SuperStar
Add SuperStar

Privacy Policy

Last updated: November 2, 2026

The short version

SuperStar is a Discord bot and a companion dashboard. To do its job, it keeps a set of records about the servers it is installed in and about the members of those servers. This page lists every category of record SuperStar keeps, what each one contains, why it exists, how long it is kept, and who can see it. It also lists what SuperStar deliberately does not keep, such as the text of your messages.

  • SuperStar does not store the text of ordinary chat messages in its database.
  • SuperStar does store Discord user IDs, and in some cases display names and avatar links, for members who take part in features such as levels, economy, moderation, and birthdays.
  • Some records are kept on every server, whether or not any feature is turned on. Those are listed in full in section 4.
  • SuperStar does not sell personal information, does not use it for advertising, and does not share it with unrelated third parties.
  • Removing the bot from a server does not automatically delete that server's records. You can request deletion at any time (section 11).

1. Who this policy covers

This policy applies to four things operated by the SuperStar project:

  • The SuperStar Discord bot, which runs inside Discord servers that have added it and responds to slash commands, reactions, messages, member events, and scheduled tasks.
  • The SuperStar website, including this page, the landing page, the documentation, and the sign-in page.
  • The SuperStar dashboard, the signed-in area where server administrators view analytics and change settings. Its server-side component is a separate backend service.
  • The owner-only project growth report, which shows aggregate, project-wide numbers across all servers.

SuperStar is not affiliated with Discord Inc. Discord's own privacy policy governs what Discord itself collects and shows. Nothing in this policy changes Discord's handling of your account.

2. Where SuperStar's information comes from

SuperStar only receives information that Discord sends to the bot, information you type into the dashboard, and information it needs to finish a sign-in. Specifically:

  • Discord gateway events for servers where the bot is installed. These include messages posted in those servers, message edits and deletions, reactions, member joins, member leaves, member updates, bans, channel and role changes, and guild join and leave events.
  • Slash-command and button interactions, including the options you choose in the command.
  • Discord profile information that accompanies a message or interaction, such as the display name and avatar of the member who sent it.
  • Dashboard sign-in data: either a Discord sign-in, which returns your Discord account ID and display name, or an email address and password for an email account.
  • Information you enter into the dashboard, such as setting changes, server links, and one-time link codes.
  • Direct messages are ignored. The bot only processes messages sent inside servers.

3. The categories of information SuperStar keeps

The sections below describe every category of record stored in SuperStar's database. Each category explains what is in it, when it is created, whether it depends on a setting, and how long it is kept. Section 10 summarizes retention in one place.

4. Records kept on every server, whether or not any feature is enabled

Some records are created by default. These do not depend on any setting you choose. They are listed here so nothing is hidden.

4.1 Member display names and avatar links

Every time a human member posts a message in a server where SuperStar is installed, SuperStar saves that member's most recent display name and avatar link, keyed by Discord user ID. This is used so the dashboard can show names and pictures instead of raw IDs. Only the latest name and avatar are kept, one pair per member per server. They are overwritten when the member changes them. They are kept until the server's data is deleted (section 11). Bots' messages are not recorded.

4.2 Member join records

When a member joins a server, SuperStar records their Discord user ID, the time they joined, and the date their Discord account was created. SuperStar keeps only the most recent 200 join records per server, so older ones are removed as new members arrive. This is used by the join-review and anti-raid features to spot unusual waves of new accounts.

4.3 Server settings and configuration

Every server has a settings record created by the administrators who configure SuperStar. It contains:

  • the command prefix, feature on-and-off switches, and enabled feature options;
  • Discord channel IDs and role IDs chosen for logs, tickets, welcome messages, birthdays, verification, starboard, levels, and similar features;
  • automod rules, including blocked and allowed terms, exempt channels, exempt roles, and exempt users, along with the thresholds and actions the rules use;
  • anti-nuke and raid-protection thresholds;
  • the list of SuperStar admin user IDs that a server has granted extra permissions to;
  • the welcome message template, onboarding panel settings, and activity-log filter choices;
  • custom command names and the replies administrators write for them;
  • the ticket category, support role, and transcript channel.

Settings are kept until an administrator changes them or the server's data is deleted.

4.4 Lockdown and channel snapshots

When a lockdown or verification step changes channel permissions, SuperStar stores a snapshot of the affected channels so the change can be reversed. Snapshots hold channel IDs and the permission settings that were in place. They do not hold member messages. They are kept while the lockdown or verification setup needs them, and are removed when they are no longer needed or when the server's data is deleted.

