Privacy Policy

Last updated: 27 October 2026

We do not sell or share personal information. We never sell personal data. We never share it with advertisers or data brokers. Ali1 has no advertising and no tracking scripts.

Who we are

Ali1 is a free Discord bot with a web dashboard, run by SantosHosting.net (“we”). Questions, data requests and removal requests go to deputyryan32@gmail.com. We answer within 30 days. This page describes what the bot and the dashboard really do today. If that changes, we change this page.

What we collect

When you sign in to the dashboard

Your Discord user ID, display name and avatar, so we can show who is signed in.
The list of servers you are in, with your permissions there, so we can show the servers you can manage. It is cached for 5 minutes.
Your roles in a server, when its admins limited a module to certain roles, so we can tell whether you may edit it. This needs the “guilds.members.read” permission that Discord asks you to approve. The roles are cached for 5 minutes.
Your Discord access token and refresh token, so the dashboard can keep you signed in. They are encrypted before they are stored and are never sent to your browser.
A random session ID in a cookie, the time you signed in, and the last server and module you opened.
Your IP address, as a counter in a temporary rate limit that expires within 60 seconds. We do not keep IP addresses anywhere else.

When Ali1 runs in a server

What Ali1 stores depends on which modules the server’s admins turn on. Every module is off until an admin turns it on. Everything below is tied to your Discord user ID and the server.

Levels and achievements: your XP, level, prestige, unlocked achievements, and counts of messages and starboard posts. Message text is not stored.
Moderation: warnings and cases, with the reason and the moderator, made by the server’s staff.
Birthdays: the month and day you set, a year if you add one, and a time zone if you add one. Your time zone is also saved when you set one for reminders.
Reminders: the text you ask to be reminded of, where and when.
Suggestions and polls: the text of your suggestions, your votes, and polls you create.
Giveaways: giveaways you host and the ones you enter, and whether you pressed the claim button when a winner has to claim the prize.
Games: how many games you won, your win streak and your tournament points in each server, and the day you solved the daily challenge. Games in progress are kept in memory only.
Counting game: the number a server has counted to and the last member who counted.
Dashboard audit log: when you change a server’s settings on the dashboard, your Discord ID and display name are stored with the time and the names of the settings you changed (not their values), and are shown to that server’s owner and administrators.
Tickets: who opened a ticket, its type, who claimed it, why it was closed and your rating. The conversation is turned into a transcript file that is posted to the server’s log channel or sent to you. Ali1 does not keep the transcript.
Verification: how many wrong answers you gave and until when you must wait.
Temporary voice channels: which member owns a room.
Logging: if an admin turns it on, Ali1 keeps recent message text, author and attachment links in a temporary cache so it can show what was edited or deleted. It is in Redis only, never in the database, and is deleted after the number of hours the admin chose (1 to 168, 24 by default). The log entries themselves are posted into a channel in the server, where Discord and the server’s admins hold them.
Timers: scheduled jobs such as a birthday announcement, a reminder or a ban that ends, which name the member.
Opt-out: if you use /optout, your user ID is kept on a list so Ali1 knows to leave you out.

Message text is otherwise read only to react to it, for example to give XP or answer a keyword, and is not stored.

If you own a server that uses Ali1

Your Discord user ID, as the owner of the server, and the server’s name, ID and member count. The bot gets these from Discord when it joins. We use them to reach you about the service (see “What the operator can do”) and to know who may delete the server’s data.
If a server or a member is blocked for abuse, the ID that was blocked, the date and a short reason we wrote.

When you visit the website

Pages are served without third-party scripts, ads or analytics. Fonts and images are served from our own site. When you are signed in, your browser loads avatars, server icons and custom emoji from Discord’s CDN, which tells Discord your IP address as any Discord image would.

Why, and on what basis

To run the bot for a server: our legitimate interest, and the interest of the server’s admins who set the bot up. Admins decide how the bot is used in their server, and they are responsible for telling their members what they record.
To keep you signed in to the dashboard: your consent, which you give by signing in with Discord. You can withdraw it at any time, see “Your rights” below.
To keep the service safe from abuse, with rate limits and with blocks on servers or members who abuse it: our legitimate interest.
To tell server owners about the service, such as an outage, a feature that changes or a change to these policies: our legitimate interest, and the interest of owners who rely on the bot.

