Data handling
For server owners and mods. Effective October 24, 2026. Questions: contact@civility.tools.
This page lists exactly what Civility stores, so you can tell your members. The Privacy Policy covers the same ground in plain terms.
What Civility can see
Civility asks Discord for the permissions its steps use when it's added, listed on civility.tools. It reads:
- messages and their edits, but not direct messages;
- members joining, leaving and changing names or roles;
/reportand "Report message";- presses on the buttons of its own direct messages, when a workflow asks a member something;
- its own entries in the server's audit log, to check its actions.
It doesn't see members' online status.
What it stores, and for how long
| Data | What's in it | When it's stored | Kept |
|---|---|---|---|
| Member names | Username, server display name, join date, avatar | When a member posts, joins, reports, is reported or changes their name | While Civility is on the server |
| Channel names | Name | When Civility sees the channel | While Civility is on the server |
| Workflow runs | The event, each step and its result, and where a run is waiting and until when. When a workflow asks a member something by direct message, which button they pressed and when | When a published workflow runs | While Civility is on the server. Message words are removed after 24 hours unless the run opened a case. An action Discord didn't confirm keeps its words until a mod answers, at most 7 days. |
| Cases | The member, a copy of the message or report with its author and channel, notes, decisions | When a workflow opens a case | While Civility is on the server |
| Recent-message fingerprints | Message id, channel, author, time, and a keyed fingerprint of the text that can't be turned back into the words | Only on servers where a live workflow uses a step that looks at members' recent messages | 24 hours |
| Join records | Member id and when they joined | Only on servers where a live workflow uses "Wait until" with "Joins drop below a number a minute" | 24 hours |
| Warnings | Member, reason, when it was given or cleared | When a workflow gives one | While Civility is on the server. A reason taken from a member's message loses the message's words after 24 hours, unless the warning is part of a case. |
| Workflows | Steps, versions, history, drafts, notes on steps, mentions | When mods edit them | While Civility is on the server |
| Access | Which roles have which abilities, who changed them; the role holders at the last check | On the Mods page, and at each check | While Civility is on the server |
| Access changes | That a dashboard account lost access, and whether they left the server or lost the role | When it happens, so an open editor can close for them | 1 hour |
| Editor presence | Which dashboard account has a workflow open, whether to edit or view, and when they were last there | While someone has a workflow open | 1 hour |
| Health | Problems Civility's checks found with its setup and permissions: the problem, the workflow step, and when it was first seen, last seen and fixed. For some problems, the run, case and member it happened with | At each check, and when a step fails | While Civility is on the server |
| Install record | When Civility joined and left, and the Discord id of whoever added it (from the server's audit log) | When Civility is added | While Civility is on the server. It is the server's data, so deleting a dashboard account doesn't remove it. |
| Dashboard accounts | Discord id, username, avatar link, cursor colour (if picked), date last used | When someone signs in, or answers a question in Discord | Until they ask us to delete it. A daily clean-up also deletes it once 90 days have passed since they last used Civility, unless it has an unresolved case assigned to it on a server Civility is still in. Their notes and decisions stay in the server's history as "Deleted user". |
| Channel groups | Each group's name, and the channels and categories in it | When mods make or change a group | While Civility is on the server |
| Setup problems | Each setup problem Civility found, the sentences it posts about it in your log channel, which channel, and the id of each message it posted | When a check finds a problem. Posts only while "Post setup problems" is on | The problems: while Civility is on the server. The record of each message it posted: 7 days after Civility confirms or gives up on it |
| Clean-up records | Which clean-up ran, when, and how many items it removed for your server | Each time a clean-up runs; for the ones that run every 30 seconds, one record an hour | 30 days |
Attachments are never copied. Only their links and file names are kept.
Mods can also add notes, make decisions and mark a case resolved from the case's post in Discord. These are kept in the case like the ones made in the dashboard, with who made them.
While mods edit a workflow together, where their cursors are passes between them live and isn't stored. Who has a workflow open is stored for an hour (row below).
If your server sets up a mod queue, Civility also posts each case in your server's forum, with a copy of the message cut to 1,000 characters. A run with no case gets a post only when its workflow writes to the mod queue or asks mods something there. Those posts are in Discord, not in the table above. Removing Civility, or the 30-day clean-up, doesn't delete them. Mods can delete them in Discord.
Removing Civility
When Civility leaves your server, nothing is deleted right away. If it comes back within 30 days, everything is as it was.
After 30 days, a daily clean-up deletes everything in the table above for your server, except dashboard accounts, which aren't tied to one server and have their own row above. Copies in backups expire within 27 days after that. A server added back after that starts fresh, with case numbers from 1.
Backups
Railway backs up Civility's whole database every day and every week. Daily backups are kept for 6 days, weekly ones for 27 days. Backups are only used to recover from a failure. When data is deleted, from the clean-ups above or because you asked, it stays in the backups until they expire: at most 27 days.
Who sees what in the dashboard
Access follows Discord roles. The server's owner gives each mod role abilities on the Mods page. For example, Cases is the ability that shows case pages and the message copies in them.
Someone who loses the role in Discord loses the access. Nobody from another server can see your server's data.
Providers
| Provider | What for | Where |
|---|---|---|
| Discord | Where Civility runs and signs people in | Discord's infrastructure |
| Railway | Hosting, the database and its backups, both encrypted at rest, and the bot's log lines: ids, codes, error kinds and code locations, never message text. Railway keeps the log lines for up to 7 days | United States |
| Sentry | Bot error reports: ids and code locations only, never message text or names. A once-a-minute signal that the bot is running, with no data about anyone | United States |
Requests
To get a copy of your server's data, or have it deleted early, write to contact@civility.tools from the server owner's Discord account.