5. Records kept only when a feature is switched on

5.1 Server analytics (when analytics is enabled)

Analytics are off by default. When a server administrator turns analytics on, SuperStar records these counts for each day, in UTC:

  • total messages, and messages per hour of the day;
  • messages per channel, together with the name of each channel;
  • the number of messages and the set of members who sent at least one message, identified by Discord user ID, with a per-day message count for each member;
  • counts of slash commands used, per command name;
  • joins, leaves, and the member count at the time of the record;
  • the first day SuperStar saw each member send a message, used to separate new members from returning members.

Analytics do not store the text of messages. Analytics for each day are removed automatically after 31 days by default. The retention period can be set by the people who operate the bot, and the default is 31 days. Turning analytics off clears that server's stored daily analytics immediately.

5.2 Server activity feed (when analytics is enabled)

The dashboard's activity feed keeps the 50 most recent server events, such as member joins and leaves, role changes, channel changes, moderation actions, and automod actions. Each entry has a title, a short description, and a time. The feed does not keep the body of any edited or deleted message. Descriptions may contain member mentions, such as the name of the member who was warned or removed. The feed is replaced as new events arrive.

5.3 Levels and experience points (when levels are enabled)

When levels are enabled, each member earns experience points for messages, at most once per minute. SuperStar keeps each member's experience points, current level, and the time of their last experience award, keyed by Discord user ID. Administrators can change or remove experience and can exclude specific users, roles, or channels from earning it. Level records are kept until removed by an administrator or until the server's data is deleted.

5.4 Reputation, streaks, quests, and activity goals

Members can give each other reputation points. SuperStar records who gave reputation to whom, the reputation totals, and the time of each grant. Daily quests and activity streaks store each member's streak count, the date of their last qualifying activity, and any rewards they claimed. Server goals and community challenges store the progress and status recorded for the goal, not personal messages.

5.5 Economy, inventory, achievements, and duels (when the economy is enabled)

Economy records are virtual. They have no monetary value and are not real money. For each member, SuperStar stores a balance, an inventory of items, unlocked achievements, and usage statistics. Transfers between members record the sender, the receiver, and the amount. Duels record the participants and the result. Cosmetic items that members own are stored in the member's inventory. SuperStar does not process payment cards or bank details.

5.6 Birthdays (when birthdays are enabled)

A member can add their birthday to a server. SuperStar stores only the month and day, not the year, keyed by Discord user ID. Changes are first held as a pending request for an administrator to approve or deny. SuperStar also records when a member's birthday was last changed so the change cooldown can be enforced, and which members were given the birthday role or bonus on a given day, so the role can be removed the next day. A member can ask to remove their birthday at any time with the remove command.

5.7 Moderation records

Moderation keeps records so moderators can see a member's history and so appeals can be reviewed. These include:

  • Warnings: a warning ID, the warned member's user ID, the moderator's user ID, the reason the moderator entered, and the time of the warning.
  • Moderation cases: a case ID, the action taken (for example a warn, timeout, kick, or ban), the member's user ID, the moderator's user ID, the reason entered, the duration where applicable, and the time.
  • Moderator notes: a note ID, the user ID of the member the note is about, the user ID of the staff member who wrote it, the note text, and the time. Notes are visible only to staff with access to moderation tools.
  • Reports: a report ID, the reporter's user ID, the reported member's user ID, the reason, a link to the reported message, the status, and the time. The message link is stored; the message content is not.
  • Appeals: a case ID, the appeal text, the status, and the time.
  • Nominations: a nomination ID, the nominator's and nominee's user IDs, the reason, the status, and the time.
  • Automod strikes are counted in memory only. They are not written to the database and are lost when the bot restarts.

Moderation records are kept until removed by staff, removed by a warning or case removal command, or deleted with the server's data. Removed warnings are marked as removed rather than erased so that the history of the case remains readable.

5.8 Tickets

Each support ticket stores a ticket ID, the Discord channel ID, the user ID of the member who opened it, the user ID of the staff member who claimed it, its status, and the times it was opened and closed. Ticket transcripts, where enabled, are posted to the transcript channel an administrator chose. SuperStar does not keep a copy of transcript contents in its database. Anyone who can view the transcript channel can read transcripts, so administrators should limit that channel to staff.

5.9 Starboard

When a message reaches the starboard reaction threshold, SuperStar copies the message into the starboard channel and stores a post record: the starboard post's message ID, the original channel ID, the author's user ID, the reaction count, and the emoji used. The message content lives on Discord in the starboard post. SuperStar's database keeps only the post record. The post record is removed if the original message is deleted.