Who can see it

Server admins and staff can see what the modules show them in their server, such as warnings, tickets, levels and the settings.
Other members see what the bot posts in channels, such as a level-up or a birthday message.
We can see what is in our database and Redis. We use that only to run the service and to answer requests.
The person who runs Ali1 has a small set of tools inside Discord, described in the next section. They are limited by design, and only that one Discord account can use them.
The providers below, as described there.

What the operator can do

The person who runs Ali1 (the “operator”) has a set of private pages on the dashboard. Only the operator’s own Discord account can open them, they do not exist for anyone else, and the most serious actions need a Discord sign-in from the last few minutes. Every change is written to a log. With these pages the operator can:

See how the bot is doing: the number of servers and members, uptime, memory and the number of waiting timers.
Look up a server: its name, ID, owner, member count, when the bot joined, which features are turned on, and any status set on them.
See a limited view of a server’s settings for support: switches, numbers and choices are shown. Anything an admin wrote (messages, names, webhook addresses) and every channel, role and emoji is shown only as “set” or “empty”, and lists as a number of entries. Message text, members’ records and moderation cases are not shown by these tools.
Turn a feature off, pause it for an update, or mark it as being tested, for every server or for one. The dashboard then shows that status on the feature’s page. Settings are kept.
Send a direct message to a server’s owner, or to all owners, about the service. Each message says why the owner got it. Owners who ran /optout stop are left out of announcements to all owners.
Block a server or a member who abuses the bot. A blocked server is left by the bot. A blocked member cannot use commands. Only the blocked ID, the date and a short reason are stored.
Make the bot leave a server. That starts the 30 day deletion described below.
Run the service: see how many timers are waiting and of which kind (no names), ask the bot to refresh a server’s channel and role lists, restart the bot, and edit the development tracker and two short site texts (a notice on the home page and a banner on the dashboard).

These pages do not give the operator a way to read members’ messages. The operator and the host can still reach the database and Redis, as the section “Who can see it” says, and use them only to run the service and to answer requests.

Who handles the data

SantosHosting.net runs Ali1.
OVHCloud provides the hosting infrastructure where the bot, the dashboard, the database and Redis run.
Cloudflare sits in front of the website as a proxy. It sees the requests to the site: your IP address, the pages you ask for, request headers and cookies, and the content passing through.
Discord is a separate service with its own privacy policy at discord.com/privacy. It provides your account, your servers and the messages. We receive from it what its API gives a bot and what you allow when you sign in.

Because of these providers, data may be processed outside the country you live in.

We do not sell personal data, we do not share it with advertisers or data brokers, and we use no other processors.

How long we keep it

A cleanup job runs once a day. The numbers below are the defaults; admins can choose a shorter time where the table says so.

Data	Kept for
Dashboard session and Discord tokens	30 days after your last visit, or until you sign out
Your server list, last server and module	5 minutes, and 90 days
IP address in rate limits	Up to 60 seconds
Cached message text (Logging)	24 hours by default, 1 to 168 hours as the admin chooses
Warnings and moderation case details	365 days by default. The admin can choose a shorter time, 7 days at the least. Older cases stay as a number without names. An active ban stays until it ends. Erasing your data does not remove warnings from the last 30 days, so a warning cannot be hidden by erasing.
Closed ticket details (who opened and claimed it)	90 days by default. The admin can choose a shorter time
Ended giveaways and their entries	90 days by default. The admin can choose a shorter time
Dashboard audit log (your ID, display name and what you changed)	180 days
Finished suggestions, ended polls and their votes	365 days by default. The admin can choose a shorter time
Reminders	Until they are sent. One-off reminders that never went out are deleted after 30 days. Repeating reminders stay until you delete them.
Verification counters	Until you pass. Counters of members who were blocked are deleted 30 days after the block.
XP, levels, achievements, birthdays, time zone, voice room owner, pending suggestions	Until you delete them, or the server’s data is deleted
A server’s settings and records	Until the owner deletes them, or 30 days after Ali1 leaves the server
The operator’s log of what was done on the operator pages (server and member IDs, and the text of messages sent to owners)	365 days
A block on a server or member (the ID, date and reason)	Until the operator lifts it. It is kept if the member deletes their data, because deleting it would undo the block.
A status set on a feature (on, off, updating, testing)	Until the operator removes it, or the server’s data is deleted
Your opt-out entry	Until you use `/optout resume`

Ali1 does not make backups of this data. If the database or server is backed up by the host, deleted data can stay in those backups until they are replaced. We do not control that schedule and do not know it, so we cannot give you a number.

