Privacy Policy

This Policy applies to all interactions with the Service, including but not limited to interactions conducted within Discord guild environments, private messaging contexts, and any auxiliary interfaces through which the Service may be accessed. The Policy governs the collection and handling of information arising from such interactions to the extent permitted and required by applicable law.

The Service operates as an automated software agent deployed on the Discord platform. All use of the Service is further subject to Discord's own Terms of Service and Privacy Policy, over which we exercise no control and for which we bear no responsibility.

In the ordinary course of providing the Service, we may collect and process certain categories of information. The nature and extent of information collected varies based on how the Service is configured and how you interact with it. Such information may include, without limitation:

• Interaction Data. Content submitted to the Service through commands, mentions, replies, or direct communications, together with relevant channel context, is processed for AI assistance, summaries and configured moderation. Deleted-message and edited-message disk archives are disabled. Per-request temporary artifacts used by supported AI features are cleaned up when processing finishes; generated image delivery has its own temporary artifact lifecycle.
• Platform Identifiers. Discord user IDs, usernames, server IDs and channel IDs are personal data. They are retained where needed for service delivery, settings, access control, DM contact/server lists and administrator-configured features. The DM contact list contains identity and contact metadata, not message bodies.
• Usage and Event Data. Records of Service interactions, including command invocations, timestamps, associated channel and guild context, and operational metadata, collected for the purposes of monitoring, diagnostics, abuse prevention, and service improvement.
• Verification Data. Server-configured verification questions must be minimal and non-sensitive. Questions requesting secrets, contact details, personal beliefs, or other sensitive traits are not permitted. Members can ask server staff for manual review. Automated review is instructed not to grant or deny access based on religion or other protected characteristics. Answers and AI review reasons are kept only in process memory while pending, not in the verification database or staff-channel notices. Authorized staff view answers through short-lived private responses. Do not submit credentials, health or financial details, or personal information about anyone else.
• Moderation Data. Ordinary messages may be processed in small batches for administrator-configured moderation. Moderation notices and audit entries posted inside Discord remain subject to Discord and server retention controls. Disabling local archives does not delete arbitrary Discord server history.
• Audio Data. Where the Service is active within voice communication channels, audio signals may be temporarily processed in real time for the purpose of enabling voice-interactive features. Such audio data is not retained in any persistent form following the conclusion of the relevant processing operation.

When the dashboard is configured, signing in with Discord authorizes access to your Discord identity and server list. The dashboard uses your user ID, username, avatar reference, manageable server IDs, channels, roles, and current permissions to show and protect server configuration. Discord credentials and OAuth access or refresh tokens are not exposed to browser code.

The service stores encrypted OAuth and session payloads server-side, with hashed opaque session identifiers. Secure, HttpOnly, SameSite=Lax cookies named __Host-based_session and __Host-based_oauth support login and the browser session. Dashboard sessions have an absolute eight-hour lifetime; login state expires after ten minutes. Signing out deletes the local session and attempts to revoke the provider token. It does not delete saved server configuration or its audit history.

Server configuration is stored per server with a revision number. The configuration audit stores the actor ID, server ID, timestamp, revision, and changed field names, not setting values, chat content, verification answers, or OAuth tokens. Configuration and audit metadata remain while needed for the service or until an applicable deletion request is fulfilled. Unsaved dashboard edits stay in the current browser tab’s memory; they are not saved configuration.

Server configuration includes optional personality settings: the bot’s name in that server, a personality description, tone, reply length, emoji and roast level, reply language, custom rules and topics to avoid. Staff write this text. When Personality is on, it is sent to the AI provider as instructions with each reply. Long text is shortened to fit a fixed size. Do not put personal information in it.

Every server read and write rechecks current membership and permissions. Mutations also require the current rotating CSRF token and a matching website origin. The dashboard’s configuration-readiness check does not monitor the bot’s gateway or external providers; runtime connectivity is reported as unknown. An unavailable or unconfigured service is shown as unavailable, not populated with example servers or activity.

Memory lets Based remember short facts (up to 200 characters each), not conversations. It does not archive chat history.

