Privacy policy

Who controls your data

Nighthawk is installed by the people who run a community. That split matters for your rights:

• Community data. For moderation records inside a given server (cases, appeals, notes, activity, message copies), the operators of that server decide what is collected and why. We process it on their behalf and on their instructions.
• Service-wide data. For dashboard accounts, the Shared Watchlist and anti-raid detection, Nighthawk itself decides the purpose and means.

If a request concerns data inside one community, we may need to refer you to that community's operators, or consult them before acting. We will tell you when that happens.

What data we collect and store

Nighthawk collects only what its configured features require. Depending on which features a server enables, that can include:

• Identifiers: Fluxer user, server, channel, message and role IDs, along with usernames and server nicknames.
• Name history: previous usernames and nicknames, with the time they changed.
• Message copies: where moderation features require it, a short-lived copy of message content, attachment metadata and author details. This backs spam cleanup, deleted-message logging and incident replay, and is deleted after 7 days.
• Moderation records: warns, mutes, kicks, bans, timeouts and notes, with the reason given and the moderator responsible.
• Automod events: which rule fired, and the fragment of content that matched it.
• Activity events: joins, leaves, message edits and deletions, used for raid detection and incident reports.
• Appeals: the text you submit, your identifiers, and the staff decision and notes attached to it.
• Verification records: a hashed challenge code or a one-time link token, its status and expiry, and failed attempt counts.
• Persisted state: roles and nicknames stored so they can be restored if you rejoin.
• Server configuration: settings, rules, role groups, channel bindings and reaction-role panels, plus an audit log of staff changes.
• Dashboard accounts: for staff who sign in, the Fluxer account ID, username, avatar, assigned role and sign-in timestamps. We request only the identify and guilds scopes, so we do not receive your email address.
• Connection data: if a server turns on the VPN check, your IP address is examined when you open a verification link. See the Verification section.

We do not collect payment details, government identifiers, or any special category data (health, biometrics, beliefs, and similar). Please do not put such information into an appeal or a moderation note.

Why we need this data

We process this information to run the moderation and utility systems a server has configured, specifically:

Our legal basis. For moderation, safety and abuse prevention we rely on legitimate interests: keeping communities safe and enforcing their rules, balanced against your interests, which is why retention is short and content copies are minimised. For dashboard accounts we rely on performance of a contract with the staff member. Where a server operator turns on an optional feature that goes beyond this, they are responsible for having a basis for it. You can object to processing based on legitimate interests at any time.

How long we keep it

Short-lived data is deleted automatically by a sweep that runs every hour. Records that exist to be a moderation history are kept until they are deleted by staff or on request.

When Nighthawk is removed from a server, everything stored for that server is deleted automatically 30 days later: its settings, moderation cases, name history, persisted roles and nicknames, appeals and their images, tickets, incident reports, logs, anti-raid observations and its encryption keys. The 30 days give a server that removed Nighthawk by mistake time to add it back, which cancels the deletion. If Nighthawk was offline when it was removed, the 30 days start when it next notices. Operators can ask for the data to be deleted sooner.

Three kinds of record outlive that deletion. The server's Shared Watchlist reports are kept but anonymized, as described in the next section. Subscription and payment records belong to whoever pays and are covered above. For a server banned from using Nighthawk, the record of that ban (the server ID and the reason) is kept.

The Shared Watchlist

This is the one feature where information about a user travels beyond the server it came from, so it deserves to be spelled out plainly.

Servers that opt in can report an account for raiding, scams and phishing, child safety, harassment, or malware. A report records the reported account ID, the reporting server, the reporting staff member, a category and a written reason. Other servers that have opted in can then see that an account has been reported, in which category, and with what confidence. Confidence rises when several independent servers report the same account, and safeguards limit how much weight a newly joined server's reports carry.