Your rights

You can use these rights wherever you live. The ones you have by law depend on your country, for example under the GDPR, the UK GDPR and the CCPA/CPRA.

Access and portability: sign in and press “Download my data” on the Account page, or run /mydata in Discord. You get a JSON file with everything stored about you across all servers. Or email deputyryan32@gmail.com.
Rectification: change your birthday with /birthday set and your reminders with /remind and /remind timezone. For anything else, email deputyryan32@gmail.com and say what is wrong.
Erasure: press “Delete my data” on the Account page, or run /deletemydata. Deleting from the dashboard asks Discord to confirm your sign-in first. It deletes or anonymizes your data in every server and every module. Warnings you received are deleted. Moderation cases are kept without your name, except a ban that is still active, because a server needs that to stay safe. If you use a module afterwards, new records are made, so run /optout stop first if you do not want that. A block placed on your ID for abuse is the one thing kept, see the table. Or email deputyryan32@gmail.com.
Objection and restriction: run /optout stop. Ali1 then gives you no XP, keeps you out of message logs, does not announce your birthday and does not repost your messages on a starboard. /optout resume turns it back on. Data already stored stays until you delete it. Opting out stops message content logging. Moderation actions (warnings, mutes, bans) are still recorded to keep servers safe.
Withdraw consent: press Sign out, which removes your sessions and tokens and tells Discord to cancel the grant, and delete your data if you want. You can also remove Ali1 under Authorized Apps in your Discord settings.
Complain: you may complain to your data protection authority, for example the Information Commissioner’s Office in the UK, your national authority in the EU, or the California Privacy Protection Agency. We would like the chance to fix it first, so please email us.

If you live in California, you also have the right to know what we collect, to correct and delete it, and to not be treated worse for using these rights. We do not sell or share your personal information.

We answer requests within 30 days. We need to know it is you, so we may ask you to sign in with Discord or to send the request from your Discord account.

Server admins

A server’s admins decide which modules run, what they record and for how long within the limits above. They must tell their members what Ali1 records in their server. The Logging, Levels, Tickets and Moderation pages in the dashboard remind them. For questions about what a server does with its members’ data, ask that server’s staff.

When Ali1 is removed from a server

The server’s settings and all records for it are marked for deletion and deleted for good 30 days later. If Ali1 is added back within those 30 days, nothing is deleted. The server’s owner can delete everything at once from the Server data page of the dashboard.

Cookies

We set one cookie that the site needs to work, “ali1_session”, which holds a random session ID, is HttpOnly and lasts 30 days from your last visit. During sign-in we set two short-lived cookies, “ali1_state” and “ali1_next”, that last 10 minutes and protect the sign-in. Your browser also keeps which sidebar groups you closed and your scroll position, on your own device only. We use no analytics, advertising or tracking cookies, so we show no cookie banner. Cloudflare may set its own cookies for security. We do not control them.

Children

Ali1 is for people aged 13 or older, the minimum age for Discord. We do not knowingly keep data of children under 13. If a server or a parent tells us a user is under 13, email deputyryan32@gmail.com and we delete that user’s data.

Security

Discord tokens are encrypted before they are stored, and are never sent to your browser.
The session cookie is HttpOnly and SameSite, and Secure on HTTPS. Every change made on the dashboard is checked against your Discord permissions on the server.
Downloading and deleting data are rate limited, and deleting needs a recent sign-in.
The operator pages open only for one Discord account, ask for a confirmation and a recent Discord sign-in before anything that cannot be undone, and keep a log.
We do not write tokens, secrets or message text to logs on purpose, and the bot removes the request body from Discord errors before they are logged.
No system is perfectly secure, so we cannot promise that nothing will ever go wrong.

If something goes wrong

If personal data is exposed, we find out what happened, stop it, and tell the people affected and the authorities where the law requires it, within 72 hours of learning of it where that applies. We write down what happened and what we did.

Changes

When we change this page, we change the date at the top. For a change that matters, we also say so on the home page of the website.

Contact

deputyryan32@gmail.com