Privacy Notice

Version 3.10 — effective 31 August 2026

This notice describes what this owaua instance actually does with personal data, according to the code that is running. Public copy: https://owaua.com/owaua/privacy. Contact: ckazros@owaua.com.

The controller of the SQLite database on this instance is the private operator who runs the bot, reachable at the contact above. Discord, Daki Hosting (Germany), Cloudflare (public web), and any configured AI or search providers are separate organisations. owaua does not sell personal data. There is no advertising SDK in the bot.

1. What this does not cover

Data Discord itself stores (messages, profiles, IPs Discord sees, audit logs). See Discord's privacy policy.
Logs or training use by Groq, OpenRouter, Google, Anthropic, DeepSeek, Cerebras, Inception, Celeris, Tavily, DuckDuckGo, QuickChart, or whoever else this instance's environment variables point at. Those are their policies. This operator cannot delete copies they keep.
Other bots in the same server.
The optional desktop pet, except that if you point it at an AI endpoint yourself, that endpoint sees what you send.

2. What we receive from Discord on every use

When you mention the bot, DM it, or run a command, Discord delivers at least: your user id, username, global/display name, the message or slash input, timestamps, channel and guild ids and names, and whether you have relevant permissions. If you are a server member, the bot may also read up to 25 role names, your top role, join date, and account creation date to build a speaker profile for the model. Attachments you include can be downloaded. Voice features read voice-state (who is in which channel).

If a server administrator enables Action Log, the bot can send private Discord log-channel embeds for server audit entries and observed gateway events. Depending on that server's dashboard choices, these can include actor and target ids, roles, channel activity, reasons, before/after values, edited or deleted message text, attachment links, and copies of previewable media, reactions, command use, voice-state changes, and bounded samples from bulk deletions. These embeds are sent back to the administrator-selected Discord log channel and are not copied into a separate owaua SQLite action-log table. Discord controls how long those channel messages remain. Administrators can disable event families, message content, attachment links, audit changes, bot events, or individual channels, roles and users.

When the malware-scanner module is enabled, the bot inspects every attachment it receives in that server or DM before normal bot processing. The bytes are written to an owner-only temporary file. A file is excluded as media only when its Discord MIME type, filename extension, and local binary signature agree; other files are scanned locally by ClamAV. The temporary file is then deleted. No attachment bytes are stored in SQLite or sent to an antivirus vendor by this code.

That profile is assembled in memory for the reply. It is not written to its own table. Pieces of it can still land in stored memories, conversation turns, or audit rows if another feature saves them.

When you open or submit the Discord-issued ToS acceptance page, Cloudflare and the bot web service receive your client IP address. Cloudflare also provides the ASN and organization name for that address. The bot normalizes the IP (an IPv4 address or an IPv6 /64 network), immediately transforms it with a secret keyed hash, and stores only that network token. ASN and organization name are classified in memory against a local VPN/proxy/Tor/hosting list and are not written to SQLite. If the network token matches a currently blocked account, the visiting Discord account is hard-blocked. If the network is classified as VPN, proxy, Tor, or hosting, acceptance is refused without creating a Discord hard-block. The acceptance record is linked to your Discord user id because the one-time link was issued inside Discord. Public Terms and Privacy pages without an acceptance link do not create an owaua acceptance record.

3. What we store in SQLite

The bot's brain is a local SQLite file (OWAUA_DB, default owaua.db) on the Daki server. Tables and what they hold:

