Privacy Policy

Last updated: 2026-11-09

This policy explains what the acrO Discord bot, its website and dashboard collect, why, how long it's kept and what you can do about it. The controller responsible for this data is acrO TEAM (support@useacro.com).

1. What we collect

• Discord identifiers and names — IDs of servers, channels, roles and users that features work with, a server's name, and a member's name at the time of a moderation case.
• Server settings — everything staff configure (channels, roles, messages, filters, language, timezone).
• Feature data, only when the feature is used: XP, levels and message/voice counts, and whether a member has left the server (leveling - including XP a server brings over from another bot's export or a file, which is kept the same way); balances, items and reputation (economy - also balances a server brings over from a file); moderation cases with reasons; temporary roles and their end time; tickets with topics, form answers and ratings; giveaway entries; suggestions and votes; starboard posts; tags, automatic replies, scheduled and sticky messages and embeds staff create; reminders and AFK notes you write (and your previous nickname while you're AFK); members' roles, when a server gives roles back on rejoin (saved when they change and when someone leaves); who owns a temporary voice channel; your birthday's day and month (and the year only if you give it); which invite someone joined with; YouTube and Twitch channels and RSS feeds a server follows (a feed is read from its public address; nothing about you is sent there); if you turn on vote reminders (/vote remind), that you did and when the next reminder is due.
• Connected TikTok accounts — only if a creator connects their own TikTok account for alerts on a server's dashboard: the account's TikTok ID, display name and profile picture, and the access tokens TikTok issues (stored encrypted). acrO uses them only to read that account's newest public videos (TikTok's user.info.basic and video.list permissions) and post them where the server chose. Nothing is posted to TikTok, and no other TikTok data is read.
• Ticket transcripts — when a ticket closes, its messages (with authors' names, avatars and links to attachments) are saved for the server's staff, and can also be posted to a staff channel or sent to the member as a file.
• Public leaderboards — only if a server turns this on (it's off by default): a public web page shows that server's ranked members with their name and avatar there, their level, XP (all time, this week and this month) and message count, and the server's level reward roles. Members who left the server aren't on it; their XP is kept in case they come back. Search engines are asked to leave the page out unless the server chooses to be listed - then the page is also named in this website's sitemap.xml. If you don't want to be on it, hide yourself with /rank public_page on that server (your XP and your place in Discord stay), or ask the server's staff to take you off. The bot remembers that choice until the server's data is deleted.
• Ban appeals — only if a server turns this on: when you appeal a ban on the website, your user ID and name, the ban reason, what you wrote, and the staff's decision with an optional note are kept for that server's staff.
• Settings history — who changed which setting on a server (user ID and name, the old and new value), shown to the server's staff on the dashboard and in its log channel. When the Server Builder runs, what it made and set (with the IDs of the channels and roles it created, and who ran it) is kept too, so the run can be undone. When a migration is applied in the Migration Center, a record of it is kept too: who started it, when, which kinds of source it used, how many items came over, and the IDs of what it created or replaced, with the previous version of what it replaced, so it can be undone - none of the imported data itself.
• Migration Center — when a server's manager uploads a file to bring their setup over from another bot (that bot's export, or a CSV or JSON file), the file itself isn't stored. A CSV or JSON file whose columns the manager still has to confirm is kept as a table until they do - for members' XP, levels and balances only its columns that can be user IDs or numbers. What acrO recognized - members' user IDs with their XP, levels or balances, reward roles, multipliers and custom commands - is kept for the manager's review. All of it is deleted as soon as the migration is applied without errors or discarded, and at the latest 48 hours after its last change. Usernames and avatars in a list of members aren't kept.
• Member reports — when you report a message or a member: your user ID and name, the reported member, the reason you wrote, any historical message snippet, and the staff's decision with an optional note, for that server's staff only.
• Modmail — when you DM acrO to reach a server's staff: your messages (and links to your attachments) are posted into a private staff thread on that server, on Discord. We store which thread belongs to whom, its number and whether it's open, and who is blocked from modmail; when a conversation closes, a text transcript can be posted to the server's log channel.
• Applications — the forms a server's staff create, your answers, and the staff's decision with an optional note.
• Confessions — the text of anonymous confessions and replies with the author's user ID. Other members never see who wrote one; the server's managers can look the author up when a confession breaks the rules, and every lookup is logged on that server.
• Events — the events staff create and who answered Going, Maybe or Can't go.
• Booster perks and counting — which personal role belongs to which member; a counting channel's current number, record and who counted last.
• Keyword highlights — the words you asked to be notified about on a server (/highlight), until you remove them; after you leave the server, they're deleted the next time one of your words comes up.
• Custom commands and scheduled messages — the commands and messages a server's staff create, with the ID of who created them.
• Server statistics — daily totals per server (messages, joins, leaves, voice minutes, commands), plus message counts per hour of the day and per channel (for the activity insights). These are counts only: no message content and nothing per person.
• Install statistics — records about servers, not members: when acrO was added to or removed from a server (with its member count, which of our links it came through, how long it stayed and how many modules were on), whether /setup was finished, which modules were switched on, when a Premium limit was reached and how Premium started; whether the person adding it already owned another server with acrO (yes or no - not who), and Server Builder runs started and finished. How often the copy and share buttons on the Referrals page are pressed is counted, with nothing about who pressed them. For each server we also note whether a dashboard hint (to recommend acrO, or about moving over from another bot) was shown or dismissed, so it doesn't come back; that note is deleted with the server's data. No user IDs.
• Ban sync — which servers a server owner linked into a group, and who created it. A repeated ban is recorded as a moderation case on the server it was repeated on.
• Backups — a server's roles, channels and permissions (including permissions set for individual members) and acrO settings, when staff make a backup.
• Public server card — off unless someone who manages a server turns it on in the dashboard. Then we keep a random ID for its link and which parts it shows (a rounded member count, the modules in use, acrO's numbers for the last 30 days). The page shows only the server's name and icon (the icon's Discord address includes the server's ID) and those parts — nothing about members, channels or messages. It's deleted when it's turned off, and with the server's data.
• Dashboard login — when you log in with Discord, we receive your user ID, username, avatar and the list of servers you're in with your permissions there (OAuth2 scopes identify and guilds). We keep these, with up to 250 of your servers' names and icons, in your login session. If you add acrO to a server from the website, you're logged in the same way with the scope identify alone, and Discord tells us which server you added it to; that server goes into your login session. The Discord access token is revoked right after login and never stored.
• Premium and votes — Discord's subscription records (which server or user has Premium, and until when); keys (stored only as a hash) with the server they were redeemed on and the user ID of who redeemed them; who gave a server Premium; the user ID of who last changed the bot's look on a server; if you vote on top.gg, your user ID and the time.
• Referral program - if you use your referral link: a random code linked to your user ID and the language you last used with it; each press of "Add" on a referral page (the code and the time, nothing about the visitor); for each server added through it, its server ID, your user ID, the user IDs of who added it and of its owner, its dates and status; and your Premium credit ledger (each reward, each use with the server it went to, and any correction with who made it and why). The person who opens your link isn't told who you are, and you see the servers only as numbers. Views of a referral page are counted only as a total. The referral program doesn't use IP addresses, browser or device fingerprints or any lasting visitor ID: a referral is tied only to what Discord tells us when a server is added.
• Abuse prevention — IDs of users and servers blocked from the bot, with the reason.
• Technical data — your IP address is used in memory for rate limiting (not on referral pages, which are limited per link instead) and isn't stored by us (our hosting provider's logs may contain it briefly); error reports can contain IDs and are used only to fix problems.
• Cookies — the dashboard sets strictly necessary cookies: your login session (7 days), and short-lived ones (at most 30 minutes) that protect the login and adding the bot from the website, and show once that the bot was added. If you pick a language with the switch in the header, a cookie remembers that choice for a year. If you come to the website through a link with a mark in it (like ?ref=reddit), a cookie keeps that mark for 30 days. When you then add the bot from the website, the mark and the button you pressed are saved with the server's join, so we can tell which links bring servers. They name a link and a button, nothing about you. There are no advertising cookies and no cookies from anyone else.

