Privacy policy

1 Who runs Pulse #

Pulse is a small, independent Discord bot and website. It's run by Ethan R. (privacy@pulsebot.gg), who is responsible for the data described here (in GDPR terms, the "controller"). It isn't a company with a data team; it's a person who cares about getting this right.

Pulse is not made by, affiliated with or endorsed by Discord.

2 What Pulse stores #

Pulse only stores things when a server has switched on the module that needs them. Everything is tied to your Discord user ID (a long number Discord gives every account) and the server it happened in.

Levels and leaderboardsYour XP, level and how many messages you've sent, plus a cached copy of your username and avatar so the leaderboard can show who's who. Never the messages themselves.
Moderation casesWarnings, timeouts, kicks and bans: who it was about, which moderator did it, the reason they typed, and when it expires.
Activity historyShort entries for the server's dashboard feed, like "mira joined", "kai reached level 12" or "a message was deleted in #general". They name who did what, never the message text.
EconomyYour coin balance, streak and cooldown times, the items you own, and a list of coin transactions (daily, work, pay, purchases, gambling).
Ticket transcriptsThis is the one place Pulse keeps message content. When a support ticket is open, the messages written in it are saved as its transcript so staff can look back at it later.
Giveaways, polls and remindersThat you entered a giveaway (and whether you won), which option you voted for, and the text and time of any reminder you set with /remind.
Captcha checksWhile you're verifying in a server: the code you need to pick and how many tries you've had. It's temporary and goes away once you pass, fail or it expires.
Raid recordsWhen raid protection fires: when it started and ended, how many accounts joined, what Pulse did, and the IDs of the accounts it acted on so staff can undo things.
Server settingsEach server's configuration, custom commands, reaction-role panels, shop items, stats counters and the YouTube channels or Twitch streamers it follows for social alerts. These belong to the server, not to a person.

A note on logging

The logging module posts edits, deletions, joins and role changes into the server's own log channel on Discord. Pulse doesn't keep its own copy of those messages; the only thing stored is the one-line activity entry above (without the message text).

Reading messages isn't storing them

To catch spam, run custom commands, award XP and spring the tripwire, Pulse has to look at messages as they're posted in servers where those modules are on. It checks them in memory and moves on. Apart from ticket transcripts, nothing you write is saved.

3 What Pulse never collects #

Some things simply aren't kept, by design. These are checked in Pulse's code and covered by its tests, so they don't quietly creep in later.

Your email address. The Discord login only asks for "identify" and "guilds", and neither includes your email.
Your IP address. Discord never shares IP addresses with bots, and the website doesn't keep them either.
Your internet provider or location. Not looked up, not stored, not guessed.
Access logs. The website doesn't keep a log of who visited which page.
Your DMs. Pulse can't read your direct messages with other people.
What you say in chat, except messages written inside a support ticket.
Ads, analytics or tracking cookies. None, on the website or the dashboard.
Anything for sale. Your data is never sold, rented or shared with advertisers or data brokers.

How does the site stop abuse without IP addresses? To slow down people hammering the login or the API, the server turns each request's address into a one-way, salted hash (a scrambled code that can't be turned back into the address), keeps it in memory for a few minutes, and then forgets it. It's never written to disk, and it resets whenever Pulse restarts.

So when you delete your data, there's no email, IP address or location to remove, because none of it was ever kept.

You log in with Discord. Pulse asks Discord for two permissions only: identify (who you are) and guilds (which servers you're in, so it can show the ones you manage).

Your session keeps your Discord ID, username, display name and avatar, plus the list of servers you're in (refreshed every few minutes).
Discord's login token stays on Pulse's server, inside your session. It's never sent to your browser, and it's deleted when you log out or delete your data.
One cookie, pulse.sid, keeps you logged in. It's strictly necessary, can't be read by page scripts, and expires after at most 7 days.
The dashboard remembers a couple of preferences in your own browser's storage, like whether the sidebar is collapsed or a settings change you haven't saved yet. Those never leave your device.

5 Why we use it #

Only to run the features a server has switched on: counting XP, keeping a moderation record, paying out coins, drawing giveaway winners, showing the dashboard, and so on. Under GDPR-style rules, that's our "legitimate interest" in providing the service the server asked for, and for the dashboard login, providing the service you asked for.

We don't profile you, build ad audiences, train AI models on your data, or combine it with anything from outside Discord.

6 Who can see it #

Server admins (the owner, and people with Manage Server or Administrator) can see their own server's Pulse data in the dashboard: its leaderboard, cases, tickets, coins and activity. They can't see other servers.
Members of the server see what Pulse posts in Discord, like level-ups, the leaderboard, giveaway results and the shop.
Anyone on the web can see a server's leaderboard (usernames, avatars, levels and XP) only if that server switches on its public leaderboard. The live "Happening now" feed on the homepage shows server names and what happened, with member names left out.
The person running Pulse can access the database to keep it working and to handle requests like the ones in section 9. They don't browse it for fun.

We'd only hand data to anyone else if the law genuinely required it, and we'd tell you if we're allowed to.