Store	What it contains	When it is written
privacy_consents	Your user id, a scope id (exact guild or DM scope), opted-in flag, timestamp	When you `/privacy opt-in` or `opt-out`
tos_acceptance_challenges	A keyed token value, Discord user id, legal version, creation and expiry times	When Discord creates a single-use acceptance button; deleted on use or after 15 minutes
tos_acceptances	Discord user id, legal version, accepted/review/rejected status, keyed network token, timestamps, and a short risk code when review is required	When the web acceptance form is submitted or the operator resolves a review
tos_blocked_networks	A keyed network token, the blocked Discord user id that contributed it, and a timestamp	When a blocked account is created or that account visits the acceptance page from a network; removed when that account is unblocked or after at most 30 days
server_messages	Message id, guild/channel ids and names, user id, username, display name, text content, optional bad-word flags, time	Under the ordinary dual consent gate, or for accessible text in an explicitly configured archival guild
conversations	Short user/bot turns, truncated to 1500 characters, kept to about 20 turns each way by default	Same dual gate as raw history
conversation_summaries	An AI-compressed continuity summary, user id, exact scope, source-through and update times	After enough new dual-consented turns; it never replaces durable memories
memories	Facts about a subject (your id or "server"), author id, guild/scope, importance, category, optional expiry/supersession, use count, and timestamps	When the bot or a moderator saves a memory; scoped to that guild or DM
lessons	Short style/behavior notes distilled from feedback, with a scope id	When enough feedback exists and distillation runs; these are guild-level, not owned by one user
feedback	Your message, the bot reply, thumbs up/down or a correction note, your id, scope	When you rate a reply
relationships	Per-user, per-guild bond score, optional nickname, optional grudge text	As the bot updates how it treats you in that server
quotes	Saved lines, who they are about, who saved them, guild id	When someone saves a quote
commands	Community command name, prompt spec, author id, guild, use count	When a command is requested/approved
interactions	Kind of interaction, author, guild, time (counts, not full text)	As you use features
ai_traces	Random trace id, exact scope, task/route, requested and serving model ids, prompt version, success/error type, latency, estimated token counts, attempts and fallback count. No prompt or response content.	When privacy-safe AI tracing is enabled for that server; used for health and cost diagnostics
guild_settings	Persona, lurk, swear level/jar, allowed channels, history/moderation/rules/STT flags, retention days, log channel ids, optional reply-language default	When administrators configure the server
swear_jar_counts	Guild id, user id, aggregate swear count, last update time; no message text or matched words	When a server administrator enables the swear jar and a message contains locally detected profanity
action_audit	Actor id, scope, action type, target id, parameters (JSON, capped), status, result, times	On confirmed `/act` and similar gated actions
assistant_action_history	Actor/scope/channel ids, confirmed action and result, redacted parameters, and an exact inverse when safely reversible	After a confirmed assistant action, so `assistant undo` can propose a rollback
module_settings	Per-server module enabled flags and bounded JSON settings, including malware scan limits/report routing, updater id and time	When an authenticated dashboard operator saves a module
dashboard_audit	Server id, dashboard actor label containing the Discord user id, module/action, limited detail and time	For dashboard configuration changes; retained under the same content-retention cleanup
community_records	Typed records for reminders, onboarding follow-ups/acknowledgements, highlights, tags, moderation cases/events/private notes/appeals, staff incidents, tickets/intake/assignment/SLA, digest schedules, forms/access links/submissions, giveaways, feed/starboard state and similar workflows. Evidence is stored as bounded HTTPS references, not copied message bodies.	Only when the corresponding module is enabled and someone uses it
afk_statuses / afk_notes	Server/user ids, AFK reason, prior nickname, notification preference, and notes deliberately left by members	While AFK is enabled; status and delivered notes are removed on return
user_levels / daily_claims	Per-server XP, level, message count, XP cooldown, daily claim time and streak	When Levels/Economy is enabled and used
dynamic_blocks	Blocked user id, source (manual/ToS/other), reason, category, SHA-256 prefix of evidence, guild/channel ids, strike notes, last 10 history events	On ToS hard-block or operator block
user flags (kv)	ToS version accepted and when; reject time; strike counters; emergency-block flag; DM-block flag; freaky-mode and fast/balanced/reasoning AI-mode flags; reply-language preference; per-guild STT consent flags	As those features are used
economy_accounts / work_cooldowns	Toy currency balance and work timestamps	If you use those commands
kb_docs	Knowledge-base passages for a guild (text chunks, topic, source)	When mods ingest files or `!kb add`
dm_contacts	User id, display name, last DM time — used by the operator DM CLI	When the operator DMs you through the bot account
cli_active_conversations	Operator CLI session heartbeats	While an operator chat session is open; dropped after a few minutes idle

