Data & safety

Practical handling rules while Watchpost is being developed.

Keep credentials private

Never paste a Discord bot token or ER:LC API key into a support email, public channel, screenshot or documentation file. Store development credentials outside the source repository and give access only to people responsible for operating the bot.

If a credential is exposed, revoke or replace it through the service that issued it, update the running configuration and review available access records. Deleting the message alone does not make the credential safe again.

Collect only what is needed

Before a feature stores information, decide why it is needed, who can see it, how long it is kept and how corrections or deletion requests will be handled. Moderation evidence should not be visible to everyone simply because a log channel exists.

Before a public bot launch

The team needs to publish a privacy policy describing the implemented system, along with clear usage terms and a support process. Retention periods, encryption practices, deletion behaviour and hosting arrangements have not been verified in this draft. This page is preparation guidance, not a privacy policy or a security guarantee.

Report a concern privately

Contact support@wachpostbot.com with a description and redacted evidence. Do not include an active secret. If you discover unintended access, stop at the minimum needed to explain it and avoid accessing other members' records.