Legal
Privacy Policy
This policy explains what Java Lava stores, why, for how long, who receives it, and how you can exercise your rights.
1. Overview
Java Lava is a Discord bot with a web dashboard. It stores what it needs to run the features a server turns on, such as moderation, tickets, leveling and welcome messages. If a feature does not need a piece of data, we do not collect it.
This policy applies to visitors of this website, to people who sign in to the dashboard, and to members and staff of Discord servers where Java Lava is installed. For most server data, the server’s administrators decide which features are on, so they choose what is processed for their community; we process that data on their behalf to provide the service.
2. Data We Collect
Depending on which features a server enables, we store the following.
- Account and login data. When you sign in with Discord: your Discord user ID, username, display name, an avatar reference, and your email address if Discord provides it. Your Discord OAuth access and refresh tokens are stored encrypted. Avatar images themselves are not stored; they are loaded from Discord when needed.
- Session cookies. Two strictly necessary cookies keep you signed in (see the Cookie Policy). Session records are kept in a server-side session store for at most 5 hours from sign-in.
- Server configuration. Enabled features, channel, role and message IDs, and the settings chosen on the dashboard. For servers that connect their own bot, the custom bot token is stored encrypted and is never shown back in the dashboard.
- Member records. For members a feature needs to recognize: Discord user ID, username, display name, roles, account creation and join/leave dates, plus feature data such as levels and XP, economy balances, invite attribution, AFK status, and birthdays (month and day, and year only if the member provides it).
- Moderation records. Cases (warnings, timeouts, kicks, bans and similar), the reason, the acting staff member and expiry; and ban appeals, including the answers submitted and the reviewer’s decision and note.
- Support tickets. Ticket subject, intake answers, staff notes, ratings, and the messages exchanged in the ticket, including message text, author, attachments and embeds, so staff can review and respond.
- Audit log. Changes staff make to server configuration, with who made them and when.
- Content staff create. Tags, saved messages, suggestions, form responses, giveaways, reminders, custom commands, social-feed connections, reaction-role panels and server backups (structure, roles and channel settings, not message history).
- Aggregate activity. Daily counts such as messages per day, active members and per-command totals, used for analytics charts.
- Billing state. Each server’s plan tier, status and period end, and invoice records. No payment processor is connected at the moment, so we do not currently collect payment details.
- Messages you send us. Anything you submit through the support page, including your email address, is used only to reply.
- Error reports. When a page of the website or one of our services fails, we record the error text, a stack trace, the page path (without query strings), the time and how often it happened, so we can find and fix the problem. Reports sent from your browser do not include your IP address or account. Errors from our services can include the ID of the server or account involved. Records are deleted after 30 days without a repeat.
- Technical data. Like any web service, our servers and hosting provider handle request metadata such as IP addresses and user agents transiently to deliver the site and apply rate limits and abuse protection.
3. What We Do Not Collect
Ordinary server messages are not stored: auto-moderation evaluates a message as it arrives and does not keep it. Messages are stored only where a feature explicitly needs them, such as inside a support ticket. We do not collect precise location, government ID numbers, or health data, and we do not store avatar images.
4. Purposes and Lawful Bases
Where the UK GDPR or EU GDPR applies, we rely on the following bases.
- Providing the service (contract or legitimate interests). Signing you in, running the features a server has enabled, showing dashboards, and keeping moderation, ticket and audit history so staff can act consistently.
- Legitimate interests. Security, abuse prevention, rate limiting, fixing faults and keeping the service running. We consider that these interests are not overridden by your rights given the small amount of data involved.
- Consent. Optional analytics and embedded third-party content on this website, only if you accept them in cookie settings. You can withdraw consent at any time.
- Legal obligation. Keeping invoice and tax records where the law requires it, and responding to lawful requests.
We do not sell personal data and we do not use it for advertising or profiling.
5. Retention
- Removing Java Lava from a server starts a 90-day grace period. If the bot is not re-added in that time, the server’s configuration, moderation records, tickets, leveling data and other server-scoped records are permanently deleted. Re-adding the bot within 90 days cancels the deletion.
- Audit log entries are deleted automatically after 365 days.
- Dashboard notifications are deleted after 180 days.
- One-off reminders are deleted 30 days after they are delivered.
- Status-page uptime samples are kept for 90 days.
- Moderation cases, appeals and ticket transcripts are kept while the server remains installed, so staff have a history to refer to, and are then deleted with the rest of the server’s data.
- Invoices and subscription records are not removed with a server’s data because we may be required to keep them for accounting and tax purposes.
Retention can be extended where needed for abuse prevention, an active legal dispute, or a legal obligation.
7. International Transfers
Discord and our infrastructure providers may process data in countries outside your own, including outside the UK and EEA. Where that happens, we rely on the safeguards recognized by data protection law, such as adequacy decisions or standard contractual clauses, put in place with the provider.
8. Your Rights
Depending on where you live, you can ask to access the data we hold about you, correct it, have it deleted, receive a portable copy, restrict or object to certain processing, and withdraw consent you have given. You may also complain to your local data protection authority.
If you are signed in, you can download a copy of your data or delete it yourself at Your data.
For data inside a Discord server, the server’s administrators are the first point of contact for what that server records, and we will help them act on your request.
9. How to Exercise Your Rights
Contact us through the support page, tell us your Discord user ID (and server ID if the request concerns one server), and say what you would like us to do. We may ask you to confirm you control the Discord account before acting. We aim to respond within one month. Server administrators can also remove Java Lava from their server to start deletion, as described under Retention.
10. Security
OAuth tokens and custom bot tokens are encrypted at rest and are excluded from ordinary database reads. Sign-in cookies are HttpOnly and, in production, Secure. Access to production data is limited to what is needed to run the service. No system is completely secure, so we keep the data we hold to what features need, which limits the impact of any incident. If a breach affects your data, we will notify you and the relevant authorities as the law requires.
11. Children
Java Lava is meant to be used within Discord, which requires users to meet its minimum age (13, or higher where local law sets a higher age). We do not knowingly collect data from anyone below that age. If you believe a child has provided data to us, contact support and we will delete it.
13. Changes to This Policy
If we materially change what we collect or why, we will update this page and its “Last updated” date.