4. Consent gates (this is the important part)

ToS acceptance unlocks ordinary commands. It is stored as the version string you accepted plus the bounded web-acceptance record described above. It must be completed on the website from a one-time Discord button; typed commands cannot accept. It is not raw-history consent. The tests assert that.
Raw history is off by default. In a server it requires the administrator to enable history_enabled and you to /privacy opt-in for that exact guild id. In DMs, opt-in alone is enough (there is no guild admin). If either gate is off, conversation turns and conversation summaries and server_messages are not stored, and live channel context is not pulled into the prompt.
Dedicated archival guild exception: the host may configure an explicit guild id in OWAUA_ARCHIVE_GUILD_IDS. In that disclosed guild, owaua backfills every message it can read from Discord and captures new or edited messages without the ordinary per-user raw-history opt-in. It stores text plus message, channel, guild and author identifiers. It strips Unicode and custom Discord emoji and does not store attachments, embeds, stickers, or emoji-only messages. Messages already deleted from Discord and channels the bot cannot read cannot be recovered. Stored message text is indexed so authorized user reports can retrieve question-relevant records.
Channel context, when history is enabled, is a live Discord API read of the last ~10 messages. Authors who have not opted in are skipped. Messages are truncated to 200 characters and sent to the model for that reply; they are not extra-stored unless the history writer also runs.
Swear jar is off by default and controlled per server by an administrator. When enabled, message text is checked locally in memory and only a per-user numeric total is stored; this does not enable raw history or send the message to a model.
Passive moderation is off until the process flag OWAUA_SAFETY_ENABLED is on and the guild enables it. The safety model only classifies. It cannot delete, warn, or globally block by itself. High-confidence hits go to a private staff review with Delete/Dismiss buttons. Delete re-checks manage_messages at click time.
Malware scanning is deterministic and enabled by default. Verified image/audio/video media is excluded; other attachments are locally scanned before command, archive, or AI processing. A confirmed signature causes immediate deletion, a private staff report, and a bot-access hard block. If the engine cannot produce a verdict, fail-closed mode removes the message but does not punish the sender. Discord does not expose its native user-report form to bots, so the private incident report is the available reporting mechanism.
Server rules run only if the process is configured for a specific guild, rules are enabled, and that guild enables them. Findings go to an approval channel. Approve/Deny re-checks the matching Discord permission and hierarchy. Denial, timeout, or restart does nothing.
Voice transcription (/stt) is off by default, and live receive is currently unavailable in the released dependency set (the install refuses to downgrade PyNaCl). If it is working: the process flag must be on, the guild must enable it, the controller needs manage_channels (or equivalent control), and every non-bot participant in the voice channel must have granted STT consent for that guild. Consent is stored as a user flag. The session stops if the controller leaves, consent changes, or people who have not consented join. Audio is sliced and sent to Whisper; transcripts are posted to the text channel where /stt was used. /privacy delete revokes STT consent.
/say TTS sends the text you asked the bot to speak to the configured TTS provider and plays audio. It does not require STT consent.
Dashboard modules that can moderate, delete, post feeds, or change roles are off by default. If an administrator enables them, the bot can inspect live message/member/voice events for deterministic filters, send notifications, change configured roles or channel permissions, and store the bounded workflow records listed above. Public forms accept the answers a visitor submits; member-only forms use an expiring link issued to that Discord user. Form submissions are rate-limited.
Dashboard sign-in uses only Discord OAuth scopes identify and guilds. The bot keeps a signed HttpOnly session cookie containing the Discord user id and up to 100 connected server ids the user owns or can manage. The cookie expires after 12 hours. OAuth access tokens are used only to complete sign-in and are not stored by owaua.

Opt-out for an ordinary scope revokes consent and deletes raw server_messages for you in that scope. In a configured archival guild, deletion removes the rows currently stored for you, but later messages are archived again under the guild archive setting. Explicit memories are left until you export or delete them.

