back. A member's Quests data is deleted when the member presses Forget my quest progress in /quests (in that server only), except three small marks that stop a reward being paid a second time: that a quest was claimed in the last eight days (its kind, its day or week, and its count), that a streak grew in the last two days (its length is deleted) and that a first week was finished (its steps are deleted); those go with the daily clean-up, after 60 days at the latest. Everything is deleted with the rest when TrinketBot is removed from the server (see Retention & deletion). When a member joins a server that has the first week on, TrinketBot posts one short line in a channel the server's admins chose that mentions the new member and, if the admins set one, a volunteer chosen at random from a role; it sends no direct message. The settings are part of a backup; what members did is not.
Heads-ups — private messages a member asks for, switched on by a server's admins. A member chooses, with /headsup, which moments to be told about: the Trinket's soup is ready, a trivia game night starts, a tournament opens for sign-ups or their match is ready, the question of the day is posted. For each member who signs up, TrinketBot keeps, for that server only, their Discord user ID and the kinds they chose, and how many heads-ups they were sent on the day (kept for two days at most, to hold to the daily number the server chose). It keeps no name and no avatar, and it never reads what a member writes. The message is sent to the member by direct message and says only a sentence of ours, the server's name and a button that opens the place it is about; TrinketBot keeps no copy of it. A moment that was noted (a soup, a game night, a match) is kept for two days so that it is not told twice, and holds no member except the one a match is about. A member's choices are deleted when they turn a kind off, when they press Stop all from this server (on /headsup or on any message they were sent), when they leave the server, when a message cannot be delivered to them (their direct messages are closed to the server, so their heads-ups there are switched off and not tried again), and with everything else when TrinketBot is removed from the server (see Retention & deletion). A server's admins see how many members chose each kind and never who. The settings are part of a backup; what members chose is not.
Patreon link — if you pledge to TrinketBot on Patreon and connect your Patreon account on the Premium page, TrinketBot stores your Patreon user ID, the name your Patreon profile shows (and the email address on it, if Patreon provides one), whether your membership is active and which tier it is, the access tokens Patreon gives it (encrypted at rest), and which server you assigned your plan to. It reads only your membership of TrinketBot's own Patreon page, nothing about what else you support. Patreon handles the payment itself; TrinketBot never sees a payment method. Disconnecting on the Premium page deletes the Patreon details TrinketBot holds about you, and deleting your dashboard account removes the connection too.
Subscriptions through Discord — if you subscribe to TrinketBot Premium in Discord's own checkout, Discord tells TrinketBot, and TrinketBot stores the entitlement it is sent: your Discord user ID (and the server, for a subscription bought for a server), which subscription, and when it starts and ends. Payment itself is handled entirely by Discord; TrinketBot never sees a payment method.
Ban appeals — if a server's admins switch them on, the message TrinketBot sends a member it bans has an Appeal button. If the member uses it, what they write is sent to the server's staff in a channel the admins chose and is not kept by TrinketBot. TrinketBot stores only that the member (their Discord ID) appealed, when, and how it was decided and by whom — so a second appeal can wait its turn and the admins can see a list — and forgets it six months after the decision.
Admin guard — if a server's admins switch it on, TrinketBot reads the server's audit log as it is written and counts, for a minute and in memory only, how many channels or roles each person deleted, how many members they banned or removed, and how many bots, Administrator roles and webhooks they added. If one count passes the limit the admins set, TrinketBot posts an alert naming that person and, if the admins chose it, takes away that person's roles that carry powerful permissions. Nothing about who did what is stored.
Settings history — each time an admin saves a change to a module's settings in the dashboard, or puts a change back, TrinketBot adds one entry to that server's history, so that the admins can see who changed what and restore it. An entry holds the server's ID, the Discord user ID of the admin who made the change, the module, whether it was a change or a restore, a summary that names which settings changed (for example “Channel, Message”: never a value, at most 300 characters) and the time. For a module where a change can be put back, it also holds a snapshot of that module's settings as they were before the change and as they are after it, in the form a backup holds them. A snapshot is the server's own configuration, so it can include channel IDs, role IDs, web addresses (a feed's, say) and message texts, and the Discord user IDs of people the settings name (an ignored user, say), and never a secret. A snapshot keeps what the setting held at that moment: if an admin later removes an ignored user or a web address from the live setting, the older entries still hold it until they are deleted, and TrinketBot does not go back and edit a snapshot, so a person named in one is not taken out of it when they ask to be forgotten. Snapshots are deleted only by the limits below and with the server's data. For the other modules, and for settings too large to keep, an entry holds the summary only and cannot be put back. It keeps no name: a person's name is looked up from Discord when the list is shown (their nickname in the server, else their Discord name), and someone who has left shows as a former member. Entries are kept for 90 days, and a server keeps at most its latest 300: a daily clean-up deletes the older ones, and a new entry past 300 removes the oldest. The admin's Discord user ID stays in an entry for that time even if their dashboard account is deleted, and there is no button to delete a single entry. The history is shown to anyone who can open the server's dashboard, is deleted with everything else when TrinketBot is removed from the server (see Retention & deletion), and is not part of a backup.
