Bot Privacy Policy

Ur Gay Now is a volunteer-run LGBTQ+ community on Discord and VRChat. This policy explains the personal data our Discord bot, this website, and our VRChat Group Logger process, why we need it, and what we do with it. It is written to match what the software actually does — if the implementation changes, this page is updated.

The short version: we collect the minimum needed to moderate the community and to handle reports. We do not sell your data, and we do not use it for marketing.

From the Discord bot

• Your Discord user ID, so the bot can recognise you and apply moderation.
• The Discord server ID of the UGN server.
• Role information, including role IDs and names, used to decide which commands you can run.
• Records of moderation actions, such as who was timed out by whom and why. These exist so staff can review decisions.

From this website

• Reports you submit: the category, your description, the reported person’s name or Discord ID if you provide it, the incident date if you provide it, any links you add, any evidence files you attach, and whether you chose to submit anonymously.
• Optional contact details: your name and email address, only if you provide them and do not submit anonymously.
• Technical data used for abuse prevention: a salted, one-way hash of the IP address a request came from. The raw IP address is not stored in the database. The hash is used to rate-limit submissions and to spot duplicate reports, and it is not used for anything else.
• Cookies: an httpOnly cookie that remembers which reports your browser submitted so you can track them, and a staff session cookie for administrators.
• Support messages: if you contact us through the support form, the details you type plus a generated ticket reference.

• To investigate reports and keep an accurate moderation record.
• To apply and record moderation actions in Discord.
• To prevent spam, abuse, and duplicate submissions.
• To let you follow the status of a report you submitted.
• To answer support requests.

The bot only collects Discord data for members of the UGN server, and only the data needed to run its commands. We do not read, store, or forward the content of your messages. If a moderation command logs a message reference (such as a deleted message ID), that record exists only for staff review.

Reports are confidential. Specifically:

• Only authorised UGN staff can open a report.
• Evidence files you attach have no public URL. They can only be opened through an authenticated staff route, and every time a staff member opens one it is written to the report’s audit trail.
• Internal staff notes are never shown to the person who submitted the report, and never posted to Discord.
• Our staff notification webhook receives only the report reference, category, priority, whether a target was named, how many files and links were attached, and a private link to the dashboard. It does not receive your description, your contact details, or your uploaded files.
• Anonymous reports do not store your name or email, and staff cannot see who sent them. Anonymous does not mean technically untraceable: our hosting and security providers may keep their own technical logs.

Our hosting provider records standard request logs (such as IP address, timestamp, and requested URL) for security and availability purposes. Those logs are controlled by the provider under its own policy and are not used by UGN for marketing. Staff actions inside the admin console are recorded in our own audit logs.

We share data only with the service providers needed to run the community, and only to do their job:

• Hosting and deployment: the provider that serves this website.
• Database provider: stores the community content, staff list, and reports.
• Image storage provider: stores images uploaded for community photos, gallery submissions, and similar site content. Report evidence is not stored with them — it is kept in the database so it cannot be shared by URL.
• Discord: for anything the bot does inside Discord.

We do not sell data, share it for advertising, or hand it to law enforcement except where the law requires it. If we are ever legally compelled to disclose a report, we will tell the affected person unless we are not allowed to.

• Reports are kept as moderation records. Resolved and dismissed reports are not automatically deleted; they remain available to authorised staff for the audit history and are removed only if a staff member deletes them or you ask us to.
• Report resolution data (outcome text and the staff member who closed it) is kept with the report.
• Evidence uploads that are never attached to a report are deleted automatically after 24 hours.
• Rate-limit data (the hashed IP) is kept with the report so duplicate-submission checks keep working.
• Tracking cookies keep the list of reports your browser submitted for up to 180 days. Clearing cookies means you will need your private tracking link instead.
• Support messages are kept as long as they are useful for support and moderation.

There is currently no automated job that deletes closed reports on a timer. If you want a report or its evidence removed, ask us and we will do it.

• Report and admin data is only served to authenticated staff, checked on the server.
• Session and tracking cookies are httpOnly and marked secure in production.
• Secrets such as our Discord webhook URL are stored only in server-side environment variables, never in browser code or public API responses.
• Evidence files are type-checked, size-limited, and stored without a public URL.
• Report submissions are rate-limited and validated on the server.
• Administrative actions are recorded in an audit trail.

You can ask to see, correct, or delete the personal data connected to a report you submitted. Contact staff in Discord or through the support page, and include:

• Your report reference, for example UGN-000123, or
• Your private tracking link, which is the most reliable way for us to find it.

We may ask you to confirm the request before we act on it. We will always try to respond, and we will explain if we cannot delete something — for example, because it is part of a moderation record we are required to keep.

This service is not directed at children under 13, and Discord requires members of our server to meet its minimum age requirement. We do not knowingly collect personal data from children below that age. If you believe a child has submitted a report or created an account in our spaces, tell us and we will deal with it under our safeguarding process.

We use Discord, VRChat, and hosting, database, and storage providers. Their own terms and privacy policies also apply to you when you use those services. We do not control them, and we are not responsible for how they handle data outside the parts they process for us.