5. What we send to models and other vendors

To generate a reply the bot builds a system prompt that can include: the persona; server mood; your relationship score/nickname/grudge; swear-level; guild lessons; your speaker profile; memories about you in that exact scope; recent stored conversation turns; matching server memories; knowledge-base chunks (delimited as untrusted reference data); an exact-user/exact-scope compressed continuity summary when dual-consented history is long enough; and your current message. That bundle is sent to whichever chat provider is configured for the route (examples the code knows: Groq, OpenRouter, Google Gemini, Anthropic, DeepSeek, Cerebras, Inception Mercury, Celeris, plus any OpenAI-compatible OWAUA_LLM_BASE_URL).

Other outbound calls, only when you or a staff feature use them:

Vision (/describe or the message context menu): image bytes or a revalidated public HTTPS URL, size-capped (default 8 MB), PNG/JPEG/GIF/WebP, to the vision model. One call returns a description and a moderation flag.
Web search: the search query to Tavily and/or DuckDuckGo (ddgs).
Charts: labels and numbers encoded into a QuickChart URL. No scriptable callbacks.
Music: no media fetch; a YouTube search URL is built locally.
Multilingual: you can set a personal/DM reply language with !language / /language. A server manager can set one authoritative guild language for dashboard interface copy, command replies, module output, controls, errors, and AI output. Incoming language is also detected on-box with langdetect (not an LLM). When a non-English guild language is active, product interface strings and outgoing bot text may be sent to the configured fast translation model; dashboard form values, member selectors, and incident/activity records are excluded from dashboard translation batches. If a configured multilingual channel detects another language while no guild language is set, a same-language reply model may also be called.
Safety / rules models: classifier prompts, not open-ended control of the server.
Malware scanner: attachment bytes stay on-box and are passed only to the local ClamAV process. This implementation does not upload them to VirusTotal or another antivirus service.
Feeds and utilities: configured subreddit names and YouTube channel ids go to public Reddit/YouTube endpoints. Twitch and Kick use operator-supplied app credentials; TikTok uses a creator-authorized Display API token. Pokémon, iTunes, GitHub, joke, dog-image, and ISS commands send only the lookup term needed to their fixed public API endpoint. Integration responses are size-bounded and redirects are refused.

Providers see IP addresses of this server, not your home IP, except that Cloudflare and Discord see client IPs on the public website and the Discord client respectively. The website worker may forward CF-Connecting-IP as X-Forwarded-For and Cloudflare ASN/organization metadata to the bot's HTTP port on the acceptance route. Those extra fields are used only to refuse VPN, proxy, Tor, and hosting networks and are not stored. Health endpoints /healthz and /readyz do not include user, guild, or provider payloads.

6. Retention

Raw history, conversation turns, compressed conversation summaries, and AI trace metadata: at most 30 days (OWAUA_RETENTION_DAYS, hard-capped at 30). Startup deletes older rows before the bot reports ready. Legacy raw history from older schema versions is purged on migrate. Raw message text in an explicitly configured archival guild is exempt from this time-based deletion and remains until an authorized privacy deletion or operator deletion.
Feedback rows older than that retention window are also deleted on cleanup.
Assistant action/undo history is exact-user and exact-scope, expires within the same 30-day retention window, and is included in privacy export and deletion.
Active moderation cases, unresolved incidents, open tickets, scheduled digests, and pending onboarding follow-ups remain while operationally needed. Once closed, resolved, disabled, or delivered, their typed community records follow the server's content-retention cleanup.
Memories, lessons, quotes, relationships, command specs, economy, swear-jar totals, consents, and guild settings stay until deleted or no longer needed to run the bot. A memory with an explicit expiry is hidden after that time and removed during cleanup; superseded memories remain visible to export/inspection until deleted.
Action-audit rows stay for abuse investigation. They are not wiped by /privacy delete.
ToS block records keep hashed evidence, not the original message body.
Unused ToS acceptance links expire after 15 minutes. Keyed network tokens are cleared after at most 30 days; unresolved review records older than that are deleted by retention cleanup. Blocked-network tokens expire on the same window and are removed when the contributing account is unblocked.
Malware scan temporary files are removed immediately after identification and scanning. Only a short SHA-256 prefix and verdict metadata enter an incident or block record; attachment bytes are not retained.
Operator CLI contacts persist until deleted with your user data.