5.10 Suggestions, votes, and challenges

Suggestions store the suggestion text, the author's user ID, the status, and the list of user IDs that voted. Community challenges store the challenge text, the dates, the creator, and a list of submissions. Each submission stores the submitter's user ID, the submission text or link, and its review status. Spotlights store the nominated member's user ID, the reason, and the status.

5.11 Giveaways, events, goals, and scheduled messages

  • Giveaways store the prize, the channel, the end time, the list of entrants by user ID, and the winners picked.
  • Events and RSVPs store the event details and the user IDs of members who said they would attend.
  • Scheduled messages store the channel, the message text an administrator wrote, the creator's user ID, and when the message should run. These messages are created by administrators, not by SuperStar.

5.12 Games and fun features

Chat games, community game scores, word chains, community bingo, and fun game sessions store the players' user IDs, scores, and the state of the game in progress. Some game sessions store the current word or prompt and the guesses made so far, so the game can continue after a restart. Game sessions expire after a set time, and the expired records are removed. Scores are kept until the server's data is deleted.

5.13 Onboarding, welcome messages, and verification

Onboarding and verification store settings only: which role is given, which channel is used, and the panel message's details. Verification may keep channel-permission snapshots so changes can be undone. These snapshots contain channel IDs and permission values, not member messages. Welcome messages store the template an administrator wrote and the channel it is sent to.

6. Project-wide aggregate numbers (owner-only growth report)

SuperStar keeps aggregate numbers across all servers for the owner's growth report. These numbers are:

  • the number of joins and leaves on each day, across all servers combined;
  • the current member count of each server the bot is in, as a single number per server;
  • the list of server IDs the bot is currently in, used to keep the count accurate.

These aggregates do not contain member IDs, names, or messages. A person who is in several servers is counted once in each server. This report is visible only to the project owner and is not shown to server members.

7. Dashboard accounts and sign-in

Server administrators can sign in to the dashboard. There are two ways to sign in, and each stores different things.

7.1 Signing in with Discord

When you sign in with Discord, SuperStar exchanges the authorization code for a short-lived Discord access token. SuperStar uses that token once to look up your Discord account ID, then discards it. SuperStar does not store your Discord access token or Discord refresh token. SuperStar stores your Discord account ID as your dashboard identity, along with your display name and avatar link, so the dashboard can show who is signed in.

7.2 Signing in with email and password

Email accounts are created and checked by Supabase Authentication, the account service SuperStar uses. Your email address and password are sent to that service when you sign up or sign in. SuperStar's own tables do not store your password. Supabase stores the account and password in protected form under its own security practices. SuperStar lowercases the email address before it is sent, and it keeps a one-way hash of the email in its rate-limiting memory for a short time to slow down repeated sign-in attempts. That in-memory value is not written to the database.

7.3 Dashboard sessions

After you sign in, SuperStar gives your browser a session cookie. The cookie is marked HttpOnly so scripts on the page cannot read it, and it uses SameSite=Lax. On the live site the cookie is also marked Secure, so it is sent only over HTTPS. SuperStar stores only a one-way hash of the session token, the account ID it belongs to, the creation time, and the expiry time. Sessions expire after 30 days by default. Signing out or revoking your sessions marks them as revoked.

7.4 Dashboard keys

Dashboard keys are one-time codes that let you sign in from another device or link a server. SuperStar stores only a one-way hash of each key, the owner ID, the creation time, and the expiry time. A key can be used once and expires after 15 minutes if unused. The plaintext key is shown to you once and is never stored.

7.5 Linked servers and link codes

When a server is linked to your dashboard account, SuperStar stores the server's ID, its name, its member count, its icon identifier, and the dates it was linked and last updated. Link codes created by the bot with the connect command store only a one-way hash of the code, the server ID, the server name, the member count at the time, the ID of the administrator who issued the code, the creation and expiry times, and, once claimed, the time and the ID of the account that claimed it. Unclaimed codes expire and are removed.

7.6 Setting-change requests

When you change a setting in the dashboard, SuperStar records the request: the owner ID, the server ID, the setting name, the requested value, any extra data the setting needs, and the request time. The bot then applies the change to the server's settings and records when it was applied. This record remains in the database after it is applied, as a log of changes.

7.7 Dashboard profiles

SuperStar stores one profile record for each dashboard account: the account ID, the display name, the avatar link, and the time the profile was last updated. The avatar link is kept only if it points to Discord's own avatar service. Otherwise it is cleared.

