Privacy Policy.

1. Who operates Scrambled

Scrambled Developer Team operates the Scrambled bot and this website. For questions, access requests, corrections, or deletion requests, contact our Discord support server. Please include the relevant Discord user or server ID, but never your bot token or password.

2. Data used by the service

• Sign-in: Discord user ID, display name, avatar reference, and OAuth access token. We request the identify and guilds scopes, not your Discord password or email address.
• Servers: Discord server IDs and names, your reported server permissions, member/role information needed for authorization, and channels and roles used in configuration.
• Moderation: server, message, member and channel identifiers; rule matches; timestamps; intended actions and outcomes; and configuration audit history. Review cases may also include message text and human labels.
• Tickets and staff actions: ticket metadata, staff and member identifiers, reasons, status, and moderation case records. Ticket transcripts can contain conversation content and may be posted to the configured Discord channel.
• Two-step verification (optional): if you turn it on, an encrypted authenticator secret and hashed one-time recovery codes are stored for your Discord user ID until you turn it off.
• Technical data: short-lived request counters and session information. Hosting infrastructure may process network addresses and operational logs.

3. Why we process it

We use this data to sign you in, verify access, provide server configuration, operate moderation and tickets, troubleshoot failures, maintain audit history, and prevent repeated actions or abuse. We do not sell personal information. Public content pages may display advertising through Google AdSense when advertising is enabled. Dashboard pages do not carry advertising or optional visit analytics.

4. External providers

Discord provides sign-in, server information, bot interactions, and subscriptions. If administrators enable malicious-link protection, detected URLs are sent to Google Web Risk for threat-list checks. Scrambled does not send messages or images to an AI moderation provider.

Premium server profiles store the uploaded avatar and banner, nickname, and bio by server ID and send them to Discord for that server. When premium expires, the server profile is reset to its defaults.

5. Cookies and sessions

The dashboard uses essential HttpOnly cookies to keep you signed in and protect Discord OAuth sign-in. If you allow optional analytics, the public website loads Cloudflare Web Analytics and records anonymous daily page-view and link/button-click counts for up to 90 days. These counters contain no URLs, account IDs, IP addresses or individual visitor identifiers. When Google AdSense is enabled, Google and third-party advertising vendors may use cookies or similar identifiers to serve and measure ads. Google can use advertising cookies to show ads based on prior visits to this or other websites. Authenticated sessions last up to eight hours, may end sooner when the Discord token expires, and end on sign-out or a bot process restart. OAuth attempts expire after ten minutes.

Advertising and cookie choices

Read how Google uses information for advertising. You can opt out of personalized advertising through Google Ads Settings. Other vendors may also use cookies to serve ads; information about additional opt-out choices is available at AboutAds. Where a consent message is shown, you can accept or reject optional purposes and revisit your choices through the consent provider’s controls. Essential dashboard sign-in cookies are separate from advertising consent.

6. Retention

Review cases follow each server’s configured retention period of 1–365 days, with a default of 30 days. The bot prunes these records on startup, during maintenance, and when they are accessed. Server owners can use /scrambled delete-learning to delete learning records. Infraction, action, configuration, ticket, and staff moderation audit records are currently retained until removed by the operator; they are not governed by the learning-retention setting. Backups and previously exported Discord files may retain separate copies.

7. Your choices and requests

You can sign out, revoke the app in Discord’s Authorized Apps settings, and ask an authorized server administrator to adjust enabled features. You may request access, correction, or deletion by contacting our Discord support server. Where applicable, you may also have rights to object, restrict processing, receive portable data, and complain to a supervisory authority. We may need to verify your identity and server relationship. Requests may be limited where records must be retained for security, legal obligations, or other people’s rights.

Children and age requirements

Users must meet Discord’s minimum age requirements for their country and any applicable requirements. We do not collect dates of birth for website sign-in. Parents or guardians may contact us about a child’s data through the data-request process.

See the Cookie Policy to manage optional services, and Data requests for the request process.

8. Security and changes

We use permission checks, secure session handling, and transport encryption in production. No system can guarantee perfect security. Report suspected issues privately to our Discord support server. Changes to this policy will be posted on this page.