# How to write a Discord bot privacy policy > Create a Discord bot privacy policy from commands, IDs, logs, and stored content. Cover retention and deletion, then publish the link where users find it. Published 2026-10-09 by Jitoma Solutions s.r.o. · 11 min read Give your Discord bot a public privacy policy that explains the data it receives, what it stores, why, and how users can request deletion. Add the URL to the Developer Portal and make it accessible from the bot. Start by checking commands, permissions, logs, and database records; a bot that processes a message briefly needs a different explanation from one that saves chat history. Canonical URL: https://legalpolicygenerator.com/blog/discord-bot-privacy-policy ## Key takeaways - Discord's Developer Terms require a privacy policy for your application, linked in the Developer Portal and reachable from the bot. - Message content is a privileged intent, and Discord's Developer Policy limits how API data, including message content, may be used. - You must delete API data when it is no longer needed, when users ask, and when you stop running the bot. - Name the hosting, database, and AI providers that receive Discord data, and do not share it with advertising networks or data brokers. ## What data does a Discord bot process? Trace a command from Discord through your bot to its logs and database. Write down which inputs you receive, which records you save, who else receives them, and what deletes them. Include the web dashboard and paid features if you have them. The inventory below is a prompt to investigate your own bot, not a list to copy into every policy: - **User data**: user IDs, usernames, display names, avatars, and roles in a server - **Server data**: guild IDs, channel IDs, role IDs, and server settings your bot stores - **Message content**: text, embeds, and attachments your bot reads, if it has access - **Commands and interactions**: slash command inputs, button clicks, select menu choices - **Feature data you create**: XP and levels, warnings and moderation logs, economy balances, reminders, tickets - **Dashboard data**: if you run a web dashboard with Discord OAuth2, the data covered by the scopes you request, such as identify or email - **Operational data**: error logs, rate-limit logs, and hosting provider logs, which may contain IDs or message text - **Payments**: if you sell premium features, subscription status and records from your payment provider For each line, note whether you only process it in memory to answer a command or store it in a database, and for how long. That difference drives both your retention section and Discord's deletion rules. ## Does a Discord bot need a privacy policy? Yes. Section 5 of the Discord Developer Terms of Service, titled User Privacy and Security, says you **will provide and adhere to a privacy policy** for your application that complies with applicable privacy laws and clearly, accurately, and fully describes what data you collect, how you use and share it with Discord and third parties, and how users can request deletion. The same section says you will maintain **publicly available, up-to-date links to your privacy policy in the Developer Portal** and make it easily accessible to users from your application. Discord also names the laws it expects you to follow, including the GDPR and ePrivacy Directive, the UK GDPR, Brazil's LGPD, and California's CCPA and CPRA. Your bot does not need to be large for those laws to matter: a moderation bot in a few European servers is already processing personal data of EU residents. There is one more detail that surprises developers. Discord says your privacy policy may not supersede or be inconsistent with the Developer Terms, and the Terms win if there is a conflict. So your policy cannot grant you rights to data that Discord's rules forbid. The next sections show what that means in practice. ## Message content and privileged intents Message content is the most sensitive data most bots touch, and Discord treats it accordingly. According to Discord's gateway documentation, MESSAGE_CONTENT is a **privileged intent** that controls access to message content fields across the API, including content, embeds, attachments, components, and polls. Without the intent, Discord's documentation says apps receive empty values in those fields, with a few exceptions: - messages the app sends itself - direct messages with the app - messages in which the app is mentioned - the message a message context menu command is used on Access rules have changed over time, so check Discord's current Help Center article before you plan around them. At the time of writing, it says apps with fewer than 10,000 users may enable privileged intents in the Developer Portal, while apps that reach 10,000 users need review for continued access. Separately, Discord's verification article says verification is required for an app to scale past 100 servers. For your privacy policy, the practical point is simple: **say whether your bot reads message content, why, and whether it stores any of it**. If you can build features with slash commands instead, you collect less and have less to explain. ## Discord's data use rules your policy has to respect Discord's Developer Policy has a section called Handle Data with Care, and it sets limits that your privacy policy should reflect rather than contradict. Among other things, it says you must not: - use API data for any purpose beyond what is necessary for your application's stated functionality, except improvement using aggregated or de-identified data - use API data to profile Discord users, their identities, or their relationships - obtain API data of people under 13 or the minimum age required by law in their jurisdiction, or sensitive information such as health or financial information except where Discord's terms allow - disclose API data to data brokers, advertising networks, or other monetization-related services - sell, license, or otherwise commercialize API data - **use message content obtained through the APIs to train machine learning or AI models**, including large language models, unless Discord grants express permission Discord also requires developers to notify Discord and affected users of potential unauthorized access to API data, as described in the Developer Terms. Write your purposes narrowly and concretely: “we store warnings so moderators can review a member's history in that server” is both clearer and safer than “we use data to improve our services”. ## Sharing with hosting, databases, and AI providers Section 5(b) of the Developer Terms allows you to share API data with a third party only in limited cases: with a **service provider**, where required by law, or when a user expressly directs you to share their data. Before using a service provider, Discord requires a written agreement that limits the provider to using the data on your behalf and for no other purpose. Your bot almost certainly has service providers. Common ones include: - a VPS or cloud host and a managed database - an error tracking or logging service - a payment provider for premium tiers - an AI API that summarizes, translates, or answers questions using message text Name these providers in your policy, or at least their categories and locations, and explain what data each receives. If you send message content to an AI provider, say so plainly, check that the provider does not use your API traffic to train its models, and remember Discord's own rule against training on message content. The [AI product privacy disclosures](https://legalpolicygenerator.com/resources/ai-product-privacy-disclosures) guide