Website measurement: We count visits to product pages and Add to Discord presses at most once per address, page or button, and campaign per day. Addresses stay only in a bounded in-memory set for that day; stored events contain the page or button, not the address. A successful Discord authorization return is counted separately from a confirmed server join. Short utm_source, utm_medium and utm_campaign labels from a link are kept in a first-party cookie for 30 days and, when applicable, saved with the server join. On public pages viewed while logged out, Cloudflare Web Analytics also measures pageviews and performance. Its beacon sends the page path and browser performance data to Cloudflare; query strings are excluded from its reports. We do not load it on the logged-in dashboard, OAuth routes or pages with private identifiers. Cloudflare Web Analytics does not use cookies or create cross-site visitor profiles. No advertising tracker or visitor profile is used.

Optional AI Server Builder

Only when a server manager chooses AI planning and confirms the notice, we send OpenAI the description they enter and a language hint derived from that text. We do not automatically send Discord server names, role or channel names and IDs, permissions, member data, messages, configuration or saved drafts. Existing-server matching, permission checks and draft preservation take place inside acrO. A bounded correction request includes the original description and fixed generic error categories, never the earlier plan or local diagnostic details. The description itself may contain personal or Discord-derived data if you paste it; do not include messages, personal details, credentials or Discord IDs. The Responses API uses store:false. This does not mean zero retention: OpenAI may retain abuse-monitoring logs for up to 30 days by default, subject to its documented exceptions. This change does not erase data previously sent to the provider. See OpenAI data controls. The AI proposes additions; existing-resource edits and removals from the draft use the local editor. Generation never changes Discord; applying a plan requires separate review and approval.