Break alerts — on the Staff Digest page, on unless a server's admins switch them off. While they are on, TrinketBot checks the server's list of problems every five minutes (a deleted channel, a missing permission, a module that cannot reach the channel it was given: the notes the dashboard already shows, which hold a sentence of ours and nothing a member wrote) and tells the server about each one in a short message with a link to the page that fixes it. The admins choose where it goes: the server's log channel (the digest's staff channel when there is no log channel), the server's owner by direct message (off until they switch it on), or both. The direct message is one TrinketBot starts: it goes to the Discord account that owns the server, holds the server's name, the module's name, what is wrong and the link, and pings nobody; TrinketBot keeps no copy of it. For each server TrinketBot keeps the switch, whether to tell a channel in the server, whether to message the owner, how the last attempt went (sent or failed), a short sentence on why when something did not go through (for example that the channel cannot be posted in, or that the owner's direct messages are closed), when it last tried, and when the settings were last saved. To say each problem once, and again only after 24 hours, it also keeps for each problem announced the name of the problem's source (the feature it is about: no member and no message), when it was first seen and when it was last announced; that row is removed when the problem is gone, when the alerts are switched off, and with the server's data. At most five problems are announced for a server in one go. Only the on switch and the choice to post in a channel are part of a backup.
The /me panel — one private message, which only the person who opened it can see, with their level and rank, points, birthday, timezone and reminders in that server and a button to change each, and the Heads-ups they asked for there (read only). It stores nothing of its own: no table and no setting. Each button reads or changes what the command it stands for already does (/rankprivacy, /points daily, /birthday, /timezone, /reminders), kept as described in this section and under Birthdays, and the panel shows level, points and birthday only in a server that has that module switched on.
My page — a page on the website where a member who is logged in with Discord sees their own data in one server: their level and rank, points, Trinket (turns, XP, coins and the style they wear), quests, trivia and games scores and streaks, their Wrapped recap, their badges and thanks, and their birthday (the day and the month). It shows a member only their own data, only for a server they are in, and only for the features that server has switched on, and nobody else can open it: it has no public link and no link to share. Each part is read from the feature that keeps it, as that feature keeps it, so it is kept for the same time as described in this section and under Birthdays; the page stores nothing of its own: no table, no setting and no copy of what it shows (the answer is sent with a mark that tells browsers and caches not to keep it). The list of servers on it is the snapshot taken at login (see Dashboard account data) cut down to the servers TrinketBot is in, and whether a member is in a server is checked in the bot's own list of that server's members, asking Discord when the bot has not seen them there. A member who asked to be left off a leaderboard, hid their badges or was removed from Games still sees their own data here, with a note that they chose it. The Wrapped part can make the member's card as a picture when they ask: it is drawn at that moment, sent to them as a download and not stored, so the member keeps it or shares it themselves. The page only shows: it changes nothing, and a choice is made with the same command as before.
Raids & clips — if a server's admins switch them on, TrinketBot is told by Twitch when the streamer's channel raids or is raided and reads the channel's new clips, and posts a message about each in a channel the admins chose (or, if they switch that card off, hands the raid or clip only to the server's own automations and webhooks, see above). The messages carry what is public on Twitch (channel names, the viewer count, a clip's title and game and the name of the person who clipped it). A clip that TrinketBot's own chat bot makes from a command in the streamer's chat is posted as soon as Twitch has it, instead of with the next check, in every server that follows the channel this way; that card never says who asked for it. Only settings are stored, plus a short note on why the last raid or clip post failed (at most 500 characters), the time up to which clips have been looked at (forgotten when the server's Twitch connection is removed or changed) and, for about a day (25 hours), the ID of each clip already posted in a server's clips channel (or in a streamer's own Discord channel, seeTwitch chat bot (streamers)) together with that channel's ID, so a clip is not posted twice; it is written as the card goes out. All of it is deleted with the server's data.
Most-watched clips — if a server's admins switch on this weekly post (on the same Raids & clips page), TrinketBot reads the Twitch channel's public clips once a week, at the day and hour the admins chose (trying again every few minutes, for up to twelve hours, if that fails), with its own app token, and posts the three with the most views in one message in a channel they chose, with an optional role ping. The message carries what is public on Twitch about each clip (title, picture, view count, game and the name of the person who clipped it). TrinketBot stores the settings (channel, role, day and hour), the moment the latest weekly post was dealt with and the latest problem (at most 500 characters), and nothing of the clips; all of it is deleted with the server's data.
Art & clips — in a channel a server's admins set up for art or clips, TrinketBot reads each message as it arrives to see whether it is a post (a picture, a video or a link), adds a thread and a reaction to it, and removes the ones that aren't; nothing of the message is kept. If the admins switch on the weekly pick, TrinketBot reads the last week of posts in those channels once a week to count the votes (the reactions) and shows the winner in a gallery channel with its poster named. Only the IDs of the messages it has featured (the last 100) are kept, so none is featured twice and a feature can be taken down when its post is deleted — no member ID or content.
Moderation notes and temporary bans — a private note about a member is stored as a moderation case (the note text is visible only to the server's moderators), and a temporary ban records its length so it can be lifted automatically; both are covered by Moderation records above.

