Skip to main content
Omniaze
EN
Dashboard Add to Discord

Privacy Policy

What the bot keeps, why, for how long, and how to have it all erased.

Last updated: 17 October 2026

1. Data controller

The data controller is EchoBit, reachable at omniazesupport@gmail.com. Any request concerning your data may be sent to this contact.

2. What the bot does not keep

The bot never records the content of your messages in its database. No attachment, no voice message and no audio content is stored there.

Some modules do read messages, without keeping them. The Hacked accounts module compares a member's messages in memory for a few minutes, to spot a scam copied into several channels. Logs, reports and the starboard copy a message into a channel of your server. When a ticket is closed, a transcript of the conversation is posted in the archive channel. These copies stay on Discord, in the channels you chose.

3. Data processed by the bot

The data below is recorded per Discord server, only for the modules you have enabled. A disabled module writes nothing.

Server configuration

  • Server ID, chosen language, active modules.
  • IDs of the channels and roles you designate in the settings.
  • Text you enter: welcome and goodbye messages, ticket labels and forms, role panels.
  • ID of each server's owner. It is used to apply their global bans, including after an ownership transfer.
  • Background images for the welcome and goodbye messages, if you upload any from the dashboard.

Moderation

  • History of sanctions issued through the bot: ID of the sanctioned member, ID of the moderator, sanction type, reason entered, duration, public code, date.
  • Internal notes attached to a sanction: author's ID and note text.
  • Temporary bans awaiting lifting: member ID, expiry, reason.
  • Global bans issued by an owner with /gban. For each person on the list, the bot keeps the owner's ID, the person's ID, their username at the time of the ban, the reason entered and the date. This list belongs to the owner, not to a server. It applies to every server they own with the bot.
  • Sanction appeals. The bot keeps the person's ID, the text they wrote, the appeal's status, the ID of the staff member who decided it, and the dates.
  • Hacked accounts incidents. The bot keeps the ID of the member concerned, the measure taken, the roles removed and, where applicable, the ID of the person who undid the measure.

Community modules

  • Levels. Member ID, experience points, number of messages counted and date of last activity. That number is a simple counter, the content of the messages is neither read for this purpose nor kept.
  • Tickets. ID of the member who opens the ticket and of the one who handles it, IDs of the related channels, opening and closing dates.
  • Giveaways. IDs of the participants in a draw.
  • Captcha. ID of members awaiting verification and the code of their challenge, erased once the verification is passed or failed.
  • Temporary voice channels. IDs of the channels created, of their owner and of the members banned from a channel.
  • Backups. The server's name, structure (roles, channels, permissions) and settings, the bot's configuration, and the ID of the owner who created it. A backup contains no messages and no members.
  • Invites. ID of the member who joined and of the person who invited them, the invite code, join and leave dates. This data is erased along with the server's, or sooner from the dashboard.
  • Birthdays. Member ID, day and month of birth, and the year if they choose to give it. They can remove it all at any time with /birthday remove.
  • Verification through the site. IDs of verified members and the date of their verification.
  • Starboard. IDs of the highlighted messages and of their authors, and the number of stars received.
  • Live announcements. Twitch and YouTube channels followed, with their public name and avatar, and the announcement message you write.

Apart from the text you enter yourself, the text of an appeal, the usernames copied into global bans and birth dates, the personal data processed is therefore limited to Discord numeric IDs. The bot collects no email address, no IP address and no payment data. The site only sees IP addresses in the cases described below.

4. Data processed by the site

Signing in to the dashboard goes through Discord (OAuth2). There, the site requests two authorisations, your profile (identify) and the list of your servers (guilds). The verification and appeal pages request your profile only. You never type a password on this site.

  • A session is created in the server's memory: Discord ID, display name, avatar, and the Discord access token.
  • The Discord token never leaves the server: the cookie placed in your browser contains only a random, signed session identifier.
  • As this storage is in memory, restarting the site erases all sessions and signs you out.
  • This cookie is strictly necessary for the dashboard to work. The site uses no advertising or analytics cookie.

The site loads no external script, no remote font and no tracker: its content security policy forbids it. The only resources coming from a third-party domain are images: avatars and server icons served by Discord's CDN, and, on the "Live announcements" screen, channel thumbnails served by Twitch and by YouTube. Displaying an image exposes your IP address to whoever serves it.

To protect its public routes from abuse, the site counts requests per IP address. That counter lives in memory, clears itself after a few minutes and is never written to the database. An address that clearly exceeds the normal rate, however, is written to the site's technical log, to spot a bot or an attack.

What the site keeps from your sign-in

Each time you sign in, the site also records the information below in its database. Unlike the session, it does not disappear when the site restarts.

  • Your Discord ID, your username, your display name, your avatar, and the dates of your first and your latest sign-in.
  • Among your servers, those where Omniaze is present, noting whether you own them or hold the “Manage Server” permission there. Your other servers are never recorded.

Only the Omniaze team can see this information. It is used to fight abuse. When the team withdraws an account's access to the service, that account can no longer sign in to the dashboard, and the bot leaves the servers it owns.