Outside the private owner Lab described below, the ordinary AI planning ledger does not store the prompt. The resulting plan and explanation stay in the manager's Builder draft until the server's data is deleted. For quota, cost control and abuse protection we record the guild ID, request ID, manager ID, tier, outcome, model, token counts and estimated cost, without the prompt. We clear the manager ID after 30 days and remove ordinary request records after 400 days. A server wipe removes the Builder draft and immediately clears the manager ID in usage records, but keeps those records for quota and spending controls. Minimal proof that a guild used its one lifetime Free generation remains while the service runs, including after bot removal or /config wipe, so reinstalling cannot reset the trial; the proof is reduced to the guild ID and usage metadata. Contact us using the rights process below if you want to access, correct or request deletion of this record. AI uses no additional cookies or tracking.

Private AI Architect Lab and operational AI

The owner-only Lab on the configured test server stores prompts, generated plans, validation diagnostics, model/version, timestamps, token counts, estimated costs and owner ratings/notes. Manually saved test cases store their name, prompt, expected result and checks. Run history is limited to the latest 500 runs per owner and server after completed processing; the daily cleanup removes runs older than 90 days on its next successful execution. Saved cases have no automatic age expiry. Service outages and backups can delay effective removal. Owners can export or delete their own Lab history and cases in the Lab; deletion is refused while a generation is running. This does not delete Builder drafts, quota records or provider-held data.

Operational AI may send repository code, technical error locations and aggregate occurrence counts to Anthropic through the configured Claude worker. Automatic error diagnosis excludes free-text error messages and samples from the model prompt. Owner-selected GitHub issues may contain their authors' text. Redacting credentials does not guarantee that text is anonymous. We do not intentionally submit Discord message content for model training. Provider retention and training settings depend on the account and contract; disabling response storage does not mean zero retention. See the OpenAI Services Agreement and Anthropic Privacy Center.

New reports keep a source reference rather than a message excerpt. Historical excerpts remain subject to the existing report retention policy; existing records are not silently erased.

Your direct messages and data requests

Optional bot-initiated DMs require your own category opt-in through /about; a server manager cannot give this permission for you. Your user ID, server ID, category, choice and update time are stored. Referral preferences and the all master switch are global; other categories apply to the selected server. Use the all master switch to stop DMs, including requested reminders and modmail. Setup reminders are shown in the dashboard. User-requested reminders and conversations remain available, subject to your master switch. Preference records remain until changed or included in a data deletion request; server-scoped records are also removed with server data.

To request access, correction or deletion, use the contact details in the rights section below and identify the account and relevant servers. Never send passwords or tokens. We verify the requester's identity and review feature records, AI records, transcripts, exports and backups. Some security, quota or legal records require a separate retention decision. Files already copied to Discord or downloaded by others cannot be recalled automatically; those copies require follow-up with their holders. The Lab export is limited to Lab data and is not a complete account export.

Community feedback

When you submit an acrO rating, we store your Discord account ID, 1–5 stars, submission and edit times, and any text you enter. We use the ID to enforce one rating per account. Discord handles sign-in and lets us check your account age and current membership in a server with acrO. No server ID, membership details or OAuth token are saved with your rating. Our database host stores feedback, and we do not send it to an AI provider.

Every verified rating contributes to the public count and average, regardless of the score. The website does not display individual reviews. Written feedback and improvement suggestions are visible to authorized operators. Previous review consent, attribution and moderation records are retained with existing submissions. If you save an older rating in the new form, its text becomes private and its public attribution is removed.

We keep an active rating until you delete it. You can edit or delete it through the feedback form. Deleting removes the live rating, text, suggestion and associated reports. Reports from the former reviews page store the reporter's Discord ID, reason and time until the rating is edited or deleted. Older copies may remain in backups until they rotate out, and we cannot remove copies made by others. Use Contact if you cannot sign in or want help with your feedback or report data.

2. Message content

If the operator enables Discord's Message Content access, acrO reads messages as they arrive to run the features that need text: automod filters, automatic replies, message logs, the starboard and ticket transcripts. Recent messages are kept in memory for about 15 minutes (at most 100 per channel; one that mentions someone for up to an hour, for ghost-ping alerts) so edits and deletions can be logged. Stored message text is limited to feature records, including ticket transcripts, confessions and historical report snippets (above). Direct messages you send to acrO are only relayed to the staff thread of the server you chose (modmail). Some features copy messages into the server's own channels on Discord when staff set them up — the logging module (edited and deleted messages), the starboard (highlighted messages) and automod alerts (the message that broke a rule). When a server's staff take over a role menu (right-click → Apps → Take over role menu, or /rolemenu adopt), acrO reads that one message's text to find which emoji gives which role; only those pairs are kept.