7 Where it lives #

Pulse's data lives in a single database on a server hosted by DigitalOcean, in its London datacentre (United Kingdom). Connections to the website and dashboard are encrypted (HTTPS), and the dashboard checks you're allowed to manage a server on every request.

Discord itself also processes everything that happens on Discord, under Discord's own privacy policy.

International transfers. Discord is based in the United States, so information about Discord accounts is already handled there under Discord's own terms. Pulse's own database stays on the server named above. If that server is outside the UK or EU, the transfer is covered by the hosting provider's data processing agreement and standard contractual clauses (or the EU–US Data Privacy Framework where the provider is certified).

Payments (Pulse Premium). If a server buys Premium, Discord handles the whole payment. Pulse never sees card details, billing addresses or who paid. It only learns that a server has Premium and until when, and keeps that record for as long as the subscription runs plus its history for accounting. If you start a free trial or an admin applies a custom bot name or avatar, Pulse notes which Discord account did it, and that link is removed if you delete your data. Custom bot images are sent straight to Discord and not stored by Pulse.

Fonts and images. The website and dashboard load their fonts from our own server, not from Google or any other third party, so opening a page doesn't share your IP address with anyone else. Avatars and server icons are loaded from Discord's image servers.

8 How long we keep it #

How long Pulse keeps each kind of data
What	How long
Dashboard session and login token	Until you log out, or 7 days at most.
Captcha checks	Minutes: gone once you pass, fail or the check expires.
Rate-limit hashes	A few minutes, in memory only.
Activity history (who joined, levelled up, used a command…)	90 days, or 1 year for servers with Premium. Older entries are deleted automatically every hour.
Levels, coins, cases, tickets, giveaways, polls, reminders	Until you delete them, a server admin removes them, or the server's data is deleted. There's no automatic expiry for these yet.
Backups	Kept for 30 days at most (no more than the newest 14), stored privately on the same server and then deleted. If we ever have to restore an older backup, Pulse automatically deletes again everyone who asked to be deleted after that backup was made, so a restore can’t bring your data back.
Deletion record	When you delete your data, Pulse keeps a scrambled, one-way fingerprint of your Discord ID (not the ID itself) for 37 days, outside the backups. Its only job is the re-deletion above; it expires once no backup could still contain you.

If a server removes Pulse, its data isn't wiped instantly (so a re-invite doesn't lose everyone's levels). The server owner can ask for it to be deleted using the contact details in section 13.

9 Download or delete your data #

You can do this yourself, any time, without asking anyone. Either way covers every server Pulse is in, not just one.

In the dashboard

Log in with Discord.
Open Your data & privacy.
Press Download my data for a copy (a JSON file), or Delete all my data and type DELETE to confirm. Deleting also logs you out.

Open Your data

In Discord

In any server with Pulse, type /mydata export to get a file with everything (only you can see it).
Type /mydata delete and press the red button within 5 minutes to confirm.

What deleting removes

Your levels and XP, coins, inventory and coin history, reminders and any captcha check in progress.
Moderation cases about you, and every activity entry by you, about you or mentioning you.
Tickets you opened, with their transcripts, and your messages inside other people's tickets.
Your giveaway entries and wins, and your poll votes.
All your dashboard logins, everywhere.

What's kept, but with your name taken off

Some records belong to someone else or to the server, so they stay, but your ID and name are removed: cases you issued as a moderator, tickets you claimed or closed, giveaways you hosted, polls and custom commands you created, and your ID inside raid records.

Deleting can't be undone. Your levels and coins won't come back.

It also can't reach things Pulse doesn't control: bans, roles and timeouts on Discord itself, messages already posted in servers (like a level-up announcement or a log-channel post), and anything a server's admins copied or noted down themselves. For those, talk to the server's staff or Discord.

If you keep using Pulse in servers afterwards, it starts collecting the usual things again from scratch, like a fresh XP count.

10 Your rights #

Wherever you live, we'll treat you as if you had the rights people have under the GDPR and UK GDPR:

Access: see what we hold (use /mydata export).
Deletion: have it erased (use /mydata delete).
Correction: get something wrong fixed. Most data updates itself from Discord; for the rest, like a mistaken moderation case, ask the server's staff or contact us.
Objection and restriction: ask us to stop using your data for something.
Portability: the export is a plain JSON file you can take anywhere.

If you think we've got something wrong, please tell us first. You also have the right to complain to your local data protection authority (in the UK, that's the ICO).

11 Children #

Discord requires everyone to be at least 13 (older in some countries), and so does Pulse. We don't knowingly hold data about anyone younger. If you think we do, contact us and we'll delete it.

12 Changes to this policy #

If Pulse starts storing something new, this page changes first and the "Last updated" date at the top moves. For bigger changes we'll also mention it in the site's "What's new" box.

13 Contact #

Questions, requests or worries: email privacy@pulsebot.gg (Ethan R.). A real person reads these, usually within a few days.

Thanks for reading all the way down. Most people don't, and that's fine too: the TL;DR at the top is the honest summary.