If you want something removed that is held for one server, ask that server's admins — they can reset leveling, forget sticky roles, delete suggestions or turn a feature off, and removing TrinketBot deletes it all — or contact us using the details at the end of this page.

11. Twitch chat bot (streamers)

A streamer can log in with Twitch (a separate login from the Discord dashboard's — no Discord account or server is needed) to use TrinketBot's chat bot. This section covers that, including the optional links to Discord and to other tools.

What TrinketBot keeps about the streamer

Their Twitch user ID, login name, display name and the address of their profile picture, when they last logged in, and the list of Twitch permissions they gave TrinketBot (so the page knows which features still need one).
Their sessions: only a hash of each session's token, the browser's user-agent text, and an expiry 30 days after login.
What they set up: whether the bot is on and its command prefix; their commands (name, response, who may use it, cooldowns, how many times each was used, and a counter's value); timers; quotes (the text and the name of whoever added it); each event's settings and wording, where it goes (chat, a Discord channel, a web address, and the automations of the server they chose) and, only if posting it failed, a short note on why.
Who changed a command from chat. If they switch on changing commands from chat, then each time a moderator (or the streamer) adds or changes a command that way, TrinketBot writes that person's Twitch user ID and login name and the time on the command, so the streamer's Commands page can say who changed it last. It is kept for as long as the command exists: it goes with the command when it is deleted, and it is cleared when the streamer saves the command on the dashboard. Only the streamer sees it. The moderator's message itself is not stored.
Channel point rewards they tie to a command: the reward's title as they typed it, and which command it runs. The viewer who redeems a reward is not stored.
A Discord invite link, if they save one for the chat word that says it: the public link (discord.gg/…) and the ID of the server it led to when it was saved. It is not tied to the Discord link, so it stays if they unlink Discord, and it goes when they remove it or delete the channel account. To check that it still works, TrinketBot sends only the invite's code to Discord, with its own bot token.
On the TrinketChad plan, if they use their own bot account: that account's Twitch user ID, login name and display name, and that account's own access token, encrypted (see below). It is the bot account's token, a separate account from the streamer's own.
If they make an overlay for OBS: a hash of its secret key, which alerts they switched on for it, the looks they gave them, the Twitch goal its bar shows and, for each label they switch on, one display name and a time — see The overlay for OBS below.
What they chose for moderation: which moderator commands, filters and lists (blocked words, sites that are always fine) are on, the timeout length, and — only if something was wrong — a one-line note on why the bot couldn't moderate (for example, that it isn't a moderator in the chat).
If they link Discord: their Discord user ID (and when), and the server and channel they chose. The link is used for these things only: to post the channel's events and Twitch log into a server that account manages (and, only for the events they switch it on for, to hand them to that server's automations), to switch on that server's go-live alert from the channel page, to read the plan of that account (see Your plan below), and to show them, on their own pages, which servers that account manages and what is set up there. Whether the account manages a server is asked of Discord each time and is not stored. If they switch on a server's go-live alert from their channel page: that is the server's own, ordinary Twitch connection, the same one its admins make on the dashboard, so it holds the channel's Twitch ID and name, the Discord channel it posts in and, as the person who set it up, the Discord user ID of the account they linked. It belongs to the server, not to the channel account (see Deleting it). If they add a web address: the address and a signing secret, kept as they are because TrinketBot has to use them; the dashboard shows the address's host only, never the address. If they make a key for other tools: only a one-way hash of it — the key itself is held by whatever tool it is pasted into, and can be replaced on the Connect page.