8. What SuperStar does not store

This is the list most people care about. SuperStar deliberately does not keep the following:

  • The text of ordinary chat messages. Messages are read in memory to run automod, respond to commands, and handle game answers. They are not written to the database. The only exceptions are text that a person intentionally submits to a feature, such as a suggestion, a moderator note, an appeal, a report reason, a challenge submission, or a scheduled message, and those are described in section 5.
  • The before-and-after text of edited or deleted messages. When an activity log channel is configured, SuperStar posts the edit or deletion to that Discord channel so staff can see it. The dashboard activity feed never keeps the message body. Whatever is posted to Discord is stored by Discord under its own rules.
  • Direct messages sent to SuperStar. The bot ignores them.
  • Attachments, images, files, and voice. SuperStar does not download or keep attachments, and it does not record voice channels.
  • Member presence and online status. SuperStar turns off presence tracking.
  • A full member list or role cache. SuperStar does not keep a copy of every member of every server. It looks up what it needs from Discord when it needs it.
  • Discord passwords, bot tokens, or Discord OAuth access and refresh tokens. The bot token is held by the service as a secret setting. It is never written into the database or shown on the dashboard.
  • Email passwords in SuperStar's own tables. Passwords are handled by Supabase Authentication. SuperStar's tables do not contain them.
  • Plaintext dashboard keys, session tokens, or link codes. Only one-way hashes are stored.
  • Payment card or bank details. SuperStar does not process payments. The economy currency is virtual.
  • Precise location, device identifiers, or contacts. SuperStar does not collect them.
  • Advertising profiles. SuperStar does not build profiles for advertising or sell data to advertisers.
  • IP addresses in the database. The dashboard uses the client's address only in memory to rate-limit requests, and it is cleared after a short window. The address is not written to the database. Where a proxy supplies a forwarded address, SuperStar uses it only for that same rate limit.
  • Birth years. Birthdays store only the month and day.

9. Information kept only in memory

Some information exists only in the bot's working memory while it is being processed, and is lost when the bot restarts or is updated:

  • the text of each message while automod, commands, and games check it;
  • automod strike counters and spam-rate counters, per member, which expire on their own;
  • join-wave and anti-nuke counters;
  • dashboard rate-limit counters, keyed by client address and an email hash, which are cleared after a short window;
  • the Discord gateway data the bot receives, which it does not keep in a cache beyond what it needs for the current task.

10. How long information is kept

The table below summarizes how long each kind of record is kept. "Until deleted" means until a server administrator removes it, a member asks for it to be removed where that is possible, or the server's data is deleted under section 11.

  • Member display names and avatar links: latest value only; overwritten when changed; kept until deleted.
  • Join records: the most recent 200 per server.
  • Server settings: until changed or deleted.
  • Lockdown and verification snapshots: kept while needed for the lockdown or verification setup, then removed or deleted with the server's data.
  • Daily analytics: 31 days by default, then removed automatically.
  • Activity feed: the 50 most recent events.
  • Levels, reputation, streaks, economy, inventory, and achievements: until removed or deleted.
  • Birthdays: until the member removes them or an administrator does; pending requests until approved or denied.
  • Warnings and moderation cases: until removed by staff or deleted. Removed warnings are marked, not erased.
  • Moderator notes, reports, appeals, and nominations: until deleted or closed and removed by staff.
  • Tickets and starboard records: until closed and removed by staff, or deleted with the server's data.
  • Suggestions, challenges, giveaways, events, and goals: until closed, removed, or deleted.
  • Game sessions: removed when they expire; scores until deleted.
  • Dashboard sessions: 30 days by default, or until signed out or revoked.
  • Dashboard keys: 15 minutes to redeem; then removed or marked expired.
  • Link codes: removed on expiry if unclaimed; kept with the claim record once claimed.
  • Setting-change requests: kept as a log of changes.
  • Project growth aggregates: kept as daily totals and current counts; no member IDs.
  • Email accounts: kept in Supabase Authentication until the account is deleted.
  • Backups: the database provider may keep backups under its own retention schedule. Deleted data may remain in those backups for a limited period before they expire.

