GroupFindsThe short version
- The bot records when people were in voice channels and for how long, how many messages they sent (not what those messages said), when they joined or left a server, and moderation actions taken against them.
- It identifies people by their Discord user ID and stores their current display name and avatar URL so cards and leaderboards are readable.
- It cannot read the contents of messages. It does not request the Message Content intent, so Discord does not send message text to it at all.
- It cannot read direct messages and does not request the ability to.
- Everything on the cross-server Passport is off until the member switches it on themselves, and switching a field off deletes it.
- A member can fill their Passport from their own Discord account. That asks Discord
for
identify,guildsandconnections, keeps counts and the IDs of servers they own, and throws the server list away. Every field arrives switched off. - Some commands can be added to a member's own Discord account and used in servers the bot is not in. When that happens we record the server, not the member.
- The public directory is built from Discord's own public invite data. Nothing in it comes from inside a server, and no owner has to have done anything for their server to appear.
- Nothing is sold, and nothing is shared with advertisers.
- Ask us to delete your data and we will, from the whole system, including backups as they roll over.
Who we are
GroupFinds is two things: a public directory of online communities at
www.groupfinds.com, and a Discord bot that server owners can add to their servers. This
policy covers both. Where they differ it says so.
The data controller is Saul Fleischman, trading as GroupFinds, Sakai, Osaka, Japan. For questions, access requests or deletion requests, write to support@groupfinds.com.
What the bot records, exactly
This list is written from the database itself rather than from a description of it. Every item below is a real table with real columns.
| What | The detail actually stored | Why |
|---|---|---|
| Voice sessions | Discord user ID, server ID, voice channel ID and name, the time joined, the time left, the duration in minutes, and whether the member was muted, deafened or streaming during it. | Voice XP, levelling, the activity cards members ask for with slash commands, and the server owner's analytics. It is the core of what the bot is for. |
| Message counts | A row per message with the message ID, the author's user ID, the server and channel ID and the time. No message text, no attachments, no embeds. Two older fields that would have needed message content were removed in August 2026 and are now always empty. | Message-based XP and the "messages sent" figure on leaderboards and weekly summaries. |
| Member events | User ID, server ID, whether they joined or left, their username at the time, and when. | Member-count history and growth charts for the server owner. |
| Moderation events | User ID, server ID, the kind of action (ban, unban, kick, timeout, timeout removed, join, leave), when it happened, a timeout's length and expiry, who performed it, the reason recorded in Discord's own audit log, and where we read it from. | Optional XP penalties the server owner configures, the moderation history shown to that server's staff, and the invite penalty described below. Read from Discord's audit log, which only staff can already see. |
| Invite attribution | Which member invited which other member, the invite code used, when they joined, when they left if they did, and whether the invite counted. Plus, for the bot-minted links, the invite code and which member owns it. | Invite rewards, which server owners switch on. It answers "who brought this person in". |
| Per-member totals | User ID, server ID, current display name, avatar URL, XP, level, message count, voice minutes, timeout count, last active time and join date. | The mirror the website dashboard and the leaderboard cards read. |
| Roles and server settings | Role IDs, names, colours and positions in each server; the server's own bot configuration. | So role-reward pickers on the dashboard show real roles, and so the bot can tell an owner when it lacks a permission. |
| Enforcement logs | When the camera or screen-share rule a server owner configured removed somebody from a call, which channel, and whether they could be told why. | So an owner can audit their own rule, and so a member can be shown what happened to them. |
The Passport
The Passport is an optional card showing a member's own history across every server where the bot is present: total voice hours, earliest join date, longest streak, how many servers they are in, a rank and percentile, and the people they most often share calls with.
Every field is off until that member switches it on. The bot stores their consent per field, a log of every consent change with when and where it was made, and the computed totals themselves. Switching a field off removes it from the card; switching the Passport off entirely deletes the consent record and the computed totals. The underlying voice sessions are a separate thing and are governed by the rest of this policy.
Call buddies. The hours two members have spent in calls together are stored only while both of them have Call buddies switched on, and are deleted as soon as either switches it off or deletes their Passport. In servers where it is switched on, a member with a Passport can press Ask my call buddies: the bot works out, at that moment and from that server's own call records, who they have shared the most call time with, and tags up to three of them in one message. That pick is not stored. What is stored is who asked whom, in which server, the message, and whether the person asked opened it, switched it on or said no, so nobody is asked twice by the same member, more than once a week, or more than three times in all. No hours are stored with it, and the public message shows none. Deleting your Passport deletes these records too; a "not for me" is kept so you are not asked again.