Cookies and local storage

The site puts five things in your browser. None of them is there to follow you, here or anywhere else.

  • omz_session: the signed session identifier that keeps you logged in to the dashboard. Seven days.
  • omz_state: an anti-forgery token, for as long as it takes Discord to send you back to the site. Ten minutes.
  • omniaze_lang: the language you picked in the selector. It is only set on that click, never because you followed a friend's link. One year.
  • Your light or dark theme, kept by the browser itself (localStorage) and never sent to the server.
  • Your place on the page when you switch language, forgotten as soon as the tab closes (sessionStorage).

None of these requires your consent. The ePrivacy directive, transposed in France by article 82 of the loi Informatique et Libertés, exempts whatever is strictly necessary to a service you asked for: authentication, security and remembering a preference such as your language all qualify. The site uses no audience measurement, no advertising cookie and no third-party tracker, so you will never be shown a banner asking you to accept anything.

You remain free to delete them from your browser settings, or to block them there. You will then be signed out of the dashboard, and both the language and the theme will fall back to their defaults.

5. Purposes and legal bases

  • Performance of the service: applying to your server the settings you chose, keeping a moderation history, running the enabled modules.
  • Legitimate interest: protecting servers against raids and abuse, diagnosing technical incidents.
  • Preventing abuse: also a legitimate interest. The dashboard sign-in information makes it possible to withdraw access to the service from an account that breaches the terms of use.

No data is used for advertising purposes, resold, or transferred to third parties.

6. Recipients and processors

  • Discord, the platform the bot operates on, subject to its own privacy policy.
  • Host. OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, hosts the bot, the site and the database. Its servers are in France, so the data kept by the bot and the site does not leave the European Union.
  • Audio infrastructure. If the music module is enabled, a relay installed at our host plays back the requested sound. It does not listen in on voice channels and records nothing.
  • Music sources. To find a track, the text of your search is sent to YouTube, Spotify, SoundCloud or Bandcamp. Playback from YouTube also goes through a third-party technical service (cipher.kikkia.dev), which receives no data about you.
  • Lyrics. The /lyrics command sends the title and artist of the current track to LRCLIB (lrclib.net).
  • Live announcements. The bot queries Twitch and YouTube about the channels you follow.

These services, mostly based in the United States, only receive searches, titles and channel names. Your Discord ID is never passed to them.

7. Retention period

  • A server's data is kept for as long as the bot is present there.
  • When the bot leaves a server (or is removed from it), a 7-day grace period applies: an accidental removal or a short outage does not erase your configuration. If the bot is re-invited within that period, everything is found as it was.
  • After those 7 days, an automatic sweep run every 6 hours permanently deletes all data attached to the server, from its configuration to its sanctions, levels, tickets and giveaways.
  • A backup is not erased along with its server, since its very purpose is to rebuild it. It is kept until its owner deletes it, with /backup delete or from the dashboard. Each owner keeps three at most.
  • Dashboard sessions expire by themselves and are lost whenever the site restarts.
  • Dashboard sign-in information is erased 12 months after your latest sign-in.
  • When the team withdraws access to the service from an account or a server, it keeps its ID, its name and the reason for the measure for as long as the measure lasts.
  • A global ban list is kept as long as its owner owns at least one server where the bot is present. Once that is no longer the case, it is permanently deleted 7 days later. If they become the owner of such a server again before then, it is kept.
  • The bot's and the site's technical logs, used to diagnose incidents, are erased after 30 days.

8. Your rights

In accordance with the GDPR, you have a right of access, rectification, erasure, restriction, objection and portability regarding data concerning you. We answer any request within one month.

  • Erasing an entire server: remove the bot from the server. The data will be deleted automatically after the 7-day grace period.
  • Immediate or partial erasure: write to omniazesupport@gmail.com stating the ID of the server concerned. A request targeting a server can only be handled if it comes from someone holding the “Manage Server” permission there.
  • Resetting levels: available directly from the dashboard, for one member or for the whole server.
  • Dashboard sign-in information: to have it erased, write to omniazesupport@gmail.com stating your Discord ID.
  • Global bans. The owner who added a person can remove them at any time with /ungban, which also lifts the bans placed by /gban. A person on a list can send their requests to omniazesupport@gmail.com.

You may also lodge a complaint with the supervisory authority of your country of residence: in France the CNIL, in the United Kingdom the ICO, and in the other countries of the European Economic Area the equivalent national authority. The list is maintained by the EDPB.

9. Security

  • Authorisation to access a server is re-checked with Discord on every request: it is never inferred from what your browser claims.
  • The Discord access token stays server-side and is never exposed to the browser.
  • The session cookie is signed; any tampering makes it invalid.

As no system is infallible, we cannot guarantee absolute security; we undertake to handle any incident diligently.

10. Minors

The Service is aimed at Discord users and follows the platform's age conditions. We do not knowingly collect data concerning people who do not meet the required age in their country of residence.

11. Changes

This policy may evolve alongside the Service. The applicable version is the one published on this page, dated at the top of the document.

12. Contact

For any question or request regarding your data: omniazesupport@gmail.com.