• Off by default. Server administrators choose whether to turn it on. Memory in DMs is separate and stays off until you opt in with /memory enable in DMs. /memory disable stops DM memory without deleting your facts.
• Two scopes. User memories are your own facts, linked to your Discord user ID and the server or DM they were saved in. They are never shown on the website or to other members’ memory commands. Server memories are shared facts about a server, managed by staff with Manage Server.
• Limits. By default, 15 facts per user in each server or DM, 30 server facts, and 10 writes per person per day (updates count). Administrators can raise these to at most 30, 60 and 30.
• What the AI sees. A small pinned core (at most five facts and 300 characters per reply) is included with replies, and other facts are looked up only when relevant. Both are sent to the AI provider that writes the reply, described in section 4. Replies may mention relevant facts, so don’t save anything you wouldn’t want referenced there.
• How long it’s kept. Facts stay until they are deleted, replaced or evicted. When memory is full, saves you ask for are refused; automatic saves may remove the oldest, least recently used unpinned fact.
• Deleting. Use /memory view, /memory forget or /memory clear to see or delete your facts in the current server or DM. Staff can delete server facts in Discord or on the dashboard. Deleting removes the stored text immediately, but not messages already sent in Discord or records kept independently by providers.
• Audit records. Memory changes are logged with IDs, the action and a timestamp, never the fact itself. These records are kept until Based leaves the server or an applicable deletion request is fulfilled.
• When Based leaves. Removing Based from a server deletes that server’s stored facts, daily counters and memory audit records.

Don’t save secrets, contact details, sensitive personal information or other people’s private facts. Based filters these out where it can, but the filter can miss things.

Information collected in connection with your use of the Service is processed for one or more of the following legitimate purposes:

• Provision, operation, and maintenance of the Service and its constituent features;
• Fulfilment of requests submitted by users or guild administrators;
• Ensuring the security, integrity, and availability of the Service;
• Enforcement of administrator-configured policies and applicable terms;
• Detection, investigation, and prevention of unauthorised use, abuse, or violations of these terms;
• Compliance with applicable legal or regulatory obligations.

We do not process personal information for advertising purposes, nor do we use collected data to construct inferences about individuals beyond what is necessary to deliver the Service.

In the course of providing certain features of the Service, user content and interaction data may be transmitted to third-party artificial intelligence infrastructure providers. Such transmission is necessary for the delivery of AI-powered functionality and is governed by the applicable terms and privacy policies of those providers. We do not control, and are not responsible for, the data practices of any third-party provider.

Depending on the feature and configuration, providers can include Google-model inference, OpenAI Codex, and voice services such as Sarvam and Deepgram. Their applicable terms and privacy policies govern their processing. The operator confirms that the configured upstream API uses zero-data-retention processing and does not use submissions to train models. Verification uses only those upstream API models, not the local CLI fallback. Provider controls must be maintained when configuration changes.

We do not use Discord message content to train our own machine learning or AI models, or for advertising.

Except as described in this Policy or as required by law, we do not sell, rent, license, or otherwise disclose personal information to third parties.

Verification answers and AI reasons expire after three days while pending and clear earlier on review completion, bot restart or unload. Expired answers cannot be retrieved; housekeeping removes expired memory entries every five minutes while online. Users may need to resubmit after a restart. Verification identifiers and status metadata also expire after three days, with database cleanup at startup and every five minutes while online. New database rows contain no answer or AI-reason payloads.

The obsolete deleted/edited-message archives have been removed and are no longer created. DM contact metadata, server/settings records, operational diagnostics, and feature metadata for statistics, invite attribution and giveaways remain stored while needed for their disclosed functions or until removed following an applicable deletion request. These records may outlive 30 days and must not be treated as anonymous. This application cleanup does not rewrite repository history, database backups or independent Discord records.

Subject to applicable law and the technical constraints of the Service's deployment model, you may have certain rights with respect to the information we hold about you, including rights of access, correction, deletion, restriction of processing, and data portability. The availability and scope of such rights will depend on your jurisdiction and the nature of the information concerned.

To request access, correction, deletion or manual verification, contact @jalkarna on Discord with your user ID and the relevant server ID. Do not send passwords or tokens. Requests cover application-controlled records; Discord and independent providers have their own data controls.

Use .help privacy to find the policy and deletion contact. .autoreply me off disables random replies for you, not administrator-configured moderation. Server administrators control bot access through Discord permissions and may remove the bot. The invite asks only for the basics needed to chat, post embeds/files and join voice. Extra module permissions stay opt-in.