Filling a Passport from Discord
A member can choose to fill their Passport from their own Discord account at
www.groupfinds.com/passport/fill. This is a separate sign-in from the website's, and it is
the only place GroupFinds asks for these permissions. It requests exactly three Discord scopes:
identify, guilds and connections. It does not
request email.
| What | The detail actually stored | Why |
|---|---|---|
| On Discord since | The date the member's Discord account was created, worked out from the user ID itself. No request is made to Discord for it. | A line on their card, if they switch it on. |
| Public badges | The badges Discord already shows on their public profile, by name — Early Supporter, Active
Developer and so on — derived from the public_flags number Discord returns. |
A line on their card, if they switch it on. |
| Counts of servers | Three numbers: how many servers they own, how many they hold Manage Server or Administrator in, and how many they are a member of. | Lines on their card, each off until switched on. |
| IDs of servers they own | The Discord server IDs of the servers they own, and nothing else about those servers. | So the Passport can offer one "add GroupFinds" button per server they run. This is the only part of the guild list that is kept. |
| Founder since | The creation date of the oldest server they own, worked out from that server's ID. | A line on their card, if they switch it on. |
| Linked accounts | The type and display name of each verified connection Discord reports as publicly visible, for example a Twitch or GitHub name. Each one carries its own on/off switch and every one of them starts off. | A line on their card, for the ones they individually switch on. |
What is discarded. The full list of servers the member is in is read, counted, and dropped in the same request. It is never written to the database and never leaves the function that reads it. A map of where somebody spends their time is not something we should be able to produce, so we made sure we cannot. No access token from this sign-in is stored either.
Every field arrives switched off. The fill writes the data and writes no consent; the
card shows nothing new until the member turns each field on. The lawful basis is consent.
To delete all of it, run /gf-passport and pick Delete, which removes the Passport, the
consent record and everything the fill brought in; or write to
support@groupfinds.com and we will do it.
Commands a member adds to their own Discord account
/gf-passport and /gf-report can be added to a member's own Discord account
rather than to a server. A member who does that can run them in servers GroupFinds is not in,
and in direct messages. In that situation the bot is not present in the server, sees nothing of it, and
is sent nothing about it by Discord beyond the ID of the server the command was run in.
| What | The detail actually stored | Why |
|---|---|---|
| Passport opened in a server | The server ID, the server name, the moment, and whether GroupFinds is in that server. No member ID, no hash of one, and no key that could be joined back to one. | To know where the Passport is being used, which is a question about servers. |
| How many different members | A per-server count. To keep it exact without keeping identities, each server has its own random salt and what is stored is a digest of that salt and the member's ID. It cannot be turned back into a Discord ID, and the same member in two servers produces two unrelated values, so no cross-server profile can be assembled from it even by us. | So a server's page can say "N members of this server hold a GroupFinds Passport", and only from three upwards, so the number can never point at one or two people. |
| "Tell the owner" presses | A count, with the source tag passport_tell_owner and the server the link was for.
Not tied to a person. |
To know whether the button is used at all. |
Report cards
/gf-report shows how a server compares with servers like it: how many people are online
right now, that as a share of members, its rank among servers with the same main topic, how that share
compares with the middle server of that group, its boost level and the games Discord counts as played
there.
Every figure on it is public data unless GroupFinds is installed in that server. For a server the bot is not in, the reading comes from that server's own Discord widget, if its owner has switched the widget on, and from the public invite it hands us — the same public endpoint the directory uses. If the widget is off and the server is not in our directory, the card cannot be drawn and says so rather than guessing. Where the bot is installed, the report may also use what the rest of this policy already describes.
Every Discord permission we ask for, in one place
There are four, and no others exist anywhere in the code. Each is asked for in a different place and for a different reason.
| Where | Scopes asked for | What it is for |
|---|---|---|
| Adding the bot to a server | bot and applications.commands, with the five permissions listed on
the install page: View Channel, Send Messages, Read Message History,
Manage Roles and Connect (so it can see voice channels; it never joins a call). |
The bot joining the server and its slash commands appearing there. It is never given Administrator. |
| Adding a command to your own account | applications.commands only. No permissions at all, and the bot does not join
anything. |
So /gf-passport and /gf-report work in servers the bot is not in and
in direct messages. |
| Signing in to the website | identify, email and guilds. |
Creating or signing in to a GroupFinds account, and proving which servers you own so a listing can be claimed. |
| Filling a Passport | identify, guilds and connections. Not
email. |
The fields described above. It creates no GroupFinds account. |
The bot does not request the Message Content intent, the Presence intent or any permission to read direct messages, and it never asks for a token that would let it act as you.
On the website
If you sign in, we store your account (email address and, if you use Discord sign-in, your Discord account ID and username), which servers you have claimed as an owner, and your settings. We record clicks on listing invite links in aggregate so an owner can be told how many people their listing sent them. There is no advertising network on the site and no third-party tracker following you across other sites.
The directory, and where its data comes from
The public pages at www.groupfinds.com/discord are built from Discord's own public invite
data. A server appears because a link to it was found in a public source — Common Crawl's web index,
public code repositories, the npm and PyPI registries — and that invite was then read through
Discord's documented public Get Invite endpoint, with no authentication and no account. Most listings
therefore exist without their owner having done anything, and that is worth stating plainly.
| What | The detail actually stored | Why |
|---|---|---|
| The server itself | Server ID, name, icon and banner URLs, the invite code, the server's own description, and its Discord features and locale. | So the page is about a real server and a reader can recognise it. |
| Member and online counts | The approximate member count and the approximate number online, as Discord reports them at the moment of the read, with the time of that read. | Ranking and the size figures on the page. Both are Discord's numbers; neither is ours. |
| Owner-chosen traits | The labels the people who run the server picked for it on Discord, in their order. | They are the only words most servers have written about themselves. |
| Games played | The game application IDs Discord credits the server with, each with Discord's own activity score, and the game's name resolved from Discord's public application endpoint. | So a reader can tell what a server is actually for. |
| Boost level | The server's premium tier and how many boosts it has. | A published signal that its own members pay to support it. |
Nothing in the directory comes from inside a server. No member is named, counted individually or identified, no channel is read, and no message is seen. All of it is what Discord shows to anyone holding the invite link.
Why we show it. The basis is our legitimate interest in running a directory of public communities, which is information about organisations rather than about people. Where a listing is claimed by its owner, what they then add is theirs.
Getting a listing corrected or removed. Write to
support@groupfinds.com from any address, or claim the server
through Discord at www.groupfinds.com and edit or remove it yourself. We do not require proof
of ownership to remove a listing — a request to take a server down is honoured. A listing
whose invite has stopped working is removed automatically and its page returns a "gone" response.
What we never collect
- Message contents. The bot does not request Discord's Message Content intent, so Discord does not transmit message text to it. It counts messages; it cannot read them.
- Direct messages. A bot cannot read DMs between members, and we do not request anything that would change that.
- Voice audio. The bot never joins a voice channel and never records, transcribes or listens to audio. It only sees Discord's own notification that somebody's voice state changed.
- Payment details. The bot is free and there is nothing to pay for. Where the website has ever taken a payment it was handled by the payment processor and card numbers never reached us.
- Special category data. We do not ask for or infer health, political, religious, biometric or sexual-orientation data.
Why we are allowed to hold it
For members of a Discord server where an owner has added the bot, the lawful basis is our legitimate interest, and the server owner's, in running and understanding their own community — the same interest that lets a server keep a member list. It is limited to activity in that server, it is visible to that server's members through the bot's own commands, and it can be objected to and deleted on request.
For the Passport, and for anything shown outside the server it came from, the basis is
consent, given per field by the member, recorded, and withdrawable at any time with
/gf-passport. The same applies to everything brought in by
www.groupfinds.com/passport/fill: the member starts it, each field arrives off, and
/gf-passport Delete removes the lot.
For the public directory, the basis is our legitimate interest in listing public communities, as set out in the directory section above. It concerns servers rather than identified people.
For website accounts, the basis is performance of a contract: you asked for an account and we keep what an account needs.
Who processes it for us
These are our sub-processors. Naming them is a requirement of any real data-processing agreement, so they are listed in full.
| Who | What they do for us | Where |
|---|---|---|
| Supabase | The database and server-side functions. Everything described above is stored here. | Tokyo, Japan (ap-northeast-1) |
| Railway | Runs the Discord bot process itself, and holds a local working copy of member XP and activity on its disk. | United States |
| Vercel | Serves www.groupfinds.com and its server-side
routes. | Tokyo region, with a global edge network |
| Cloudflare | DNS for groupfinds.com, and the network
requests pass through it. | Global |
| Resend | Sends the few emails we send: server-claim notifications and owner reports. Email addresses only. | United States |
| Discord | The source of everything the bot sees, and the place the bot writes to. Discord's own privacy policy governs your Discord account. | Global |
Some of these are outside Japan and the EEA. Transfers rely on the providers' standard contractual clauses. We do not sell personal data, we do not share it with advertisers, and we do not pass it to data brokers.
