Privacy, without the fog.

1. Scope

This policy covers The Squatch Bot, its Discord commands and status messages, and this website. Discord processes information under its own Privacy Policy. Game platforms and server operators may have separate policies too.

In this policy, “Discord server” means a Discord community and “game server” means the Steam, Minecraft, FiveM, or ARK endpoint that Squatch monitors.

2. Data we process

Discord identifiers

When a manager publishes a monitor, Squatch stores the Discord server, channel, status-message, and creating-user IDs. These numeric IDs let Squatch enforce server-scoped management, find the public status message, and remove the correct monitor.

Game-server configuration and status

Squatch stores the selected platform, submitted hostname or IP address, game and query ports, resolved public IP, discovered connection method, server name, current player count, map and game names, password/VAC flags when available, poll timestamps, recent error state, and display settings. Display settings can include chosen fields, custom labels, status text, and up to three HTTPS links.

Server analytics

For saved monitors, Squatch records hourly totals for availability, population, capacity, query latency, and the metric types the platform actually exposes. It also keeps map-frequency totals. When Steam or FiveM provides a genuine public player list, Squatch can count observed unique players and sessions. Player analytics store a server-scoped HMAC-SHA-256 key derived from the normalized player name, plus first/last-seen times and connection-duration counters. They do not store the raw player name in the analytics tables. These keys are pseudonymous, not anonymous: someone with the secret and a guessed name could reproduce a key.

Operational events and logs

Query-event records can contain the monitor and Discord server IDs, platform, queried endpoint, query phase, success state, attempt number, duration, error class/message, player count, changed fields, whether the embed changed, and limited diagnostic details. Structured runtime logs contain timestamps, event names, technical context such as monitor IDs/endpoints, and redacted errors. A failed interactive control can also put its Discord custom-control identifier, which may include a user or monitor ID, into process output.

Identity tools

Inputs to /tools steamid and /tools minecraftid are used to request public Steam or Mojang profile data and return a private Discord response. The bot does not insert those lookup inputs or results into its application database.

Website requests

The website code does not set first-party cookies, create browser storage, or run an analytics tracker. It loads fonts from Google Fonts and the optional Three.js library from jsDelivr, so those providers receive the ordinary network information your browser sends, such as an IP address and user agent. The web host may also retain standard access or security logs according to its configuration.

3. What the current code does not collect

• Ordinary Discord message content or attachments. Squatch requests guild and guild-message events only so it can operate commands and detect deletion of its own status message; it does not request Discord’s privileged Message Content intent.
• Discord passwords, login tokens, email addresses, phone numbers, payment information, precise location, voice, or video.
• Discord member lists, direct-message history, friends, presence, or typing activity.
• Player identities for Minecraft analytics, Bedrock rosters, or ARK rosters. Those protocols do not provide a dependable complete identity list, so Squatch does not infer one.
• Advertising profiles, cross-site tracking IDs, or data sold to advertisers or data brokers.

This list describes the application code, not information Discord, Google, jsDelivr, a web host, or a game-server operator may process independently.

4. How data is used

• Query the game server and publish or refresh the status requested by a Discord server manager.
• Provide private management and analytics views to members with Discord’s Manage Server permission.
• Coordinate repeated queries, recover from temporary failures, prevent duplicate monitors, and keep the service reliable.
• Diagnose delivery and query failures, protect the service, and improve supported-game compatibility.

Squatch does not use Discord API data for advertising, sell it, or use ordinary Discord messages to train machine-learning models.

5. What becomes public

Setup previews and analytics responses are ephemeral Discord responses. Nothing is posted publicly until a manager chooses Publish Server or Express Setup.

A published status message can show the game server’s name, connection address and port, online state, map, game, player count, security flags, custom labels/links, and player names or connection details when that game server publicly returns them and the manager leaves those fields visible. Anyone who can view the selected Discord channel can see that message under the channel’s current permissions.

If a Steam game has not completed Squatch’s compatibility review, the bot can privately send the configured operator account the fetched App ID, server/game names, requested and resolved endpoints, map, capacity, version, security flags, and discovery source. That review message does not include the requesting member or Discord server identity.

6. Storage and retention

• Unpublished setup: controls expire after 30 minutes of inactivity. Drafts are removed immediately on cancel or successful publish, opportunistically during later setup activity, or when the bot restarts; there is no exact 30-minute physical-deletion timer.
• Shared query results: successful status payloads, which can include public player names, are cached in Redis for 15 seconds. Query locks expire after 30 seconds.
• Steam app names: cached in process memory for 24 hours and Redis for 7 days.
• Saved monitors: configuration and latest status metadata remain until the monitor is removed or its Discord status message is deleted.
• Hourly analytics: retained for 90 days.
• Player and map aggregates: retained for the life of the saved monitor and deleted with that monitor.
• Query events: successful events are retained for 7 days and failed events for 30 days. They can remain for that window after a monitor is deleted.
• Daily application log files: scheduled for removal after 14 days by default. The same structured entries are written to process output, whose retention depends on the hosting configuration.
• Steam compatibility reviews: the Steam App ID and review state are retained as a platform-level compatibility record; no requesting member or Discord server ID is stored in that record.
• Operator-created database backups: can contain the durable records above. The current backup script does not apply an automatic expiry; backup retention depends on operator and infrastructure procedures.

Backups, security investigations, or legal obligations may require limited additional retention. When no longer needed, information should be deleted or de-identified.

7. Services and sharing

Squatch sends only the information needed for a request to the relevant service:

• Discord: interactions, ephemeral replies, status messages, and the IDs needed to fetch or edit them.
• Game servers and DNS providers: network requests to the manager-supplied public endpoint and domain lookups needed to find it.
• Valve and Steam: server discovery, app-name metadata, and public profile lookups. A configured server-side Steam API key may be used for profile lookup.
• Mojang: public Minecraft Java username, UUID, skin, and cape lookup requests.
• Cfx.re/FiveM and ARK: public server metadata endpoints or official directory data used for status checks.
• Infrastructure providers: PostgreSQL, Redis, logging, and hosting services acting for the operator.

Squatch may also disclose information when legally required, to investigate abuse or security incidents, or during a service transfer subject to appropriate safeguards. It does not disclose Discord API data to advertising networks or data brokers.

8. Your controls and deletion

Discord server managers can use /server manage to edit or remove a monitor. Deleting Squatch’s published status message removes its saved monitor when the bot observes the deletion or later finds the message missing, including its linked hourly, player, and map analytics. Recent query-event and log records follow the shorter schedules above.

To ask for access, correction, or deletion beyond those controls, use the support contact published on Squatch’s Discord application profile. Include the relevant Discord server ID and monitor details; never send a password or bot token. We may need to verify that you are authorized to act for that Discord server.

Before removing Squatch from a Discord server, an administrator should remove its saved monitors or status messages. The current code does not automatically purge a Discord server’s records merely because the bot is removed from that server.

9. Security and age

Squatch limits Discord permissions, validates public network targets, bounds upstream responses and timeouts, stores secrets in server-side configuration, and redacts token-, password-, secret-, cookie-, authorization-, Redis-, and database-related fields from its structured logger. No method of storage or transmission is completely secure.

Squatch is not directed to anyone below the minimum age required to use Discord in their country. If you are not eligible to use Discord, do not use Squatch.

10. Contact and policy changes

For privacy questions, requests, or reports, use the support contact shown on Squatch’s Discord application profile. Discord privacy questions should be sent to Discord through the contact options in its own privacy policy.

This policy may change when Squatch’s features, data practices, providers, or legal obligations change. The effective date above will be updated, and material changes will be announced where appropriate.