What it does not keep

No token of the streamer's own Twitch account. The one Twitch hands over at login is used once to learn who the streamer is, then dropped. Twitch itself keeps the permissions the streamer gave, and the streamer can withdraw them at any time in Twitch's Settings → Connections. Likewise, linking Discord asks it only who the account is (its “identify” permission) and drops that token at once.
The only Twitch token kept is a bot account's. When TrinketBot's own chat account (or a TrinketChad streamer's own bot account) is authorized, the token Twitch gives is stored encrypted at rest (AES-256-GCM, like the TikTok and Patreon tokens) and renewed when it runs out. It is used for exactly three things that Twitch only does for the account itself: looking up how long someone has followed (a command with the follow-time action, or any command whose reply uses the word for how long the person who asked has followed), making a clip (a command with the clip action), and reading the list of emotes the account can use, so the streamer's emote picker can mark which of their emotes the bot can use (the list is looked at as it arrives and not kept). Everything else the bot does — chatting, and moderating — works with TrinketBot's own app token, using the permission Twitch holds for that account. A streamer's own bot account's token is deleted when the streamer switches back to TrinketBot's account, when they delete their channel account, or when no channel uses it any more; TrinketBot's own account's token stays for as long as TrinketBot runs.
No chat is stored. While the bot is on, Twitch sends TrinketBot the messages written in the streamer's chat so it can find commands, and the events the streamer switched on (a follower's or subscriber's name, a cheer's message, a reward's text). They are looked at as they arrive, used to write a reply, a Discord post, a delivery or a hand-over to a server's automations (see Where it goes), and then forgotten — never stored or logged, with one exception the streamer has to switch on: the display name of the latest follower or subscriber that an overlay label shows (see The overlay for OBS below). The one thing that forwards chat is the streamer's own Twitch log (below), and only if they switch it on. The only counts kept are numbers: how often a command was used, and how many messages chat has had since a timer last spoke (held in memory, lost on restart).
The streamer's schedule is read, not kept. When a message uses the chat word for the next streams, TrinketBot reads the channel's public Twitch schedule with its own app token and holds the answer in memory for a few minutes (up to an hour if Twitch can't be asked again). It is never stored.
Facts about the person who asked are looked up, not kept. When a command's reply uses the words for how long the person who typed it has followed the channel or had their Twitch account, TrinketBot asks Twitch about that one person (their follow, with the bot account's own token; their public profile, with its app token) and holds the answer in memory for a few minutes, at most a few thousand people at a time, so asking twice does not ask Twitch twice. It is lost when TrinketBot restarts and never stored.

The Twitch log (only if the streamer switches it on)

A streamer can have a record of their chat kept in a Discord channel they choose: bans and timeouts (who, by which moderator, how long, why), unbans, deleted messages, cleared chats and, optionally, every chat message with the writer's name. TrinketBot collects those lines in memory for a few seconds and posts them to Discord together; it does not keep them. To show what a deleted message said, the bot holds the text of recent messages in memory for up to 15 minutes — only for a channel that logs deleted messages, never in the database, and lost if TrinketBot restarts. Once posted, the lines live in the streamer's Discord server under Discord's terms and that server's own rules; the streamer decides who can read that channel and is responsible for telling their community. They can be sent to the streamer's web address as well.

The bot as a moderator (only if the streamer switches it on)

A streamer can let the bot act as a moderator in their chat: commands for their moderators (a shoutout, an announcement, a timeout, a ban, an unban, a link permit), a clip and a follow-time command — all of them ordinary commands the streamer adds and words themselves — and filters that remove messages with links, many capitals or symbols, many emotes, repeats or blocked words. It does this through the bot account, which has to be made a moderator in that chat by the streamer, and every action appears in Twitch's own moderation log under the bot account's name (a timeout or ban made through a command also names the moderator who asked, in its reason). To apply the filters the bot reads every message in the chat as it arrives, as it does to find commands; nothing is stored. To warn first and time out on a repeat it remembers, in memory only and for ten minutes, who broke a filter and how often, and for a minute who was allowed to post a link; that is lost on restart. The filters never apply to the streamer or their moderators, and the streamer chooses whether VIPs and subscribers are exempt too.