11. Deleting your information and changing what is stored

You have several ways to control what SuperStar keeps:

  • Remove your birthday at any time with the birthday remove command. The change is approved by a server staff member and then applied.
  • Ask a server administrator to remove a warning, note, report, appeal, suggestion, submission, or other record about you, or to remove you from a list such as RSVPs, giveaways, or reputation. Server administrators can see and change most server records.
  • Turn features off. Administrators can turn off analytics, levels, the economy, birthdays, and other features. Turning a feature off stops new records from being created but does not, by itself, erase existing ones. Administrators can then clear records through the commands that manage them.
  • Sign out and revoke sessions in the dashboard to end sign-in on every device. Revoking dashboard keys stops them from being used.
  • Remove the bot from a server. Removing the bot stops new collection for that server immediately. It does not delete the server's existing records automatically.
  • Request full deletion of a server's records, or of your own records, by contacting the project team through the SuperStar Discord server. Please include the server ID or your Discord user ID so the request can be matched to your records. We may ask you to confirm you control the account before deleting anything.

When a deletion is approved, SuperStar removes the matching records from its live database. Copies in backups are removed when those backups expire, as described in section 10. Some records may be kept longer where needed to meet a legal obligation, to protect the service from abuse, or to finish a feature that is already in progress.

12. Getting a copy of your information

Server managers with Manage Server permission or SuperStar admin access can export moderation, warning, and economy records for their server as CSV or JSON with the export command. The export is sent privately to the manager who ran it. It contains member IDs and the other fields shown in section 5, so managers should handle it carefully.

If you want a copy of records about you across servers, or records that a server export does not include, contact the project team through the SuperStar Discord server. Where local law gives you a right of access, we will respond to a verified request.

13. How information is used

Information is used only to provide and run SuperStar's features. This includes:

  • automod, raid protection, anti-nuke, lockdown, and verification;
  • moderation, warnings, cases, notes, reports, appeals, and tickets;
  • levels, reputation, streaks, quests, economy, and games;
  • welcome messages, birthdays, events, giveaways, scheduled messages, and starboard;
  • analytics and the activity feed for server administrators;
  • dashboard sign-in, security checks, and rate limiting;
  • the owner's aggregate growth report;
  • error alerts sent to the bot owner when something fails.

SuperStar does not use the information for advertising, does not sell it, and does not build marketing profiles of members.

14. Where information is stored and who processes it

  • Supabase holds SuperStar's database, including the bot's state record and the dashboard tables, and it holds email accounts through its authentication service.
  • Oracle Cloud Infrastructure hosts the bot's server process. The server holds the bot's secret settings in its own environment, not in the database.
  • Discord delivers the events the bot receives and displays the messages, replies, logs, and tickets the bot posts. Discord processes that content under its own policies.
  • Google Fonts serves the fonts used on the SuperStar website. When your browser loads the fonts, Google receives your IP address and browser details, as it does for any site that uses Google Fonts.

SuperStar does not share information with unrelated third parties. Information may be processed in countries other than your own, where the providers above operate.

15. How SuperStar protects information

  • Dashboard keys and session tokens are stored only as one-way hashes.
  • The dashboard database tables have row-level security turned on and are locked away from public and signed-in browser access. Only the server-side service can read or write them.
  • The database is accessed with a secret key that is held on the server and is never sent to a web browser.
  • Dashboard session cookies are HttpOnly and use SameSite=Lax, and are sent over HTTPS in production.
  • The dashboard rate-limits sign-in, sign-up, key creation, and linking attempts.
  • Bot-side secrets are kept in the server's environment, not in the database or in the source code.
  • Ticket transcripts and moderator notes are visible only to people who can access the channel or the staff tools they are posted to. Administrators should limit those channels to staff.

No system is perfectly secure. If SuperStar learns of a breach affecting personal information, it will act to contain it, and it will tell affected server administrators through the channels available to it.

16. Children

SuperStar is used through Discord. Discord requires users to meet its own minimum age. SuperStar does not knowingly collect information from anyone below that age, and it does not target children. If you believe a child's information has been recorded by SuperStar in a way that should not have happened, contact the project team and it will be reviewed and removed where appropriate.

17. Automated decisions

Automod, raid protection, anti-nuke, join-review checks, and the strike system make automatic decisions based on message rules, rates, and thresholds that server administrators set. These decisions can remove a message, time out a member, or start a lockdown. Staff can review automatic moderation actions in the moderation log and reverse them through the moderation tools. If you believe an automatic action was wrong, you can appeal through your server's appeal process or ask the server's staff.

18. Changes to this policy

This policy may change as SuperStar changes. When a change affects what SuperStar stores, this page will be updated and the "Last updated" date will be changed. Material changes will be announced in the SuperStar Discord server before they take effect where practical. The latest version is always posted on this page.

19. Contact

For questions about this policy, or requests to access, correct, or delete information, contact the project team through the SuperStar Discord server.