• Participation is off unless a server enables it. Servers that do not take part neither contribute nor receive.
• A listing is information, not a sentence. Each server decides for itself what to do with it.
• Reports are rate limited, and every report is attributable to the server that filed it.
• When a server's data is deleted, 30 days after Nighthawk leaves it, its reports are kept but anonymized: the reporting server, the staff member who filed the report, the written reason and the link to the server's moderation case are removed, leaving the reported account ID, the category, the status and the date. Nothing that remains says which server filed it. Anonymized reports count for less: each as half a server, and all of an account's anonymized reports together as one server at most. On their own they never make a listing more than low confidence.
• You can dispute a listing. Use the dispute form. Disputes are reviewed by hand, and the message and contact details you provide are end-to-end encrypted so that only the reviewer can read them.

Automated detection and decisions

Nighthawk includes a machine-learning anti-raid system. It scores joining accounts on behavioural signals such as join timing relative to others, account age and profile characteristics. It does not read your messages to do this.

• The default response is an alert to staff, not a removal. A human decides what happens.
• A server may configure a stricter automatic response, up to requiring verification, a timeout, a kick or a ban. Where that is enabled, a decision that removes or silences you can be made without a person reviewing it first.
• You have the right to contest it. Ask for a human to review the decision through that server's appeal form, or contact us. Any moderation action taken this way is recorded as a case with its reason, so it can be examined and reversed.
• Scored observations are stored under a salted, irreversible hash of the account ID rather than the ID itself, and are used to measure and improve accuracy.

AI moderation

A server may switch on AI Moderation. When it is on, the text of messages posted in that server, and image attachments if the server also enables that, are sent to OpenAI's moderation service to be scored for categories such as harassment, threats and sexual content. It is off by default and no server sends anything until an administrator turns it on.

• Not everything is sent. Messages that do not need scoring, such as bot commands, are filtered out before any request leaves the server. Repeated identical text, such as raid spam, is answered from a short-lived local cache rather than being sent again.
• Nothing is stored at OpenAI for training. Content sent to the moderation endpoint is not used to train models. We keep only a per-server count of how many checks were made, never the content or who wrote it.
• This is a transfer outside the EEA. OpenAI processes in the United States under Standard Contractual Clauses.
• Legal basis. Legitimate interests (Art. 6(1)(f)): keeping a community free of abusive content. The server operator decides whether to enable it and is the controller for that choice. You can object, see Your Rights below.
• A score crossing a threshold triggers the same automod pipeline as any other rule, so the automated-decision protections described above apply to it in full, including your right to have a person review the outcome.

Payments and subscriptions

Nighthawk DeepIntel is an optional paid plan that raises one server's AI Moderation allowance. This section only concerns people who buy it. Nothing here applies to members of a server.

• We never see your card. Payment details are entered directly into a form served by Stripe and are transmitted to Stripe, not to us. We do not store, log or have any means of retrieving a card number.
• Checkout asks for an address. Stripe collects it and Stripe keeps it; it is never sent to us and we have no copy of it. Nothing is shipped to you. It is there because Stripe will not offer Google Pay on a checkout that calculates VAT automatically unless the address field is present, and Stripe uses the same address to work out which country's VAT rate applies.
• What we store: your Fluxer account ID, the Stripe customer and subscription IDs, which server the plan applies to, the plan status and renewal date, and the billing email address you gave Stripe at checkout. That email is the only one we hold, and we use it solely to tell you about your subscription when a direct message cannot reach you.
• What we never send to Stripe: message content, member lists, moderation records, or anything about the people in your server. The only identifiers we attach to a payment are your account ID and the server ID.
• Legal basis. Performance of a contract (Art. 6(1)(b)) for the subscription itself, and a legal obligation (Art. 6(1)(c)) for the invoice records.
• Retention. Subscription records are erasable once the subscription has ended. Invoices are not: German tax and commercial law requires them to be kept for up to ten years, and Art. 17(3)(b) GDPR makes that obligation override a deletion request. Those records are held by Stripe.
• You can cancel at any time from your profile page, without contacting us. Access runs to the end of the period you have already paid for.