The streamer can also give their moderators commands that warn a chatter and change the chat's modes (Shield Mode, slow, followers-only, emote-only, subscribers-only). A warning is done at Twitch: the reason typed, with the moderator's name added, is shown to the chatter by Twitch and kept there. TrinketBot keeps nothing of either; if the streamer has a Twitch log, one line names the moderator and, for a warning, the chatter.

The streamer can switch on raid protection: when a raid brings at least the number of viewers they chose, the bot puts the chat in the mode they chose and puts it back after the time they chose, changing only what it changed. So that the chat is put back even if TrinketBot restarts in between, it keeps for each protecting channel, only while the protection lasts, which mode it changed, what that mode was before, how many raiders came and when it ends. No name of a raider or of a viewer is kept. The Discord server the streamer linked gets one line when protection starts and one when it ends; the first names the channel that raided.

The streamer decides the rules and is responsible for them in their own chat, including what the filters remove and whom the commands are used against. A viewer whose message was removed or who was timed out should ask the streamer or their moderators; TrinketBot only carries out what the streamer set up.

Clips made from chat

A clip command makes a public Twitch clip of the live stream, as the bot account. The streamer or one of their moderators can type a title after the command, and it is sent to Twitch as the clip's title: it is public, on Twitch and on any Discord card for the clip. Words from anyone else are not used, and TrinketBot keeps no copy. As soon as Twitch has the clip, TrinketBot also posts a card for it in Discord: in every server that follows the channel with clips switched on in Raids & clips (that card never says who asked), and in the streamer's own Discord channel if they switched on the clip event there. The streamer's own card can say, in a second line, which viewer asked, unless they switch that off; it names no one when the streamer asked or a tool using their key did. The viewer's name is held in memory for that one post, is never put in the clip's title and is not stored.

People in a streamer's chat

A chatter's message is read to see whether it is a command, and the bot's reply may use their Twitch name and what they typed after a command (cut to 100 characters). The same goes for the lines a streamer can switch on for when a viewer shares a watch streak, a moderator has an anniversary or a hype train ends: the line is said once in the streamer's chat, may use the Twitch name, the number of streams or months and the train's level and points, and none of it is kept. If the streamer has switched the Twitch log on, the message — with the chatter's name — is also copied to the streamer's Discord channel. A moderator can save a quote with !quote add, which stores the words as written and the moderator's name; the streamer can see and delete quotes on their page. A viewer who wants something removed can ask the streamer or contact us.

The overlay for OBS (only if the streamer makes one)

A streamer can make an address for an overlay: a page they add to OBS as a browser source, so that their alerts (and, if they switch them on, a goal bar and two labels) show over their stream. The address holds a secret key. TrinketBot keeps only a one-way hash of it, shows the key once when it is made and cannot show it again. Anyone who has the address can open the overlay and see what it shows, so it should be kept private, like a password; the streamer can replace it or remove it at any time, and the old address stops working at once.

What is kept for an overlay: the hash of its key, when it was made and when it was last open (to the hour, written at most once an hour); which alerts the streamer switched on for it; the looks they gave some alerts, as colours, words and seconds the streamer typed (never anything a viewer wrote); and, if the goal bar is on, the streamer's running Twitch goal as Twitch tells TrinketBot of it (its kind, the description the streamer gave it on Twitch, the amounts and times, and whether it was reached), with a note on why Twitch could not be asked when it could not. The goal is forgotten when the bar is switched off or the overlay is removed, and whenever TrinketBot can no longer be sure it is the goal that is running.
The latest follower and the latest subscriber (only if the streamer switches that label on). For each label that is on, TrinketBot keeps one display name and the time of the latest person Twitch told it of: a new follower, or a new subscriber, a person who was given a subscription, or someone who resubscribed with a message. Nothing else about that person is kept: no Twitch user ID, no login name and no list of earlier ones, because the next one replaces it. This is the exception to “No chat is stored” above. It is the name the person chose to show on Twitch, and it is stored so that the overlay can keep showing it, which can be for many hours between two followers. It is shown on the streamer's overlay and nowhere else, and the dashboard is never sent it. It is removed when the streamer switches that label off, removes the overlay or deletes their channel account, and when TrinketBot can no longer be sure it is the latest one (Twitch ended, or TrinketBot had to make again, the subscription that tells it of those people, so some may have come meanwhile).
What only passes through. An alert for the overlay (a viewer's name, an amount, the words they wrote) is sent to the open overlay as it happens. The latest few, at most twenty and none older than a minute, are held in memory so that an overlay that reconnects does not miss one, and are lost when TrinketBot restarts. The list of what became of the latest alerts, which the streamer can read on their Stream page, names the kind of alert and what became of it, never who it was from. None of this is stored.

