TOS and privacy policy

[Tais993]

Is your feature request related to a problem? Please describe.
No privacy policy / TOS

Describe the solution you'd like
Creation of privacy policy and TOS
This also needs to be added to the bot on the developer portal
This should also be added to the bot's about me section (description in the developer portal

[Zabuzard]

I do not think we need or should create one. Discord covers all of that stuff already itself and people explicitly agree to it when joining a server.

Legally its definitely not needed in this case at all. I also dont see a good reason to provide one regardless. And the consequences of providing one that is outdated or legally not fully correct could actually be harmful.

[Zabuzard]

Regarding ToS, what terms are you thinking about?

And are we talking about people using our GitHub code for their own bot projects (cause that is covered by the license already) or about using our bot as an user in our server? In which case everything is covered by our server rules already...

[Zabuzard]

No activity for almost a month. Rejected and closed.

Can be reopened if there are new arguments.

[Tais993]

In which case everything is covered by our server rules already...

Sure, we can forget about TOS

Still, regarding the privacy policy

Discord covers all of that stuff already itself

Technically yes

Developers: Developers using our SDK or API will have access to their end users’ information, including message content, message metadata, and voice metadata. Developers must use such information only to provide the SDK/API functionality within their applications and/or services.

It's really really vague, this tells the user absolutely nothing, it's useless tbh

From the Discord Developer TOS (2a):

You will provide and adhere to a privacy policy for your application that uses the API (your “API Client”) that clearly and accurately describes to users of your API Client what user information you collect and how you use and share such information with Discord and third parties.

We aren't doing things at all. We've no privacy policy that clearly and accurately describes what information we collect.
There's a reason Discord provides a TOS + Privacy policy URL to applications.

And the consequences of providing one that is outdated or legally not fully correct could actually be harmful.

If you're afraid at these kind of things, it's only evidence "privacy" doesn't matter.
While it does matter, we should add a point to the template:

"This feature stores from Discord: (users, message content)"
Or something like that, to make sure that can't happen.

[Zabuzard]

The problem I see is that you can be held legally responsible if you do it wrong and formulate the text incorrect.

If you find a good template somewhere, we can use it. But if you neither can propose a safe and correct text, nor find any lawyer or something, I would rather not write something than doing it wrong and getting Doppey (as the owner of this organization) or our server into possible legal trouble or getting our server banned by Discord or anything.

At that point it would be Doppeys decision honestly. But maybe you can find some nice template for such a privacy notice.

[borgrel]

We dont need to store any user information? or message content
We process events and discard them?

As long as User Id, Member name, etc is never written to the log, we are never storing User content?
So we just need to add Unit Tests for the .log file to make sure User Id etc never appears there and nobody forgets the rule (or never knew about it)

Even if you wish to add persistence (as mentioned in #155) to reconnect to existing bot messages you will only store User ID, message ID and Possibly timestamp and it will be deleted after a short time period. As long as you don't store the member name or message content your not storing any person-ably identifiable information and as long as its getting deleted with a short roll over the data cant even be used for telemetry or heuristics or demographics

[Heatmanofurioso]

From Discord's own Privacy Policy, as long as we don't store any sensitive information, we're fine.

Storing messages in public "a server" chat rooms, logs, user ids and such are fine from their end. So it should be fine from ours too since this info is technically publicly available to anyone in the server

Still, we should avoid storing those if we don't need to, and borgrel's idea of a test for that is a good one, although it might be hard to test since it's almost asking for a test across the whole bot "all possible logging functions and such"

[Tais993]

Since it's a community server, never mind.
Everything is public already.

Didn't think about that :p

[Tais993]

You will provide and adhere to a privacy policy for your application that uses the API (your “API Client”) that clearly and accurately describes to users of your API Client what user information you collect and how you use and share such information with Discord and third parties.

https://discord.com/developers/docs/legal#section-2-user-privacy-and-security

You will provide

Doesn't sound optional

[Zabuzard]

Fair. Then we will write something.

[Zabuzard]

Done and linked in the settings: