Scope and operator
This policy covers the SEC Discord bot (application ID 1440487140734533792) and usesec.top. The operator is SEC team, the independent developer of SEC. Contact us through SEC support or the /support report command in Discord. This policy does not govern Discord, Cloudflare, or an individual server’s administrators; those parties have their own responsibilities and policies.
SEC is built for server moderation and security. It does not sell Discord data, build advertising profiles, or use Discord message content to train AI models. Installing the bot does not grant the operator access to your Discord password, account token, payment information, or private messages with other people.
Data SEC processes
Discord sends the bot data permitted by the application’s authorization and enabled Gateway intents. SEC requests guild, member, moderation, and webhook events. It also subscribes to guild message events for join-wave and general message-flood detection. Message Content Intent remains disabled. The detector counts message IDs, channel IDs and timestamps; it does not inspect or retain message bodies, attachments, embeds or bot names.
| Data | Purpose | Storage |
|---|---|---|
| Server IDs, timezone, module switches, setup state, configured channel IDs (including optional updates), trusted bot/application IDs, ticket categories, protected resource IDs, maintenance settings and reasons | Apply each server’s chosen configuration | Local server configuration |
| Audit actor/target IDs, action type, timestamps, audit-entry IDs, classification, scores, signals and containment results | Detect and explain destructive activity | Anti-raid incident summaries |
| Moderator or SEC bot actor, target, server and channel IDs; action, timestamp, reason and message counts for cleanup or raid detection | Warnings and moderation case history | Moderation cases |
| Human join times, recent message IDs/channel IDs/timestamps, account or webhook source IDs, join-wave state and message-rate counts | Detect join-wave spam, individual message floods and coordinated member floods; prevent duplicate timeout requests | Bounded process memory; join-wave candidates expire after 10 minutes; general message sources expire after 5 minutes of inactivity; message-rate windows last 10 seconds |
| Wave and message-flood detection, integration flood alerts, automatic timeout results, skipped/failed actions, affected member/channel IDs, timestamps, reasons and message counts | Explain SEC automation in dashboard and Bot Log channel | Bot activity records (30 days); successful timeout moderation cases (90 days) |
| Your submitted support text, Discord user ID, optional server ID, report ID and submission time | Handle support, abuse reports and privacy requests | Private support records |
| Member names, role positions, account creation/join dates, bot status, guild resource information | Permission checks, welcome messages and requested utilities | Transient Discord client memory; no separate persistent profile |
Command inputs such as moderation reasons and support text are content you deliberately provide, even though ordinary message bodies are not archived. Avoid sensitive or irrelevant personal information in these inputs.
When /mod purge is used, SEC retrieves recent messages through Discord to delete the requested number. It does not save their bodies or attachments. Its case record stores the count, channel, moderator, time, and supplied reason. Discord and channel participants may still retain copies.
Website and delivery data
The dashboard uses Discord OAuth to connect your account. With your authorization, it receives your Discord ID, username, display name, avatar, email and email verification status, and the names, IDs, icons and permissions of servers you belong to. These account details and OAuth access/refresh tokens are held in server process memory to show your account, refresh Discord access and check which servers you may manage. The email is shown only in your account settings and is not used for marketing. There are no advertising trackers, analytics scripts or browser-local storage. The origin server does not create a request-access log.
Cloudflare provides DNS, encrypted web delivery and tunneling. It may process IP addresses, request information, connection and device characteristics, and security signals, and may use necessary security cookies according to its services and configuration. Its handling is described in the Cloudflare Privacy Policy. Provider retention is governed by the provider and account settings; SEC’s bot-record retention periods below do not apply to those independent systems.
Account login requests identify, email, guilds and guilds.join. The last permission is used only when you press Join SEC support, to add your account to SEC’s support server (ID 1437270187043848366). Login never joins a server automatically. Discord membership screening may still be required. Bot installation is a separate Discord authorization step; the dashboard’s server-specific install flow requests Administrator permission. SEC never receives your Discord password or personal account token. Discord’s processing is described in its Privacy Policy.
The website uses necessary, first-party HttpOnly Secure cookies: __Host-sec_oauth binds a login request for up to 10 minutes, and __Host-sec_session identifies your dashboard session for up to 24 hours. These cookies contain random identifiers, not OAuth tokens. Sessions and account data are removed on expiry, logout or website restart. Logout also requests revocation of the OAuth token; you can revoke SEC from Discord’s Authorized Apps settings. Account linking does not retain your profile, email or OAuth tokens in SEC’s SQLite databases.
Purposes and legal grounds
SEC uses data to deliver the features requested by server administrators or command users; check permissions; detect security activity; maintain server-scoped case records; respond to submitted reports; prevent abuse; and satisfy applicable legal obligations.
Where data-protection law requires a legal basis, the basis depends on the relationship and processing: performing a service requested under our Terms, legitimate interests in operating secure moderation and handling reports, consent for optional features where consent is required, and compliance with legal duties. Our legitimate interests do not authorize unrelated profiling or marketing. An administrator’s installation does not override a member’s statutory privacy rights.
