Privacy Policy

Last updated October 20, 2026

This explains what Elarix stores, why, who it's shared with, how long it's kept, and how to get a copy or have it deleted.

Who's responsible

Harley Swaney runs Elarix and is the data controller for the data described here. For anything about your data, contact privacy@hugobot.online.

What Elarix stores

• Discord IDs of servers, channels, roles, users and messages, so features know where to act.
• Server settings that admins choose (log channels, welcome messages, automod rules, role menus and so on).
• AI API keys that server admins add for AI features. They're stored encrypted, only used for that server's requests, and deleted with /ai removekey or when the server's data is deleted.
• Things created with Elarix: warnings and their reasons, ticket details and ratings, suggestions and votes, reminders, birthdays (month and day only, never the year), auto-responder text, giveaways and entries, stream alert subscriptions, starboard entries, counting and word-chain progress.
• Activity stats: XP and message counts for levels (plus total minutes spent in voice channels, if a server turns on voice XP; for that Elarix only counts the minutes and doesn't listen to audio), and coin balances for the economy. If a server's admins import levels from another leveling bot, Elarix copies each member's user ID, XP and message count from that bot's public leaderboard for the server.
• Server insights: daily counts of messages per channel, per hour and per member, and of joins and leaves, so server admins can see how their server is doing. Only numbers are stored, never what anyone said. Kept for 90 days. If a server turns on the weekly recap, Elarix posts that week's totals in the channel they pick; on Premium servers the recap also names the three most active members (without pinging them). People who opted out of activity stats are never named.
• Invite tracking (only if a server turns it on): which invite each new member used, who created it, when they joined or left, and whether the account was brand new.
• Things admins set up: saved message templates and the feeds (YouTube channels, subreddits, RSS links) a server follows.
• Usage stats: which slash commands are run, when, in which server, whether they worked and how long they took. Your user ID isn't stored: to count unique users, Elarix uses a code that changes every day and can't be traced back to you. Kept for 90 days so we can fix bugs and see which features people use. Command options (what you typed) aren't stored.
• Website visits: daily totals per page area. To count unique visitors, your IP address is combined with a random key that changes every day and is only kept in memory, so visits can't be traced back to you or linked across days. IP addresses aren't stored.
• Twitch streaks (only if you link your Twitch with /streak link): your Twitch user ID and name, and in servers that use streak roles, the best watch streak you shared in that server's Twitch chat and when. See “Twitch streaks” below.
• Your privacy choices: whether you opted out of activity stats, and in which servers you agreed that Elarix's voice assistant may hear you.
• Bug reports: what you write with /elarix bugreport, your user ID and the server you sent it from, so we can fix the problem and reply to you. If we reply, Elarix sends it to you by DM.
• Blocks: if someone abuses Elarix, we can block their user ID or a server's ID, with a short reason. Elarix then ignores that user or leaves that server.
• Premium purchases: for card subscriptions, your Discord user ID, the server it's for, the plan, its status and renewal date, the Stripe customer and subscription IDs, and the amount and date of each payment, so Premium follows your subscription and problems can be sorted out. Stripe handles the payment itself and keeps your card, email and billing details; Elarix doesn't store them. For subscriptions bought inside Discord, Discord handles the payment and only tells Elarix who subscribed, when, and whether it's still active; Elarix stores that with the server you picked. Elarix never sees card or bank details for either.

Message content

Elarix reads messages as they arrive to run features like automod, the word filter, the honeypot channel, message logs, auto-responders, counting, AI chat and AI moderation. Message text is processed in memory and not stored, except where a feature needs it: suggestion text, reminder text, words played in word chain, and the reasons given for warnings. Message logs and ticket transcripts are posted into your own server's channels (and ticket transcripts are also sent to the ticket's opener by DM). Elarix does not keep its own copy.

Public server pages

A server's admins can turn on a public page for their server at elarixbot.com/s/… It shows the server's name, icon, banner and description, member and online counts, how many messages were sent and how many people joined in the last 7 days, and, if the admins choose, the top 10 members by XP with their display name, avatar and level. Anyone with the link can see the page, and search engines only list it if the admins allow that. You can hide yourself from every server's page at any time with /elarix privacy (members who opted out of activity stats are hidden automatically).

Twitch streaks

If a server turns on Twitch streaks, Elarix reads that streamer's public Twitch chat without an account and only acts on one kind of message: Twitch's own notice when a viewer shares their watch streak (“watched 10 streams in a row”). Chat messages are not stored. When you run /streak link, you approve a code on Twitch; Elarix uses that login once to read your Twitch user ID and name, then gives it back to Twitch (revokes it). It asks for no other permissions. Elarix then saves your streak when you share one, and gives the server's streak roles. If someone who hasn't linked shares a streak, Elarix remembers only their Twitch ID and the number, in memory, for 24 hours (so linking right after still counts). /streak unlink removes the link, and /elarix privacy deletes it with the rest of your data.

Voice assistant

If a server turns it on, members can talk to Elarix in a voice channel by saying “Hey Elarix”. Elarix only listens:

• while it's in a voice channel because someone asked it to join (/voice join). It posts a notice in the channel and shows a status that it's listening;
• to members who agreed to it (/voice optin). Elarix never decrypts or processes audio from anyone else in the channel; it's discarded as it arrives. You can withdraw at any time with /voice optout.

Elarix listens for “Hey Elarix” on its own server, so what you say doesn't leave that server unless you say the wake word. The sentence that starts with “Hey Elarix” is sent to Google Gemini (with the server's own API key) to understand it and write an answer. Elarix then reads that written answer out loud with a voice that Google Gemini also generates (only Elarix's answer is sent for this, never your voice); if that isn't available, Elarix uses a backup voice generated on its own server. Right after Elarix answers you, your next sentence within 8 seconds is treated the same way, so you can ask a follow-up without saying “Hey Elarix” again. Elarix doesn't record or save your voice or what you said: audio is kept in memory only while you're speaking, and the last few questions and answers are remembered only while Elarix is in the channel (so follow-up questions work), then forgotten. If the server chose it, Elarix also writes its answer in the voice channel's chat. If you ask Elarix by voice to set a reminder or start a poll, it saves that the same way as /remind me or /poll create (the reminder note or the poll, never the audio). If a server turns on moderation by voice and the speaker is a moderator, the display names of the members in that voice channel (and the names of the server's voice channels) are sent along with the sentence, so Elarix knows who they mean. Mutes, deafens, disconnects and timeouts done by voice are saved as moderation cases, the same as ones done with a slash command, and posted to the server's mod log.

Who data is shared with

• Discord, which runs the platform Elarix works on.
• Google (Gemini AI): when someone uses AI chat, roasts, ticket summaries, translation or the voice assistant, or if a server turns on AI moderation, the relevant messages (and any images Elarix is shown or asked to check, or the spoken sentence that started with “Hey Elarix”) are sent to Google to generate a response, using the API key that server's admins provided. On free keys Google may use what it's sent to improve its products, so Elarix only uses a key once the server's admins confirm it has billing turned on or belongs to someone in the EEA, Switzerland or the UK; in both cases Google's terms don't allow it to use the data to train its models. Servers that don't turn on AI features never send anything to Google.
• Anthropic (Claude AI): in Elarix's own support server, AI chat, roasts, ticket summaries, translation and AI moderation are answered by Anthropic's Claude with Elarix's own key, so the relevant messages (and any images Elarix is shown) go to Anthropic instead of Google; if Claude can't answer, Google Gemini does. Anthropic's commercial terms don't allow it to train its models on this data. The voice assistant there still uses Google, because Claude can't process speech.
• YouTube: music searches and links are sent to YouTube to find and stream songs.
• Weather and Wikipedia: when someone asks the voice assistant about the weather or something to look up, only the place name or topic is sent (never who asked) to OpenStreetMap's place search and the Norwegian Meteorological Institute, or to Wikipedia.
• Twitch: when you link your Twitch, the login happens on Twitch, and Elarix asks Twitch who you are. Reading a streamer's chat sends nothing about you to Twitch.
• Feed sites (YouTube, Reddit, or any site a server adds as a feed): Elarix checks their public feeds for new posts. No information about you is sent to them.
• Other leveling bots: when a server's admins import levels, Elarix asks that bot's public leaderboard for the server's ID. Nothing about members is sent to it.
• Stripe and Discord handle Premium payments. When you pay by card, Stripe gets the server's name (on the subscription), your Discord user ID and the server ID, so the payment can be matched to the right server.
• Google Drive stores Elarix's off-site backups. They're encrypted before they leave our server, so Google can't read them.

Elarix does not sell data and doesn't use it for advertising.

Where data is stored

Elarix's server is in the United States. Discord and Google are based in the United States. When data about people in the EU or UK goes to these places, it's protected by the providers' Standard Contractual Clauses or the EU-US Data Privacy Framework.

Why we use it (legal bases)

• Running the features a server turns on (moderation, levels, tickets, reminders and so on): our and the server's legitimate interest in running a useful, safe community. Using a feature yourself (e.g. setting a birthday) is also you asking for it.
• Moderation records (warnings, cases, staff notes): the server's legitimate interest in keeping its community safe.
• Usage stats, insights and invite tracking: legitimate interest in fixing bugs, improving Elarix, and helping admins understand their server. You can opt out (see below).
• Premium purchases: needed to deliver what was bought (contract), and kept for accounting (legal obligation).
• AI features: the server's legitimate interest, when its admins turn them on with their own key.
• Twitch streaks: you asking for it, by linking your Twitch account (you can unlink any time).
• Bug reports and blocks: our legitimate interest in fixing problems you tell us about and keeping Elarix safe from abuse.
• Voice assistant: your consent, which you give with /voice optin and can withdraw any time with /voice optout.

Web dashboard

The dashboard uses a single login cookie so you stay signed in. It doesn't use tracking or analytics cookies.

How long data is kept

• Server data is kept while Elarix is in that server. When Elarix is removed, the server's data is deleted after 30 days (so an accidental kick doesn't wipe everything).
• When you leave a server, your own data there (levels, coins, birthday, reminders, votes and the like) is deleted 90 days later (sooner if that server chose a shorter period), unless you come back. Moderation records, tickets and modmail stay while Elarix is in that server.
• Server insights and command usage stats are deleted after 90 days, error reports and Elarix's system logs after 30 days.
• Bug reports are deleted 90 days after we've handled them, and after a year at the latest. Blocks stay until we lift them.
• Payment records are kept for 7 years for tax and accounting, then deleted.
• Backups: encrypted daily copies on our server are kept for 14 days, encrypted off-site copies for 30 days. So deleted data fully disappears from backups within 30 days of being deleted (within 60 days of Elarix being removed from a server).

Your rights

Wherever you live, you can:

• Get a copy of your data: use /elarix privacy → Download my data for an instant file (JSON, which also covers data portability).
• Delete your data: /elarix privacy → Delete my data erases it in every server. Things you set up for a server (auto-responders, polls, templates) stay without your name. Moderation records (warnings, cases), tickets and modmail threads stay in each server's history but anonymous: your ID and the details are removed, and staff notes about you are deleted. A ban, timeout or temporary role that's still running, or a ticket that's still open, is made anonymous when it ends. Payment records are kept, because tax and accounting law requires it, and so is a block for abusing Elarix, so it can't be undone by deleting data.
• Object to activity tracking: /elarix privacy → Opt out of activity stats. You'll still count toward totals, but never under your name in insights, command stats or invite tracking.
• Correct data, restrict how it's used, or ask about anything not covered above by contacting privacy@hugobot.online. We answer within one month. To protect your data, we'll first confirm the request really comes from the owner of that Discord account (usually by asking you to use /elarix privacy or to message us from that account).
• Complain to your data protection authority (in the EU, the one in your country; in the UK, the ICO) if you think we've handled your data wrongly. We'd appreciate the chance to fix it first.

Server owners can download everything Elarix stores for their server, or delete all of it at once, with /data or on the dashboard's Data & privacy page. Server admins can delete one member's data in their server and choose to delete departed members' data and activity stats sooner than the defaults. Server admins can also turn off any feature or remove Elarix at any time. Discord requires users to be at least 13 years old (older in some countries), and Elarix is meant for the same audience.

Security

Data is stored on a server controlled by Elarix's operators. The database isn't reachable from the internet, AI keys are stored encrypted, server access needs a cryptographic key, Elarix runs in a sandbox, and all backups are encrypted. No system is perfectly secure, but if a breach ever puts your data at risk, we'll tell Discord and the relevant authority (within 72 hours) and let affected users know.

Changes

We'll update this page if Elarix's data handling changes, and change the date at the top.

Contact

Join our support server or use /elarix bugreport in Discord.

← Back