What an overlay shows is the streamer's choice, and they are responsible for it on their stream. A viewer who does not want their name there should ask the streamer, or contact us.

Where it goes

Twitch delivers the chat and events and carries the bot's replies, as described under Who we share data with.
Discord, when the streamer chose a channel: the event (a name, a count, a short message) is posted there, where it is governed by Discord and that server's own rules. For events, TrinketBot checks, on every post, that the linked account can still manage the server. For the Twitch log, which can post every few seconds, it checks at least once a minute. A go-live alert switched on from the channel page is checked once, when it is switched on, and then belongs to the server: it keeps working until someone who manages the server switches it off, even if the streamer unlinks Discord, loses Manage Server there or deletes their channel account.
The automations of the server they chose, only for the events the streamer switched on for that: follows, new subscriptions, resubscriptions, gifted subscriptions, cheers, hype trains and reward redemptions (raids are not handed over; a server announces those itself). The rules of that server then receive the viewer's Twitch display name where the event has one, the amount (tier, months, gifts, bits, level, reward title and cost) and the channel's name, and can post them in a channel of the server like any other rule — never what a viewer wrote along with it. TrinketBot hands an event over only while a rule there listens for it, and every time it asks Discord whether the account the streamer linked still manages the server. The streamer agrees event by event, can switch one off on the Events page or all of them on the Connect page, and it switches itself off when they choose a different server, or choose one again after the place was removed. It stops at once when they unlink Discord or delete their channel account. What a rule has already posted stays in Discord, and the rules belong to the server.
The server's admins: anyone who manages a server a streamer chose can see, on that server's Twitch page in the dashboard, which Twitch channels post into it — each channel's Twitch name and picture, the Discord channels it posts to, and which events and Twitch log parts are switched on or handed to the server's automations, including whether every chat message is logged. They never see the Discord account the streamer linked. They can remove a channel from the server at any time: the streamer's other settings stay, and the streamer can choose the server again for as long as the account they linked still manages it. Posts sent through a Discord webhook address are not listed, since TrinketBot doesn't know which server they go to.
Your plan: how many commands, timers and quotes a channel may have depends on the plan of the Discord account it is linked to. TrinketBot reads that plan — from the Patreon link, Discord subscription or grant that account has (see Premium & Patreon in the Documentation) — when it needs to, and keeps no copy of it for the channel. With no Discord linked, the channel is simply on the free plan.
The web address, when the streamer added one: each event they switched on is sent there (to Discord as a message, to anything else as signed JSON with the event's values, such as a viewer's name). The streamer chose that receiver and is responsible for it; TrinketBot only refuses addresses inside private networks and doesn't follow redirects.

What the streamer's own pages check

The Overview's Needs attention box and the Check tab of the Connect page look at what is set up and what is wrong: the streamer's settings, whether the bot account is a moderator (asked of Twitch), and, for the servers that follow the channel or get its events, whether TrinketBot can post in the channel chosen and whether the linked Discord account still manages the server (asked of Discord, each time the page is opened). On request, the Check tab looks through every server TrinketBot is in for the ones that account manages and shows only those, with what is set up there for this channel — what those servers' own pages already show to the people who manage them. Nothing is stored for this beyond the short notes about a problem that the events and moderation already keep.

Deleting it

Delete my channel account on the channel page removes everything above in one step, except what a Discord server holds for the channel (see below), and takes the bot out of the streamer's chat. The Discord link, the web address and the key can also be removed on their own on the Connect page; unlinking Discord stops the events being posted to a server, but does not switch off a go-live alert a server holds. A channel account that hasn't logged in for 12 months and isn't doing anything — its bot is off and none of its events is switched on — is deleted automatically, with everything under it; one that is still working for its streamer is kept. Sessions expire after 30 days. Anything not covered by the self-service option can be requested at the address under Contact.

A go-live alert is the server's, not the channel account's. It is the server's own connection to a Twitch channel, the same kind its admins make by typing the channel's name, and it holds the channel's Twitch ID and name, the Discord channel it posts in and the Discord user ID of whoever set it up — for an alert a streamer switched on from their channel page, the account they linked. It stays when the streamer unlinks Discord or deletes their channel account, whether by hand or automatically, until the server's admins disconnect it on the server's Twitch page, or TrinketBot is removed from the server and its data is deleted (see Retention & deletion). The streamer can switch it off from their channel page while that server is the one chosen for their events there and the account they linked still manages it, which stops the posts but leaves the connection in place. To have one removed that you can't reach, ask that server's admins or contact us.

A server also holds what was done with the channel's events: the rules its admins wrote (they are the server's), what those rules and its cards have already posted in Discord, and, for up to 25 hours, the ID of each clip posted in the Discord channel the streamer chose (see Raids & clips above). Deleting the channel account deletes each event's settings and the invite link, so nothing more is handed to a server's automations and the chat word for the invite stops working.

When a server's data is deleted, the Twitch channels that were set to post into that server are removed from it too, and the streamer's page then shows no server chosen. A server's admins can also remove a channel from their server at any time, as described above.

TrinketBot doesn't sell data, and doesn't share it for advertising. Data passes through the following parties strictly because the service can't function without them:

Discord, Inc. — the platform TrinketBot runs on; every feature ultimately reads from or posts to Discord.
Twitch, YouTube (Google), Kick, Spotify, TikTok — read for the notification/account-link features described above, limited to the platform a server actually configures. For a streamer who turns on the chat bot, Twitch also delivers that channel's chat messages and chosen events to TrinketBot and carries the bot's replies back.
The places a streamer chooses to send events — a Discord channel, the automations of one Discord server, and one web address (a Discord webhook, Zapier, Make, n8n or their own server) — which receive only the events the streamer switched on, as described under Twitch chat bot (streamers).
YouTube (Google), only if you press play on our intro video — the landing page and the documentation show the video as a picture of ours with a play button. Nothing is loaded from YouTube until you press it; then the player loads from YouTube's privacy-enhanced domain (youtube-nocookie.com), and YouTube's own privacy policy applies to that viewing.
The sites a server chooses to follow — a blog or RSS address, Reddit or Bluesky — which TrinketBot reads, and the web addresses a server's admins choose to send webhooks to, which receive the events described above. TrinketBot sends them only what those events contain.
The public domain registry (RDAP), through rdap.org — only the domain name of a link, never the message, the sender or the server, for the brand-new website filter and Scam Shield (see Scam Shield).
Our database host — a managed Postgres provider storing the data described on this page.
Our application hosting providers — the servers that run the Bot and the web dashboard.

None of these parties receive data beyond what's necessary to provide the feature it's tied to.

13. Security

TikTok and Patreon OAuth tokens, and the token of a Twitch bot account (see Twitch chat bot (streamers)), are encrypted at rest with AES-256-GCM before being written to the database.
A streamer's session tokens and their key for other tools are never stored in raw form either — only a SHA-256 hash. TrinketBot keeps no token of a streamer's own Twitch login at all. A web address and its signing secret are stored as given (TrinketBot has to use them) and are never shown back in full.
Dashboard session tokens are never stored in raw form — only a SHA-256 hash, so a database read alone can't produce a usable session.
Session cookies are HttpOnly, SameSite-restricted, and Secure (HTTPS-only) in production.
Traffic to the dashboard and API is served over HTTPS.
Login and authentication endpoints are rate-limited to reduce brute-force and abuse risk.

No system is perfectly secure, and we can't guarantee absolute protection against a sufficiently determined attacker — but the design choices above mean that even a raw database copy, on its own, doesn't hand over a working session or a usable TikTok, Patreon or Twitch bot-account token.

14. Retention & deletion

Server configuration is kept for as long as a feature stays set up. Disconnecting an integration (e.g. "Disconnect" on the Twitch or TikTok settings page) removes that feature's configuration; for TikTok specifically, disconnecting a server unlinks it from the TikTok account without deleting the account's tokens outright if another server is still using that same TikTok connection.

If TrinketBot is removed from a server — kicked, or the server deletes it — that server's stored data (every feature's configuration, moderation history and settings history) is deleted automatically 3 days later, unless the Bot rejoins before then. A server's admins can turn on Delete everything the moment TrinketBot leaves in advance, from that server's Data & Privacy settings (reachable from the account menu's Settings page while the Bot is still in the server) — doing so skips the 3-day grace period entirely and deletes on removal, with no way to undo it by re-inviting the Bot afterward. The grace period exists as the safe default specifically so an accidental removal (a moderation bot cleanup, a misclick) doesn't destroy a server's setup for something nobody actually chose.

To see how TrinketBot is growing, two small things are kept about the servers it is added to. When a server added TrinketBot through its one-step add link, a short label of the link, or of the place on this site where it was clicked (such as “website”), is kept with that server's other data and is deleted with it; it names no person. And when TrinketBot is removed from a server, one is added to a count for that day and for the day it had joined, under that label. Those counts hold no server identifier, no name and no person, so they are not deleted with a server, and only the bot's owner can see them.

You can delete your own dashboard account — your login, every session, and any linked Patreon connection — yourself, at any time, from Settings → Danger zone. This never touches any server's data; moderation cases, templates, and everything else still belong to that server, not to the account that happened to configure it.

A dashboard account that hasn't logged in for 12 months and has nothing active is deleted automatically, in the same way. “Nothing active” means no Patreon link that is still in good standing (a lapsed or declined membership doesn't count) and no premium granted to it by hand; the bot owners' accounts are never deleted this way. Only the account itself goes — its sessions, its snapshot of your servers and a lapsed Patreon link — never a server's data, and logging in again simply makes a new account. A daily clean-up deletes at most 100 such accounts a day, and nobody is warned first, since TrinketBot holds no contact details for them. Sessions that have run out are deleted from the database once a day as well. For anything not covered by that self-service option — including a request under the rights described below — contact us using the details at the end of this page and we'll action it manually.

A streamer's channel account — and everything under it — is deleted with Delete my channel account on the channel page, at any time; nothing about it depends on a Discord server. What a server holds for the channel, such as its go-live alert or, for up to 25 hours, the ID of a clip posted in the Discord channel the streamer chose, is the server's and stays until its admins remove it or it expires (see Twitch chat bot (streamers)), and this is so for an automatic deletion too. An account that hasn't logged in for 12 months and whose bot is off, with none of its events switched on, is deleted automatically (a daily clean-up removes at most 100 such accounts a day, and nobody is warned first, as TrinketBot holds no contact details for streamers). Otherwise it is kept for as long as it is in use, and its sessions expire after 30 days. Deleting a channel account also deletes the token kept for its own bot account, unless another channel uses that same account, and a daily clean-up removes any such token that no channel uses.

IP addresses seen on login/authentication requests are used transiently, in memory, purely to rate-limit abusive request patterns — they are never written to our database and are discarded automatically as soon as the rate-limit window they were tracked in expires.

15. Your rights

Depending on where you live, you may have rights over your personal data under laws such as the EU/UK GDPR — including the right to request a copy of what we hold about you, correct it, or have it deleted. Deleting your dashboard account, deleting a Twitch channel account and choosing a server's data-deletion behavior are all self-service, described in Retention & deletion above; a server's admins can also download a copy of that server's configuration themselves at any time as a backup (also described above). For anything else — including a copy of data outside a server backup, or a request about data another server's admins control — contact us using the details below; we'll respond as promptly as we reasonably can. To answer such a request, the person who runs TrinketBot can look an account up by its Discord ID to see which servers hold data about it, in counts and categories only and never what the data says, and can erase it; every lookup and every erasure is recorded, and anonymous features are never linked to an account.

16. Children's privacy

TrinketBot is built for use on Discord, which requires all users to meet Discord's own minimum age requirement (currently 13, or higher where local law requires it). We don't knowingly collect data from anyone below that age beyond what Discord itself already requires them to provide to use the platform at all.

17. Changes to this policy

If this policy changes in a way that meaningfully affects what we collect or how we use it, we'll update the "Last updated" date above. Continuing to use TrinketBot after a change means you accept the updated policy.

18. Contact

Questions about this policy, or requests relating to your data, can be sent to trinketbotapp@gmail.com.

TrinketBot is operated by Claylake Interactive (Finnish business ID 3659997-5), which is the controller of the personal data described on this page. See the Legal Notice for the operator's details. If you are in the EU/EEA and are unhappy with how we handle your data, you can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).

TrinketBot Creators, a separate website for TikTok creators at /creators, has a Privacy Policy of its own. This page does not cover it, and what it stores is not part of the features described here.

Privacy Policy