Who can access data
Server administrators and authorized moderators can access server-scoped settings and case history through permission-checked commands. Server owners and users with Manage Server or Administrator can also read that server’s retained case history and configure SEC through the dashboard. Dashboard configuration changes record the actor ID, server ID, action and timestamp in the moderation history. Security alerts and moderation logs are posted to channels chosen by administrators, where Discord channel permissions determine the audience. Welcome messages appear in the configured welcome channel. Join-wave, message-flood and automatic timeout logs are sent to the selected Bot Log channel without pinging members. Bot activity records are also available to authorized server managers in the dashboard. Review those permissions before enabling logging.
The SEC operator can access service files and support submissions for operation, troubleshooting, and responding to requests. The support inbox commands are limited to the Discord application owner or authorized application team recognized by the bot library.
Discord receives API requests and messages necessary to provide the requested functionality. Cloudflare handles web delivery. We may disclose data when required by law, or when reasonably necessary and legally permitted to address a security incident, prevent serious harm, or protect legal rights. We do not sell, license, or disclose Discord API data to data brokers, advertisers, or monetization services.
Retention and deletion
- Dashboard account sessions: up to 24 hours in server memory, cleared on logout or website restart. OAuth login state expires after 10 minutes; the server-list cache lasts up to 45 seconds within the session.
- Bot activity logs: 30 days. Successful automatic timeout cases are kept with moderation cases for 90 days.
- Anti-raid summaries: 30 days from their recorded timestamp.
- Moderation cases and warnings: 90 days from their recorded timestamp, unless erased sooner.
- Support reports: 90 days from submission, unless you delete them sooner.
- Server configuration: until reset, removed by an administrator, or SEC observes that it has left the server.
- Operational logs: private bot, website and tunnel process logs on the SEC server. Each component keeps at most two 5 MiB files. Inactive log files expire after 14 days; cleanup runs when a component starts. These logs record startup, errors and operational metadata; the website has no request-access log.
- Deployment snapshots: initial migration copies of server configuration and databases are removed after the migration is confirmed. Future code pushes exclude live databases and secrets; code rollback copies contain source only.
- Rolling detection context and client caches: held in process memory for operational use and cleared or expired by the bot, including when the process stops.
Expiry cleanup runs at startup or during a daily maintenance task. Records can remain on an offline host until the next cleanup. This deployment does not create scheduled database backups. Operational log and deployment snapshot handling follows the retention described above.
When SEC receives a guild-removal event while running, it deletes that server’s local configuration, cases, and incident records. Removing the bot while it is offline may not deliver that event; use the owner deletion command before removal or send a privacy request to ensure records are cleared.
Support reports are handled separately because a report may concern abuse or a privacy issue outside the reporting server. The report submitter can erase their reports with /support delete-my-reports. Copies held by Discord, server administrators, other users, or delivery providers are governed by those parties and are not erased by these commands.
Your controls and requests
Use /privacy data to view a short data summary. Account settings lets you inspect and refresh your Discord profile, optionally join support and log out. Remove account authorization in Discord’s Authorized Apps settings to withdraw future OAuth access. The server owner can use /privacy erase-server-data and enter DELETE SEC DATA to erase SEC’s retained configuration, moderation cases, bot activity logs, and anti-raid records for that server. The dashboard provides the same owner-only erasure with the same confirmation phrase. This disables protection and welcome messages and requires a fresh setup. It does not reverse kicks, bans, timeouts, deleted messages, or Discord audit entries.
For access, correction, deletion, objection, restriction, portability, or withdrawal of consent where those rights apply, use SEC support or the /support report command in Discord. Include your Discord user ID, the relevant server ID if known, and the request type. Do not include credentials or identity documents in an initial report. We may request proportionate verification before disclosing or changing data.
We respond within applicable legal deadlines. Some rights may be limited by lawful grounds, third-party rights, or the need to preserve evidence required by law. If a request cannot be fulfilled, we will explain the applicable reason where permitted. You may also complain to the data-protection authority with jurisdiction over your situation. Server administrators are responsible for answering requests concerning their own logs and copies.
Security and processing locations
Bot records are stored in local SQLite databases outside the website’s public directory. The website serves public assets and authenticated dashboard endpoints. Private bot code, databases and environment files are not exposed as downloadable website files. Dashboard changes require a valid account session, request-forgery checks and server permission checks in both the website and bot bridge. Moderation and support commands use permission or owner checks, and sensitive bot configuration is kept outside public files. Web traffic is delivered through Cloudflare over HTTPS; the local tunnel origin is bound to loopback.
The application does not itself encrypt SQLite files at rest. Protection of the host, disks, accounts, backups, and credentials is an operational responsibility of the operator. No system can guarantee absolute security. Report suspected unauthorized access privately through SEC support, and do not publish exploit details or credentials.
SEC’s host and its delivery providers may process data in locations different from your country. Applicable international-transfer obligations and safeguards continue to apply. We will notify Discord and affected users of a qualifying data incident as required by applicable law and Discord’s developer terms.
Age requirements and changes
SEC is not directed to people below Discord’s minimum age or the minimum age required by their country. Do not submit information about a person who is not eligible to use Discord. Contact us if you believe SEC has retained such information.
We may update this policy when functionality, data practices, providers, or legal requirements change. The effective date is shown above. We will provide notice of material changes through the website or Discord application channels where practical. New data uses that require consent will not rely solely on acceptance of an updated policy.