Last updated
This notice explains how the Matcha Discord bot and dashboard use personal data. It covers members who use bot features, people mentioned in moderation records, and administrators who sign in to the dashboard.
Matcha is operated from the United Kingdom by the administrator of feksake.com, who acts as the data controller for the service described here.
Contact matcha@feksake.com for privacy questions or requests. The service is intended to be handled under the UK GDPR and Data Protection Act 2018.
Data comes from Discord, from actions people take with Matcha, from server administrators who configure or moderate with it, and from the device used to reach the dashboard. You do not have to use Matcha, but the bot cannot deliver a requested feature without the data that feature needs.
| Data | Detail | Purpose |
|---|---|---|
| Discord identity and membership | User ID, username, display name, avatar reference and, per server, nickname, join/leave times, message count and voice time. | Account display, server features and statistics |
| Commands and feature activity | Command name, server/channel and success information; giveaway entries; suggestion votes; invite attribution; temporary roles; workflow activity; and starboard message references. | Delivering features, preventing abuse and troubleshooting |
| Content you submit | Reminder and AFK text, ticket subjects, suggestions and decisions, application answers, and text entered into configurable server features. An excerpt up to 512 characters may be kept when automod triggers. Matcha does not create a general archive of chat messages. | Delivering the feature or allowing server staff to review it |
| Community feature records | Economy balances and transactions, inventory, XP events and totals, pets, game sessions and other per-server progress. | Delivering the features you use |
| Moderation and security records | Cases, reasons, staff notes, automod hits, guard incidents, blocks, administrative actions, actor/target IDs, timestamps and sometimes an IP address. | A server's moderation and Matcha's security and accountability |
| Dashboard sessions | An encrypted Discord OAuth access token and, if issued, refresh token; an opaque session ID; IP address; browser user agent; and session timestamps. | Authentication, authorisation and abuse investigation |
| Operational telemetry | Service health measurements and warning/error logs. A log can include a server ID and technical provider error, but secrets and message bodies are not intentionally recorded. | Reliability, security and diagnosis |
Matcha does not request your Discord password, email address or payment information. It does not sell personal data or use it for advertising.
Matcha uses data that is necessary to provide features you request and to perform the Terms of Service. It also relies on legitimate interests: a server's interest in operating and moderating its community, and the operator's interest in securing, diagnosing and preventing abuse of Matcha. Those interests are weighed against the rights and reasonable expectations of the people affected.
Matcha does not rely on consent for essential operation, so there is no pre-ticked consent box to withdraw. Optional cookies or marketing are not used. You may object to processing based on legitimate interests as described below.
Discord OAuth2 sign-in requests identify (basic account details) and guilds (your server list and permissions). These scopes do not let Matcha read your messages, join servers for you or act as your account.
Tokens are encrypted before storage. Signing out immediately revokes the Matcha session and clears its cookies; the revoked database row and encrypted token are removed when the session expires, normally within seven days. Erasure removes all of your dashboard sessions.
Some recipients may process data outside the United Kingdom. Contact the address above for the current provider list and transfer safeguards for this deployment.
Depending on the data and lawful basis, you may ask for access, correction, erasure, restriction, or portability, and you may object to processing based on legitimate interests. These rights are not absolute—for example, a necessary moderation or security record may lawfully be retained.
Email matcha@feksake.com with your Discord user ID and the request. Discord Developer Mode lets you right-click your name and choose Copy User ID. The operator may ask for proportionate proof that the account is yours and aims to respond within the legal time limit, normally one month.
Erasure currently anonymises the cached profile and nickname, clears automod excerpts and ticket subject/link fields, and deletes reminders, AFK records, invite attribution and dashboard sessions. Moderation cases, staff notes, audit/security records and per-server economy, level and feature history may be retained where still necessary. A ticket transcript already posted into a Discord staff channel is controlled in Discord and must be requested from that server's staff.
If a server enables automod or guard features, configured rules can automatically delete content, warn, mute or otherwise restrict an account. The server administrator selects the rules and consequences. Contact that server's moderators to ask for human review of a decision; contact Matcha's operator if the issue concerns the service rather than the server's moderation choice.
Dashboard tokens are encrypted at rest; session cookies use opaque, signed identifiers and production cookies are required to use HTTPS. The API validates server permissions and uses CSRF, origin and rate-limit controls. No system is perfectly secure.
Matcha is not intended for anyone below Discord's minimum age—13, or older where local law requires. If you believe information about an under-age user is present, contact the operator so it can be investigated and handled appropriately.
The date above identifies this version. Material changes will be explained here, and people will be told before a materially new use of personal data where required.