If our data practices change, this page is updated and the “last updated” date changes. We will not retroactively weaken a commitment that has already been made about reports you have submitted.

Privacy questions and requests can be sent to UGN staff in Discord or through the support page. Please include a report reference if your question is about a specific report. The same channel handles requests about data collected by the VRChat Group Logger (see sections 15 to 22 below).

Ur Gay Now operates a separate tool called the VRChat Group Logger(a Python rewrite of the legacy "Scarlet" logger). It is a self-hosted Discord bot that mirrors a VRChat group's audit log into private Discord forum channels for authorised UGN staff moderation. It is not the Discord bot described in sections 1 to 14, and it does not serve general users. This section explains what the Group Logger collects, how it monitors, and how it stores and protects information.

The Group Logger is used only for groups UGN has legitimate authorisation to monitor. It is run by authorised staff only and is not available to community members. Where this section says "we" or "UGN" in relation to the Group Logger, it means the authorised UGN staff who operate it.

The Group Logger may collect and process the following information about VRChat groups and users, only where the information is returned by the VRChat API or observed through the monitoring methods described in section 17:

• VRChat user IDs, usernames, and display names — of group members, actors (the user who performed an audit-log event), targets (the user an action was taken against), and the dedicated logger account used to access the API.
• VRChat group IDs and group names — for each group linked for monitoring.
• Group membership and membership changes — users joining or leaving a monitored group, captured from the VRChat audit log and from periodic membership snapshots.
• Group roles and permissions — the role IDs and effective permissions of the logger account in each linked group, used to determine what the logger can read and do.
• Group audit logs — the full audit-log event stream for each linked group, including the raw event payload returned by VRChat.
• Moderation events and administrative actions — bans, kicks, warnings, unbans, join requests, invites, and similar actions recorded in the group's audit log, plus actions initiated by staff through the Group Logger's Discord moderation buttons and commands.
• Instance IDs and relevant instance information — VRChat group instance IDs, associated world IDs and world names, and whether an instance is open or closed.
• Instance activity and session history — when instances are opened or closed, derived from the audit log and from checks of the group's active instances.
• Watched users and groups — the VRChat users and groups linked for monitoring, including identity links between Discord and VRChat accounts made through voluntary bio-code verification.
• Event timestamps and associated metadata — when each audit event occurred and when it was first seen by the logger.
• API responses and relevant event payloads — the raw JSON returned by the VRChat API for audit-log and group requests is stored so events can be reconstructed and reviewed.

Client-observed information is not collected. The Group Logger does not integrate with the VRChat game client and has no client-monitoring feature. No client-observed information (for example, from an in-game overlay or local client) is collected, and no such feature is implemented.

API-based monitoring

Monitoring is performed through the VRChat API. The logger polls each linked group's audit-log endpoint at a configurable interval (default 30 seconds), fetches new audit-log events, de-duplicates them, and stores them locally. Polling is not guaranteed to be continuous and can be affected by VRChat API outages and rate limits (see section 20 of the Bot Terms of Service).

Optional client-observed monitoring

The Group Logger does not implement client-observed monitoring. It does not observe VRChat through a connected game client, and no client-observed data is collected or processed.

Automatic group joining

When a group is linked through the /link-group flow, the dedicated logger account may automatically attempt to join the group. This is optional functionality: it is only attempted as part of linking a group, it is not mandatory, and it is not permanently enabled for all groups. If automatic joining cannot succeed (for example, an invite-only or blocked group), an administrator may instead invite or approve the logger account manually. Joining only ever happens for groups UGN has authorisation to monitor.

Derived or inferred information

Some information is derived rather than directly reported by VRChat:

• "Instance closed" events are derived: when a previously open instance no longer appears in a successful check of active instances, a close event is synthesized. Fetch errors or timeouts never produce a close event.
• Membership changes (joins, leaves, role, username, and display-name changes) arederived by comparing periodic membership snapshots.

Derived or inferred information may not be independently verified and should not automatically be treated as confirmed evidence. It is presented alongside the raw audit-log record so staff can distinguish what VRChat reported from what the logger inferred.

What evidence is collected

Evidence consists of the audit-log events, moderation actions, membership changes, instance states, and raw API payloads described in section 16, together with records of staff-initiated moderation actions (who requested an action, the target, the reason, and the outcome).

Why evidence is collected

Evidence is collected for moderation investigations, incident reviews, administrative decisions, and community safety within the groups UGN is authorised to monitor.

Who can access evidence

Evidence is delivered to private Discord forum channels. Access is limited to the Discord server owner, Discord administrators, and the staff or moderation roles configured during setup. Community members and @everyone cannot view the logging forums.

How evidence is protected

Evidence is stored in the local database and delivered only to private Discord forum threads with no public URL. Every staff-initiated moderation action is recorded with an idempotency key so it cannot be duplicated or silently altered.

Export and sharing with authorised Discord staff

Evidence can be exported to CSV, JSON, or HTML by authorised staff for use in investigations. It may be shared with authorised Discord staff through the private logging forums. It is not published publicly and is not shared outside the staff team except where the law requires it.