How long it is kept
| Data | Kept for |
|---|---|
| Voice sessions and message counts | As long as the bot is in the server. It is the history the whole product is built on; a levelling bot that forgets last year has nothing to show. |
| Member and moderation events | As long as the bot is in the server. |
| Per-member totals, roles, settings | As long as the bot is in the server. |
| Everything for a server the bot has left | Deleted within 90 days of removal, on request immediately. |
| Passport consent and computed totals | Until the member switches the field off, which deletes it, or asks for deletion. |
| What a Passport fill brought in from Discord | Until the member deletes their Passport
with /gf-passport, which removes all of it, or asks us to. Running the fill again
replaces it rather than adding to it. |
| Where a Passport or report was used | Kept, because it holds no member reference of any kind and so there is nobody for it to be about. The per-server holder digests go with the server row if that row is ever removed. |
| Directory listings | Until the invite stops working, which removes the listing automatically, or until an owner asks for it to be taken down. |
| Website account | Until you delete the account. |
| Database backups | Rolling, up to 30 days. A deletion takes effect immediately in the live database and drops out of backups as they roll over. |
Your rights, and how to actually use them
Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to us holding it, or ask for it in a portable form. If you are in the EEA or the UK you have these rights under the GDPR; if you are in California you have them under the CCPA. We do not charge for any of it and we do not treat you differently for asking.
Deleting your data
- The fastest route: email support@groupfinds.com from any address, telling us your Discord username and, if you can, your Discord user ID. Right-click your name in Discord and choose Copy User ID to get it. We will remove every row keyed to that ID across every server, and reply when it is done. We aim to do it within 7 days and the law allows us 30.
- The Passport, instantly and by yourself: run
/gf-passportand pick Delete. That deletes your consent record, your computed cross-server totals and everything/passport/fillbrought in from Discord — your account creation date, badges, server counts, the IDs of servers you own and your linked accounts — straight away, with nobody in the loop. Because the command can be added to your own Discord account, you can do this from any server or from a direct message, whether or not the bot is there. - A whole server: a server owner can remove the bot, and can ask us to delete that server's records. Removing the bot stops all collection immediately.
If you are not happy with how we handle a request you can complain to your local data protection authority.
Children
Discord requires its users to be at least 13, and older in some countries. GroupFinds is not directed at children and we do not knowingly collect data from anyone below Discord's minimum age. If you believe a child's data is in our system, write to support@groupfinds.com and we will delete it.
Cookies
The website sets a session cookie when you sign in, and stores your preferences in your browser. There is no advertising cookie, nothing that follows you onto other people's websites, and no cookie banner because there is nothing to consent to beyond what signing in requires. The product analytics described below store one random number in your browser, and that is the whole of it.
Product analytics
We measure how the website is used, so that we can tell which pages actually lead someone to add the bot to their server. It is one question and it had no answer before: a page on this site, and then an install.
It does not identify you. There is no profile of you, no session recording, and nothing that watches where your mouse goes or what you type. We record which kind of page was opened - a server page, the directory, pricing - the press of an "Add GroupFinds" button and which button it was, and a handful of named actions such as downloading a chart or copying an embed. Where a page is about a particular server, the server's id goes with it, because otherwise "which page led to this install" has no answer; a server is not a person, and a server's member count is recorded only as a range and never as an exact figure.
Your email address, your Discord account, your username and your display name are never sent, and neither is anything anyone has written. What identifies the visit is a random number this site generates in your browser and stores there. It is not derived from anything about you, it is not joined to your account, and clearing your browser's site data for groupfinds.com ends it.
That number travels with you through the "Add GroupFinds" link so that the install, which happens on Discord's side where we can see nothing, can be matched back to the page you pressed it on. Nothing else about you goes with it.
If your browser sends a Do Not Track signal, none of this runs at all - no number is stored and nothing is sent.
The measurements are processed for us by PostHog. Separately, some pages load Microsoft Clarity, which
is a usage-analytics tool of the same kind; you can switch it off for your browser by opening any page
with ?clarity_optout=1 on the end of the address.
Security
Data is held in a managed Postgres database with row-level security, reached over TLS. Access to the production database is limited to the operator. Server owners can only ever read their own server's data, enforced in the database rather than in the interface. No system is perfect; if we ever discover a breach affecting personal data we will notify the people affected and the relevant authority within 72 hours.
Changes to this policy
If we change what the bot collects, this page changes with it, and the date at the top changes. A change that materially widens what is collected will be announced on the site and to server owners before it takes effect.
Contact
Saul Fleischman, trading as GroupFinds
Sakai, Osaka, Japan
support@groupfinds.com
See also the Terms of Service and the full list of permissions the bot asks for and what each one does.