3. Why, and on what legal basis

• To run the features a server's staff turned on, show the dashboard and website, keep the service safe (rate limits, blocking abuse), fix errors, measure public-page use and performance, and see which of our links bring new servers — our legitimate interest in providing the service they asked for and letting people find it (GDPR Art. 6(1)(f)).
• To provide Premium you bought or redeemed — performing that agreement (Art. 6(1)(b)), and keeping purchase records where the law requires it (Art. 6(1)(c)).
• Optional details you add yourself, like your birthday — your consent (Art. 6(1)(a)), which you can withdraw by removing them.

We don't build profiles, show ads or use data to train AI models.

4. Sharing

We never sell, rent or give data to advertisers or data brokers. Data is processed by our hosting provider, Railway Corporation (United States),, by Cloudflare for public-page analytics, and naturally by Discord. Payments are handled by Discord; we never see card details. top.gg only receives the number of servers. YouTube, Twitch, Bluesky and Reddit only receive the public channel, account or subreddit names we check, and the site behind an RSS feed only receives the request for the feed; TikTok only receives the requests made with the access a creator granted. Where data leaves the European Economic Area (Discord and many hosting providers are in the United States), it's protected by the provider's safeguards, such as the EU–US Data Privacy Framework or Standard Contractual Clauses.

5. How long we keep it

• While acrO is on a server, feature data is kept until staff delete it or the member removes it (for example /birthday remove).
• Server configuration and feature data are deleted 30 days after acrO is removed from it — except backups, kept until 180 days after they were made so an owner can rebuild a lost server. Minimal install and lifecycle statistics remain for at most 400 days after each record was created, including after removal. An explicit server-data deletion also deletes these statistics.
• Lifecycle statistics record server-level setup steps and issues, dashboard and setup-tool openings, configuration saves, and the first and last recorded command-handler returns or failures and missing permissions per installation. They contain no user IDs, command arguments, message content, raw errors, IP addresses or device fingerprints. Only the bot operator can view server lifecycle details. Missing activity is not proof of inactivity or a reason for removal.
• Dashboard sessions end after 7 days. Top.gg votes are deleted after 30 days. Daily statistics are deleted after about 13 months, hourly and per-channel counts after 100 days. Ticket transcripts are deleted after 30 days (365 with Premium). The settings history is deleted after 90 days, ban appeals 180 days after they were decided, member reports 90 days after they were handled. Confessions are deleted after 90 days, decided applications and closed modmail conversations after 180 days, events 30 days after they took place. Member reports nobody handled are deleted 180 days after they were made, ban appeals nobody decided 180 days after they were sent. Ended giveaways are deleted after 60 days, delivered reminders after 7 days, weekly and monthly leaderboard counts after 100 days, the saved roles of members who left after 180 days, members who never finished membership screening after 30 days, and install statistics after 400 days. Server Builder runs and Migration Center records are deleted after 90 days.
• A connected TikTok account is deleted - and TikTok is asked to revoke the access - when it's disconnected on the dashboard, and with the rest of the server's data. You can also remove acrO's access yourself in the TikTok app's settings, where the apps with access to your account are listed.
• Referral records and the Premium credit ledger are kept while the referral program runs: they keep a server from counting twice and the credit auditable. Presses of "Add" on a referral page are deleted after 90 days. If you ask us to delete yours (section 6), your link stops working and unused credit is lost.
• Premium records are kept as long as needed to honor purchases and for accounting. Blocks for abuse last until they're lifted.
• A server owner can delete the server's data at once with /config wipe. Only what must outlive it is kept: temporary bans and roles that are still running (so they still end on time), Premium records, the server's basic record (its ID and name), and a raid lockdown that's still on (so it can be lifted). The server's language and timezone go back to the defaults.

6. Your rights

You can see, correct or delete your data, get a copy of it, object to or restrict its use, and withdraw consent — contact us (email support@useacro.com or the support server); we answer within 30 days. Many records you can also remove yourself (your birthday, reminders, AFK note), and server staff can delete most others with the matching commands. You can also complain to a data protection authority, for example the one in your country.

7. Children

acrO is for Discord users, who must meet Discord's minimum age (13 in most countries). We don't knowingly collect data from anyone younger.

8. Security

Dashboard sessions are random and only their hash is stored; every form is protected against cross-site requests; access to a server's dashboard is checked against the bot's live view of Discord on every request; the bot asks only for the permissions its features need.

9. Changes and contact

We'll update this page when what we collect changes; the date at the top shows the latest version. Questions or requests: email support@useacro.com or the support server.