Verification and IP checks

Servers can require new members to pass a verification gate. Depending on the method, this stores a hashed code or a one-time link token, its status and expiry, and how many attempts failed.

If a server enables the VPN check, then when you open a verification link your IP address is sent to IPHub, which reports whether the address belongs to a VPN, proxy or hosting provider. We use that answer, plus the network operator and country it returns, to decide whether to let you through, and the server's staff may be notified that a flagged connection was seen.

• No lookup happens at all when a server has both the block and alert options switched off.
• We do not store your IP address in our database. It is held briefly in memory (up to 30 minutes) to avoid repeat lookups, and may appear in short-lived server logs.

Who else processes it

We do not sell your data, and we do not share it for advertising or profiling. We do rely on a small number of service providers to run Nighthawk, each bound to process data only on our instructions:

International transfers. Your data is stored in the European Union. Where a provider processes data outside the EU or UK, that transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision.

Session replay. To diagnose faults, Sentry records a sample of dashboard sessions, and records the session around an error when one occurs. Text content is masked and media is blocked in these recordings, so they capture layout and interaction rather than what is written on screen. This applies to the staff dashboard, not to the bot.

We may also disclose data where the law requires it, or where it is necessary to investigate abuse or protect someone's safety.

Cookies and local storage

• Strictly necessary. Signing in to the dashboard sets a session cookie. Without it, staff cannot stay logged in.
• Analytics. Our traffic and performance analytics are cookieless and produce aggregate counts, not profiles of individuals.
• Diagnostics. Error reporting and session replay use browser storage to tie events within one visit together.

We do not use advertising or cross-site tracking cookies.

How we protect it

• End-to-end encryption. Appeal text, staff notes and watchlist disputes can be encrypted so that only the intended holder of the private key can read them. We cannot read those fields.
• Encryption at rest. Sensitive data, including message copies, case reasons, matched automod content, nicknames and incident data, is encrypted with keys held separately from the database.
• Access control. Access to stored data is restricted at the database level, dashboard access is limited to approved staff accounts, and staff changes are recorded in an audit log.
• Data minimisation. Message content is kept for the shortest window the features allow, and exports deliberately exclude stored message content.

No system is perfectly secure. If a breach affects your personal data, we will notify the relevant supervisory authority within 72 hours where required, and inform affected users without undue delay when the risk to them is high.

Your rights

If you are in the European Economic Area or the United Kingdom, you have the following rights. We extend them to everyone who uses Nighthawk.

• Access: a copy of the data we hold about you.
• Rectification: correction of anything inaccurate.
• Erasure: deletion of your data, subject to a server's need to keep a moderation record, and to invoices we are required by tax law to retain.
• Restriction: pausing our use of your data while a dispute is resolved.
• Objection: objecting to processing we base on legitimate interests.
• Portability: your data in a machine-readable format.
• Human review: contesting an automated moderation decision, as described above.
• Objection to AI Moderation: you can object to your messages being scored. Raise it with the server's operators, who choose whether the feature runs, or contact us.

To exercise any of these, contact us using the details below. We will respond within one month. There is no charge. If we cannot act, for example because a request concerns a moderation record a server operator must retain, we will explain why.

You also have the right to complain to your local data protection supervisory authority.

Children

Nighthawk is not directed at children. It is used on Fluxer and is intended for people who meet Fluxer's minimum age requirement. We do not knowingly collect data from anyone below it. If you believe a child's data has been collected, contact us and we will delete it.

Changes to this policy

When this policy changes we update the date at the top of this page. For changes that materially affect what we collect or how we use it, we will announce it in our support community before the change takes effect.

Contact and data requests

To exercise any of the rights above, request deletion, or ask how Nighthawk handles your data, email us at contact@nighthawk.bot. This is the address to use for anything formal, because it gives both of us a written record and starts the one-month response clock.

Please include the account ID and the server involved so we can find the right records. For general questions and setup help, our support community is usually faster.