covers how to describe model providers and retention. If you transfer data from the EU or UK to providers elsewhere, your policy should mention international transfers too. ## Retention, deletion requests, and security Discord is unusually specific about deletion. Except where law requires you to keep data, the Developer Terms say you must promptly delete API data when it is no longer necessary for your stated functionality, when you stop operating your application, when Discord asks, when the user asks, or when the law requires it. You must also **give users an easily accessible way to ask for their API data to be modified and deleted**. In your bot, that might mean: - a slash command that deletes a user's stored data, with a confirmation step - a support server or email address listed in the policy - automatic deletion of data from servers that remove the bot, after a period you state Your policy should list retention periods for each kind of data, for example moderation logs kept until a server admin deletes them or the bot leaves the server, and error logs kept for a fixed number of days. On security, Section 5(c) requires commercially reasonable efforts to protect API data, including **encryption of data at rest** and administrative, physical, and technical safeguards, plus prompt notice to Discord about incidents. A short security paragraph in your policy should describe these measures without overpromising. ## Where do you put the privacy policy link for a Discord bot? Discord requires two things: a publicly available, up-to-date link in the Developer Portal, and easy access from your application. In practice, that means: 1. **Developer Portal**: add the URL to your application's settings so it appears where Discord and users expect it. 2. **Inside the bot**: a command such as a privacy or about command that replies with the link, and a mention in your help command. 3. **Your website or listing pages**: link it from any bot list pages, your landing page, and your support server's information channel. The link must open a real web page that anyone can read without logging in. A pinned message in a Discord server is not publicly available, and a document that changes permissions can break without warning. If you do not have a website for your bot, see [how to get a privacy policy URL](https://legalpolicygenerator.com/blog/how-to-get-a-privacy-policy-url), which compares hosting options, including a hosted page from a generator. Keep the same URL for the life of the bot and update the content when features change. ## Do you also need Discord bot terms of service? Many bot developers publish terms of service alongside the privacy policy, and they serve a different purpose. The privacy policy explains what you do with data; terms set the rules for using the bot: acceptable use, premium subscriptions and refunds, availability, liability limits, and your right to block abusive users or servers. Discord's Developer Policy also expects you to provide users with a way to report issues or violations relating to your application, and to review those reports and take appropriate action. Your terms are a natural place to explain how reporting works, alongside the support server or email you list in the privacy policy. If you sell premium features, terms matter more: they should explain billing, cancellation, and what happens to premium perks if the bot is removed from a server. Our guides on [terms and conditions for apps](https://legalpolicygenerator.com/blog/terms-and-conditions-for-apps) and [privacy policy vs terms and conditions](https://legalpolicygenerator.com/blog/privacy-policy-vs-terms-and-conditions) explain the split, and the [app terms of service generator](https://legalpolicygenerator.com/app-terms-of-service-generator) can draft terms from your answers. ## Generating a Discord bot privacy policy You can build a bot privacy policy with the [app privacy policy generator](https://legalpolicygenerator.com/app-privacy-policy-generator). Choose the application use case, then describe your data honestly: which identifiers and message content you store, your hosting and database providers, any AI API, payments for premium features, retention periods, and the regions your users are in. Discord bots often reach users in the EU, UK, US, and Brazil, which matches the laws Discord itself names. The questionnaire, full preview, and simple HTML and PDF download are free with no account. Clauses come from a versioned library and are selected deterministically from your answers, so the policy describes only what you confirm. Advanced regional modules such as GDPR, UK, California, and Brazil's LGPD cost $5, and **optional public hosting adds $0.99 once**, giving you a public page to paste into the Developer Portal. After generating, compare the text with Discord's rules: if the policy describes a use that the Developer Policy forbids, change your bot, not just the wording. Generated text reflects your answers and is not legal advice. ## Common questions ### Where do I add a privacy policy to my Discord bot? Add the URL in your application's settings in the Discord Developer Portal, because Discord's Developer Terms require a publicly available, up-to-date link there. Then make it easy to reach from the bot itself, for example through a privacy or help command, and link it from your website or support server. ### Can my Discord bot store message content? Only if it is necessary for your bot's stated functionality, you have access to message content, and your privacy policy says so. Discord's Developer Policy limits API data use to that functionality and forbids training AI models on message content without Discord's express permission. Store as little as possible and set a retention period. ### Do I need a privacy policy for a private bot in my own server? Discord's Developer Terms apply to applications using its APIs and do not limit the privacy policy requirement to public bots. If your bot processes other members' data, a short policy describing what it stores and how to request deletion is the safe approach, and it costs little to publish. ### Can I use Discord messages to train an AI model? Not without permission. Discord's Developer Policy says you must not use message content obtained through the APIs to train machine learning or AI models, including large language models, unless Discord grants express permission. If you send messages to an AI API for features, confirm the provider does not train on that data. ### What should my bot do when a user asks to delete their data? Delete the user's stored API data promptly unless a law requires you to keep it, and confirm when it is done. Discord's Developer Terms require an easily accessible way to request modification and deletion, so offer a command, support server, or email address and describe it in your policy. ## Official sources - [Discord Developer Terms of Service](https://support-dev.discord.com/hc/en-us/articles/8562894815383-Discord-Developer-Terms-of-Service) - [Discord Developer Policy](https://support-dev.discord.com/hc/en-us/articles/8563934450327-Discord-Developer-Policy) - [Discord: What are Privileged Intents?](https://support-dev.discord.com/hc/en-us/articles/6207308062871-What-are-Privileged-Intents) - [Discord Gateway documentation, Message Content Intent](https://docs.discord.com/developers/events/gateway) - [Discord: How Do I Get My App Verified?](https://support-dev.discord.com/hc/en-us/articles/23926564536471-How-Do-I-Get-My-App-Verified) Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability.