Privacy Policy

Information Cyra handles

The information involved depends on which features you use or your server enables. Cyra receives information through Discord and from content you provide:

• Discord information: user, server, channel, role and message identifiers; names, avatars, membership and permissions needed for the requested feature. Names and images can be retrieved from Discord when a response is prepared.
• Dashboard sign-in: Discord account ID, display name and avatar; your server list and permissions to identify servers you can manage; and a short-lived Discord OAuth access token stored encrypted on the server. Team access and reviewer permissions are checked separately.
• Profiles: your user identifier, bio, status, accent color or palette, and links you choose to add.
• Personal tools: AFK status and reason, and reminder text, delivery time, recurrence and delivery status.
• Server configuration: welcome messages, images and links, role and channel choices, enabled modules, log settings and records of configuration changes.
• Moderation: the affected member and moderator identifiers, action, reason, timestamp and case status.
• Antiscam, when enabled: per-server settings, known-image fingerprints and exceptions, incident metadata (detection rule, domains, a hash of the message content, Discord identifiers and time), reviewed network cases and delivery records. Antiscam evidence does not store the full message body or download linked pages.
• Community features: polls, options and votes; suggestions, votes and review decisions; giveaway participation and winner history; and temporary voice-room ownership and configuration.
• Support tickets: ticket and channel identifiers, participants, panel configuration, opening and closing information, and any transcript generated when a ticket is closed.
• Social features: public creator handles, profile or media links and content retrieved for a request, notification destinations and the last update identifier used to avoid duplicate notifications.
• Levels and voice preferences: XP, level, counted messages and last XP activity per server; and global room name and capacity preferences chosen by the user.

Cyra does not ask for your Discord password. The dashboard offers Discord sign-in. Cyra does not collect payment details.

Messages, logs and ticket transcripts

Cyra can receive server message content through Discord when permissions and features allow it, including to clear AFK status, respond to mentions and handle optional message logs. This is not a general archive of every server conversation.

Message-edit and message-deletion logging, and voice-event logging, are off by default. If an administrator enables them, Cyra may send event information and available message content to configured Discord log channels. Message content for these event logs is not stored in the bot's database. Voice events concern channel activity such as joining or leaving; Cyra does not record voice audio.

Tickets are different: closing a ticket can generate an HTML transcript of up to 1,000 messages, including author display names, timestamps, message text and attachment links, and send it to the configured ticket log channel. Staff and others with access to that destination may read or download it. Ticket metadata and closing reasons are also stored by the bot.

Reminders, suggestions, poll questions, welcome templates and profile text are stored because their features need that content. Avoid including sensitive information in those fields or in support tickets.

Antiscam and reviewed network cases

When a server enables antiscam, Cyra inspects supported image attachments and repeated linked messages. Incidents, account identifiers, evidence and staff decisions stay in the source server and the authorized Cyra review workspace. Other server administrators do not receive that user’s incident history or evidence. Approved image fingerprints can detect the same scam image in another server; that server applies its own Observe or Protect mode and local Review, Timeout, Kick or Ban setting. Ordinary bans are not propagated. Contact support privately to challenge a detection or request a correction.

Private incident previews are sanitized JPEG files, reduced to at most 512 pixels and limited to ten per incident. They may be viewed by authorized Cyra reviewers and attached to a private moderation alert in the source server. They expire from Cyra storage after seven days. Original attachments are not archived. Unlinked incidents expire after seven days; withdrawn or expired reviewed cases are removed after thirty days, once legacy actions are resolved. Permanent reviewed cases remain until withdrawn and can be challenged through support. Historical evidence copies already posted to Discord may remain there; Cyra attempts to remove tracked alerts previously shared with other servers.

A scam-image report stores a sanitized JPEG preview, fingerprints, category, reason, source identifiers and submission time for private team review. Only authorized reviewers can approve or reject it. Approval activates a global image fingerprint; reporting alone does not sanction the author. Reports are limited to 50 pending per server and 1,000 overall. Pending reports expire after thirty days. Rejected or retired reports are removed thirty days after review, and approved previews are retained for at most ninety days after approval. Active image fingerprints remain until removed; they are not a global list of accused users.

Why this information is used

We use information to run the feature requested by a user or configured by an authorized server administrator, apply permissions, keep server data associated with the correct server, maintain persistent settings, prevent duplicate actions and diagnose service failures.

Cyra does not sell personal information, use Discord data for advertising, or use Discord message content to train AI models. Where applicable law requires a legal basis, processing is based on providing the requested service, legitimate interests in operating and securing it, consent where required, or compliance with legal obligations. You can ask the maintainers about the basis applicable to your request.

Who can see information

Your Cyra profile is a public profile associated with your Discord account and may be shown across servers using Cyra. Share only the bio, status and links you want other users to see. Polls, suggestions, giveaways, welcome messages and alerts appear in their configured Discord channels.

Server staff can access information their Discord permissions allow, including moderation records, log channels, tickets and transcripts. Server administrators control these destinations and may change their permissions. A deletion from Cyra's storage does not remove copies already posted, downloaded or retained by Discord or other users.

Authorized Cyra team may access operating data for support, security and maintenance. Discord receives bot interactions and messages under its Privacy Policy. External creator platforms process requests to their own services when social features are used.

Information may also be disclosed where required by law or reasonably necessary to address fraud, security incidents or threats to users' safety. Service providers can process information in countries other than your own under their own policies.

Dashboard sessions

Signing in requests Discord’s identify and guilds scopes. The access token stays encrypted on the server and is not sent to the browser. Sessions last at most seven days, limited by the Discord token expiry. Signing out deletes that session. Cyra does not store refresh tokens. A cleanup runs at startup and every fifteen minutes, inspecting all session files, independently of new sign-ins. Expired sessions cannot authenticate while awaiting cleanup. You can also revoke authorization in Discord.

Changes made in the dashboard are saved by the bot’s existing services. Global presence/support changes include an audit record identifying the authorized team member and the time. Team members who are trusted antiscam reviewers can access the relevant incident metadata for global review.

Website visits and external resources

The public website displays information and a command catalog. Viewing the catalog does not require a Discord account or send your Discord account data to the bot.

The site is delivered through Cloudflare. Requests can include your IP address, requested URL, browser information and technical headers used for delivery, security and diagnostics. Cloudflare may use security cookies or similar mechanisms under its Privacy Policy.

Fonts are requested from Google Fonts, so your browser contacts Google's servers when loading them. Google's processing is governed by its Privacy Policy. Icons are included with the site and do not require a request to the Iconify API.

Cyra does not add advertising cookies or an analytics tracker to this website. Identity preferences are saved to your Discord account in Cyra. Identity previews can load custom images directly from the HTTPS URLs you enter; those hosts receive the image request. Links to Discord and other websites take you to services with their own privacy practices.

Retention and deletion limits

Retention depends on the feature. Completed or permanently failed reminders are removed after seven days; AFK status after thirty days; configuration audits and completed tickets, polls, giveaways and voice rooms after ninety days; reviewed suggestions ninety days after review; ordinary moderation records after 180 days; and XP records after 180 days without XP activity. Active configuration, identities, links, voice preferences and ongoing community items remain while needed or until a verified deletion request. Removing the bot starts a thirty-day grace period before the server’s stored records are deleted. Returning within that period cancels the pending removal. These cleanups run hourly while the bot is available. Expiry of a stored moderation record does not undo a Discord sanction.

You can request access to or deletion of information associated with your account or server through support. Requests are reviewed for ownership, other users' rights and any applicable legal retention requirements. We do not promise an automatic deletion deadline that the current service cannot enforce.

Encrypted database backups are rotated daily and after deployments, with at most ten copies and a maximum age of thirty days, retaining the newest recovery copy. Verified erasures are recorded in a restricted deletion ledger outside database backups and reapplied before any restore is activated. The ledger is retained to prevent deleted data from returning through recovery. A deletion also includes related records and, for account requests, dashboard sessions. Copies posted to Discord or held by others need separate removal through Discord or the relevant administrators. Private support exports are reviewed for other people’s information and deleted after delivery.

Your choices and privacy requests

• Use /identity delete to delete your stored Cyra identity and profile links after confirmation.
• Edit profile details with /profile customize or manage individual links with /profile links.
• Use /afk clear to clear your AFK status, and /reminder cancel to delete one of your reminder records.
• Server administrators can change feature permissions and destinations, disable log delivery with /logs disable, or remove the bot to stop new server interactions.

Depending on the law that applies to you, you may have rights to access, correct, delete or receive a copy of your personal information, restrict or object to processing, withdraw consent where processing relies on consent, and complain to a relevant privacy authority.

Contact the Cyra maintainers through the official support server to make a request. Describe the request and provide your Discord user ID and, where relevant, server ID. Ask for a private conversation rather than posting personal details publicly. We may need to verify that you control the account or are authorized to act for the server. Never send a password or account token. Requests are handled subject to applicable legal requirements and time limits.

Security

The website uses HTTPS. Operational database files, their auxiliary journals, session files, configuration secrets and managed backups are stored on an encrypted volume. Session tokens are additionally encrypted with AES-256-GCM. Decryption keys are restricted to the server operator and are stored separately from that volume. This protects copied storage, but does not protect against an attacker controlling the running server. Permissions and server scope are checked for bot and dashboard actions. Report suspected exposures privately through support. The team investigates, limits access, rotates affected credentials and notifies Discord and affected users as required.

Age requirements

Cyra is intended for people eligible to use Discord: at least 13 years old and the minimum age required in their country. We do not knowingly collect information from children below that age. If you believe Cyra holds such information, contact the maintainers so it can be reviewed and removed where appropriate.

Updates and contact

We will revise this page and its date when data practices change. Material changes will be announced through the official support server, and additional notice or consent will be provided where required by law.

For privacy questions or requests, contact the Cyra team through the official support server.