7. Your controls

These work without accepting the Terms, and replies are ephemeral where the slash command is used:

/privacy status — consent, history-feature state, ToS status, links.
/privacy opt-in / opt-out — this exact scope only.
/privacy export — a private JSON file of data owned by, authored by, or explicitly about you: consents, memories, conversations and their summaries, DM-scoped AI trace metadata, relationships, quotes, feedback, interactions, raw messages, DM contact row, dynamic block metadata, and swear-jar totals. Oversized exports are gzip-compressed. The export includes your web ToS acceptance status and keyed network token while retained, including any blocked-network token sourced from your id. Subject-linked cases, notes, appeals, incidents, tickets, and onboarding records use the same community-record ownership coverage. This is not a complete dump of the database.
/privacy delete — after a confirmation click, deletes your memories, conversations, conversation summaries, DM-scoped AI traces, relationships, quotes, feedback, interactions, raw messages, consents, authored community commands, economy, DM contact, CLI sessions, ToS web challenges/acceptance records, blocked-network tokens sourced from your id unless a confirmed-malware security block is retained, ordinary dynamic block row, and user flags (including ToS acceptance and STT consent), plus swear-jar totals. It also revokes in-memory STT sessions. A confirmed-malware security block is minimized instead of deleted and continues to deny bot access.
/tos opens web acceptance; /tos reject revokes it.
/dmblock / /dmunblock — stop or allow the operator DM-relay from messaging you. Relayed DMs name the requester unless sent as anonymous by that tool's rules.

What /privacy delete does not erase (this is a real gap, not an oversight we are hiding):

action_audit rows that name you as actor or target;
guild knowledge-base passages;
guild lessons distilled from mixed feedback;
guild_settings;
the operator's static environment block list;
a minimized confirmed-malware security block retained to prevent immediate block evasion; guild/channel/tag/history details are erased;
quotes or memories that are about you but stored under another subject id, except those the delete query already matches as subject or about/author;
anything Discord or a model provider retained;
operator backups of the SQLite file if they make any (the running code does not upload the DB anywhere by itself).

Moderators with view_audit_log can inspect another member's relationship/intelligence in the current server. They cannot read other servers or your DMs through the bot. Memory is exact-scope: a guild cannot see another guild's facts.

8. Children

owaua is not directed at children under Discord's minimum age. We do not knowingly store extra data to identify children. Sexual content involving minors is banned and is a ToS-block category. If you believe a child's data is in this instance, contact ckazros@owaua.com.

9. Security

The database is a file on the host. Access is whoever can read that server (the operator, and in principle Daki staff or anyone with the panel/SFTP credentials). Public legal HTTP pages send default-src 'none' CSP and no cookies. The dedicated acceptance route permits only a same-origin form and carries an opaque, short-lived capability linked server-side to one Discord id; the id is not exposed in the URL. Exports are sent as an ephemeral Discord attachment to you, not published. Evidence of ToS violations is hashed. Provider API keys live in the server's .env.

This is not a certified security programme. A compromised Discord token, Daki account, or API key would expose data. Report issues to ckazros@owaua.com.

10. International processing

The bot host is in Germany (Daki). Discord, Cloudflare, and most configured model APIs are outside your country, often in the United States. If you use owaua, your prompts and identifiers may leave the EU. This instance does not implement Binding Corporate Rules or a named SCC packet in code. If that is not acceptable, do not use the bot and use /privacy delete.

11. Legal bases (EU/UK readers)

We are not a law firm. In plain terms the operator relies on: performing the service you requested after ToS acceptance; consent for raw history and STT; legitimate interests in stopping CSAM, doxxing, token theft, prompt-leak abuse, and block evasion (hashed evidence, strike counters, time-limited keyed network tokens, hard-blocks of later acceptance visits from a matching network, and refusal of VPN, proxy, Tor, and hosting networks during web acceptance); and Discord's position as the platform you already have an account with. You can withdraw consent, reject the Terms, or delete as described above.

12. Changes

Material changes bump LEGAL_VERSION. Your previous acceptance becomes invalid and ordinary commands stay locked until you accept the new version. /privacy remains available.

13. Contact

Privacy and security: ckazros@owaua.com.

If this page and the running code disagree, the code wins and the page is wrong. Please report that.