The Deadlock Observatory

Bot Privacy Policy

Updated October 1, 2026

The Deadlock Observatory Discord bot and dashboard are operated under the public name hesy, United States. Privacy, support and reporting: [email protected]. The main website policy covers community votes, chat, games and the underlying tracker separately.

What we collect and why

• Discord sign-in: account ID, display name, an encrypted access token and expiry identify your dashboard session. Discord supplies your server list and management permissions so we can check access. Server names/icons and channel/role lists are displayed in the dashboard; we do not request your email, password or privileged member/presence/message-content intents.
• Server settings: server, channel, role and dashboard-message IDs, section preferences, Yoshi notification choices, retention settings and recent typing-alert markers operate the features you configure.
• Yoshi delivery: a temporary queue holds the quoted text, source links, author/attachment information and destination IDs until delivery. Timed posts retain destination/message IDs to schedule deletion. This content comes from the Observatory tracker, not conversations in servers installing the bot.
• Commands: Discord supplies interaction/account/server identifiers to respond. Temporary in-memory cooldowns prevent abuse; we do not keep a command-history database. The installed bot does not monitor ordinary conversations or DMs.
• Milestone announcements: community-vote announcements may be sent to configured dashboard channels with a screenshot. Delivery records prevent duplicate sends. They do not contain individual voters’ identifiers.
• Technical data: connection IPs, request details and errors may be processed by the hosting provider and Cloudflare for delivery/security. Dashboard rate limits use a bounded in-memory map.

Cookies

Essential HttpOnly, Secure, SameSite cookies support requested sign-in: __Host-observatory-oauth lasts up to 10 minutes; __Host-observatory-dashboard lasts up to one hour. The bot dashboard does not use advertising cookies. Discord and linked media providers operate their own services and policies.

Sharing and legal grounds

Discord receives authorization requests, bot replies and configured notifications; channel members can see posted content. Hosting and delivery providers process information needed to run and secure the service. We do not sell personal data or use it for targeted advertising. Required legal disclosures may occur. Where applicable, requested dashboard/bot functions rely on performance of the service agreement; security and abuse prevention rely on legitimate interests; legal obligations apply where required. Data is processed in the United States and potentially other provider locations; contact us for applicable provider and international-transfer information. We do not claim a transfer certification or safeguard that has not been verified.

Retention

• Dashboard sessions expire after at most one hour; expired sessions and OAuth states are purged at startup and every minute while the bot runs. Signing out removes the current session and attempts token revocation.
• Server settings last until you delete them or remove the bot. Removal events trigger cleanup; a complete Discord server-list reconciliation at startup and hourly catches missed removals. API failures postpone cleanup rather than risk deleting an active server’s settings.
• Unsent Yoshi payloads expire after 24 hours. Source-message duplicate markers last seven days. After sending, payloads are removed. “Never” retains the Discord post, not a permanent bot-side copy of the delivery payload. Timed post IDs remain until deletion succeeds, with retries for up to seven days after the scheduled deadline. Missing permissions or outages can prevent deletion.
• Milestone destination/message records expire after 30 days or when the dashboard subscription is removed, checked every 30 seconds while the worker runs. An aggregate campaign marker remains so cleanup cannot resend the announcement.
• Bot operational container logs rotate by size (two files of up to 5 MB); milestone logs use two files of up to 2 MB. This is not a fixed time guarantee. Hosting/Cloudflare logs and older backups have separate retention; active deletion does not automatically erase those copies.

Delete or manage your data

Sign in to the dashboard and choose Delete my dashboard data to remove all stored dashboard sessions/profile records associated with that Discord account and attempt to revoke their tokens. Server configuration belongs to the server and is not removed by personal deletion.

People with Manage Server permission can choose Delete this server’s configuration. This removes settings, dashboard subscriptions and queued/scheduled Yoshi deliveries and stops those features. The bot remains installed. Existing Discord posts are not deleted by this action, and their scheduled deletion stops. Server managers can remove those posts in Discord. Configuring the bot again creates new settings.

Removing authorization under Discord’s Authorized Apps revokes access on Discord. For access, correction, deletion of other records, restriction, objection, portability or an appeal, email us or use the private request form. Include only relevant account/server IDs or content URLs; do not send passwords, tokens or identity documents. We verify control before acting on someone’s records. Where applicable, we normally respond within one month and explain any permitted extension within that month. You may complain to your relevant data-protection authority. Statutory rights and justified legal retention take precedence.

Tracker content and copies

The underlying tracker separately collects developer messages, attachments, names and observed activity, including through a Discord desktop collector. This policy does not assert Discord authorization for that collector. Its data sourcing is under separate review. Removing a bot dashboard session does not delete the public tracker archive; contact us with the source URL for correction or removal. Copies already received by Discord, channel members or other third parties may remain.

Security, children and changes

Access tokens use authenticated encryption at rest. Access to bot storage is restricted. We have not verified provider-level encryption for all databases/backups and do not claim it here. Report security or harmful-content concerns to the contact above. We will investigate and handle applicable user/Discord incident notices. The service is not directed to children under 13 or those below Discord’s applicable minimum age. We update this policy when practices change.

Discord bot · Privacy controls · Terms · Contact & reporting