Bot Privacy Policy

Ur Gay Now is a volunteer-run LGBTQ+ community on Discord and VRChat. This policy explains the personal data our Discord bot and this website process, why we need it, and what we do with it. It is written to match what the software actually does — if the implementation changes, this page is updated.

The short version: we collect the minimum needed to moderate the community and to handle reports. We do not sell your data, and we do not use it for marketing.

From the Discord bot

• Your Discord user ID, so the bot can recognise you and apply moderation.
• The Discord server ID of the UGN server.
• Role information, including role IDs and names, used to decide which commands you can run.
• Records of moderation actions, such as who was timed out by whom and why. These exist so staff can review decisions.

From this website

• Reports you submit: the category, your description, the reported person’s name or Discord ID if you provide it, the incident date if you provide it, any links you add, any evidence files you attach, and whether you chose to submit anonymously.
• Optional contact details: your name and email address, only if you provide them and do not submit anonymously.
• Technical data used for abuse prevention: a salted, one-way hash of the IP address a request came from. The raw IP address is not stored in the database. The hash is used to rate-limit submissions and to spot duplicate reports, and it is not used for anything else.
• Cookies: an httpOnly cookie that remembers which reports your browser submitted so you can track them, and a staff session cookie for administrators.
• Support messages: if you contact us through the support form, the details you type plus a generated ticket reference.

• To investigate reports and keep an accurate moderation record.
• To apply and record moderation actions in Discord.
• To prevent spam, abuse, and duplicate submissions.
• To let you follow the status of a report you submitted.
• To answer support requests.

The bot only collects Discord data for members of the UGN server, and only the data needed to run its commands. We do not read, store, or forward the content of your messages. If a moderation command logs a message reference (such as a deleted message ID), that record exists only for staff review.

Reports are confidential. Specifically:

• Only authorised UGN staff can open a report.
• Evidence files you attach have no public URL. They can only be opened through an authenticated staff route, and every time a staff member opens one it is written to the report’s audit trail.
• Internal staff notes are never shown to the person who submitted the report, and never posted to Discord.
• Our staff notification webhook receives only the report reference, category, priority, whether a target was named, how many files and links were attached, and a private link to the dashboard. It does not receive your description, your contact details, or your uploaded files.
• Anonymous reports do not store your name or email, and staff cannot see who sent them. Anonymous does not mean technically untraceable: our hosting and security providers may keep their own technical logs.

Our hosting provider records standard request logs (such as IP address, timestamp, and requested URL) for security and availability purposes. Those logs are controlled by the provider under its own policy and are not used by UGN for marketing. Staff actions inside the admin console are recorded in our own audit logs.

We share data only with the service providers needed to run the community, and only to do their job:

• Hosting and deployment: the provider that serves this website.
• Database provider: stores the community content, staff list, and reports.
• Image storage provider: stores images uploaded for community photos, gallery submissions, and similar site content. Report evidence is not stored with them — it is kept in the database so it cannot be shared by URL.
• Discord: for anything the bot does inside Discord.

We do not sell data, share it for advertising, or hand it to law enforcement except where the law requires it. If we are ever legally compelled to disclose a report, we will tell the affected person unless we are not allowed to.

• Reports are kept as moderation records. Resolved and dismissed reports are not automatically deleted; they remain available to authorised staff for the audit history and are removed only if a staff member deletes them or you ask us to.
• Report resolution data (outcome text and the staff member who closed it) is kept with the report.
• Evidence uploads that are never attached to a report are deleted automatically after 24 hours.
• Rate-limit data (the hashed IP) is kept with the report so duplicate-submission checks keep working.
• Tracking cookies keep the list of reports your browser submitted for up to 180 days. Clearing cookies means you will need your private tracking link instead.
• Support messages are kept as long as they are useful for support and moderation.

There is currently no automated job that deletes closed reports on a timer. If you want a report or its evidence removed, ask us and we will do it.

• Report and admin data is only served to authenticated staff, checked on the server.
• Session and tracking cookies are httpOnly and marked secure in production.
• Secrets such as our Discord webhook URL are stored only in server-side environment variables, never in browser code or public API responses.
• Evidence files are type-checked, size-limited, and stored without a public URL.
• Report submissions are rate-limited and validated on the server.
• Administrative actions are recorded in an audit trail.

You can ask to see, correct, or delete the personal data connected to a report you submitted. Contact staff in Discord or through the support page, and include:

• Your report reference, for example UGN-000123, or
• Your private tracking link, which is the most reliable way for us to find it.

We may ask you to confirm the request before we act on it. We will always try to respond, and we will explain if we cannot delete something — for example, because it is part of a moderation record we are required to keep.

This service is not directed at children under 13, and Discord requires members of our server to meet its minimum age requirement. We do not knowingly collect personal data from children below that age. If you believe a child has submitted a report or created an account in our spaces, tell us and we will deal with it under our safeguarding process.

We use Discord, VRChat, and hosting, database, and storage providers. Their own terms and privacy policies also apply to you when you use those services. We do not control them, and we are not responsible for how they handle data outside the parts they process for us.

If our data practices change, this page is updated and the “last updated” date changes. We will not retroactively weaken a commitment that has already been made about reports you have submitted.

Privacy questions and requests can be sent to UGN staff in Discord or through the support page. Please include a report reference if your question is about a specific report.