Retention

Events are archived after a configurable retention period (default 30 days, set per group or globally). Archiving moves events into an archive batch; events are not automatically deleted. See section 20.

Deletion

There is no automatic deletion job for archived audit events. If you are the subject of Group Logger records and want them corrected or deleted, contact UGN staff through Discord or the support page (see section 14). We will explain if we cannot delete something, for example because it is part of a moderation record we need to keep.

Local data processing

The Group Logger processes all monitoring data locally. Its database is a local SQLite file. An optional PostgreSQL backend is supported but is not the default and is not used unless explicitly configured.

Credential protection

VRChat credentials (username, password, and optional TOTP secret) live only in the local environment configuration file and are never requested, accepted, or stored through Discord. Secrets such as the Discord token and VRChat password are automatically redacted from log output and are never written to logs.

Authentication and dashboard access

An optional web dashboard is available. When a dashboard API key is configured, dashboard access requires that key; when no key is configured, the dashboard has no authentication of its own. The dashboard is disabled by default and is separate from Discord authentication.

Role-based access restrictions

Access to logged evidence is enforced through private Discord forum channels. The@everyone role is denied View Channel; only the server owner, Discord administrators, and staff or moderation roles explicitly added during setup can view the logs. Staff role IDs are stored in the local database and re-applied whenever forums are created or repaired.

Administrative activity logging

Staff-initiated moderation actions (bans, kicks, warnings, unbans, and Discord bans) are recorded in an audit trail with a unique idempotency key, so a repeated action cannot be performed twice and each action is attributable to the requesting staff member.

Evidence access restrictions

Evidence can only be opened by staff with access to the private logging forums. There is no public URL to evidence, and evidence is not shared by link.

Backup considerations

The SQLite database file can be backed up by copying it (while the bot is stopped) or by using SQLite's online backup. Backup records are kept in the database. Staff are responsible for backing up the database and the encryption key; losing the key means the stored VRChat session cannot be decrypted (the account would just need to re-log in).

Protection against accidental exposure of authentication credentials

The persisted VRChat session cookie is encrypted at rest using Fernet (AES-128-CBC + HMAC) with a locally stored key. Only the session cookie blob is encrypted; the database as a whole is not encrypted at rest. Credentials and cookies never leave the local installation except as API traffic to VRChat and Discord.

Optional Discord integrations

The Group Logger integrates with Discord only by posting audit-log events and moderation confirmations to the private logging forum channels it creates. It does not use Discord webhooks for the website, and it does not forward VRChat data to any Discord service beyond those private forums.

Audit events are retained in the local database and archived after a configurable period (default 30 days, configurable per group or globally). Archived events remain in the database; they are not automatically deleted. There is currently no scheduled job that deletes closed records on a timer.

• Audit events and monitoring history: kept until archived and not automatically deleted; removal happens only on staff deletion or on a valid data subject request.
• Evidence: retained with the events it relates to and subject to the same retention and deletion rules.
• Linking challenges and verification codes: codes are single-use, expire after 10 minutes, are stored only as a SHA-256 hash, and are invalidated on success or expiry. Staged linking challenges are removed when they expire or complete.
• Log files: application logs are rotated and retained for a configurable number of days (default 14). Secrets are redacted from logs.

Because retention is configurable, there is no single fixed deletion date. To request deletion or correction of your data, contact UGN staff through Discord or the support page (see section 14).

• VRChat and its API: the Group Logger connects to VRChat's public API (api.vrchat.cloud) to read group audit logs, membership, roles, and instances. VRChat operates under its own terms of service and privacy policy, and we do not control how VRChat handles data.
• Discord: events are posted to private Discord forum channels in the UGN server. Discord operates under its own terms and privacy policy.

No other external services are used by the Group Logger by default. Each third-party service operates under its own terms and privacy policy, and we are not responsible for how they handle data outside the parts they process for us.

The Group Logger processes personal data (VRChat user IDs, usernames, display names, and related event data) and is subject to the UK GDPR and the Data Protection Act 2018 where applicable.

• Controller: Ur Gay Now (UGN) is the controller for data the Group Logger collects and stores. VRChat and Discord are independent controllers for data they process themselves.
• Lawful basis: we do not claim that all Group Logger processing rests on a single basis. Processing for community safety and moderation of authorised groups is assessed on its purposes; where we rely on legitimate interests, that reliance is limited to the specific, authorised monitoring purpose. Voluntary identity linking between Discord and VRChat is based on your consent.
• Data minimisation and purpose limitation: the logger collects only the audit-log and membership data needed for authorised group moderation, and uses it only for that purpose.
• Data subject rights: you can ask to see, correct, or delete personal data connected to you that the Group Logger holds. Contact UGN staff in Discord or through the support page (see section 14). We may ask you to confirm the request and will explain if we cannot delete something.
• Third-party processing: VRChat and Discord process data under their own terms and privacy policies; see section 21.

We do not publish a company identity, registered address, or dedicated data protection contact email in this document. If any legally required controller or contact information is missing, it must be supplied by the site owner before publication.