Privacy Policy

Last updated 2026-09-02.

Vigil is not open to the public yet. This page describes how Vigil handles data when it is running. Some of what it describes is designed and not yet deployed, and no server outside development is using Vigil, so none of it has happened to anybody's data. This note comes off at launch, and the page will be true before it does.

The short version

Vigil is a Discord bot that watches YouTube channels and Twitch streamers and posts to a channel you pick when there is a new upload or a stream goes live.

It stores IDs and settings for the servers that use it. It keeps no records about the people in those servers. There is no user table in its database and there is never going to be one, because the bot has no gateway connection and so it cannot read your messages even if somebody asked it to.

There is one exception, and it is worth knowing about up front. A server administrator can write a custom message template, and Vigil stores that exactly as typed. Put a name in one and the name is stored.

Who is responsible

Vigil is a project run from the United Kingdom. Under UK GDPR and the Data Protection Act 2018, the person running it is the data controller, and the address below reaches them.

Contact: privacy@vigilbot.net

This policy covers Vigil. Discord is its own controller for your Discord account and for what you do on the platform, and its own privacy policy covers that.

What is stored

Everything below is what the database holds. This list matches the schema, not a summary of it.

Per server:

• The Discord server (guild) ID
• Whether the server is on the free or paid plan, and the Discord entitlement ID if it is paying
• The date the bot was added

Per subscription, meaning one source being watched into one channel:

• Which server it belongs to
• Which source type it is, YouTube or Twitch
• The external source ID: a YouTube channel ID, or a Twitch user ID
• The Discord channel ID the notification goes to
• The Discord role ID to ping, if one was chosen. A role, not a person
• The filter settings, such as whether short videos are wanted
• The custom message template, if one was written
• Whether the subscription is working, and if it is not, the reason
• The point it started delivering from, so setting it up does not post the whole back catalogue
• When it last delivered something

Per external source being watched, shared across every server watching it:

• The source type and ID
• The secret used to verify pushes from YouTube or Twitch
• When the push subscription expires, when it was last renewed, when it was last polled, and how many times renewing it has failed
• Whether a subscribe or unsubscribe request is in flight, and since when

Per notification sent:

• Which subscription it belongs to
• The ID of the thing that happened, such as a YouTube video ID
• Whether it sent, failed, or was skipped, how many attempts it took, and when
• Whether it was found by push or by polling
• When the next retry is due, if it is waiting to retry
• The error text, if it failed

The subscription and notification rows also carry an internal ID and the time they were created. That is the lot.

What is not stored

• No message content. The bot receives slash commands as signed HTTP requests and does not connect to Discord's gateway at all. It has no message intents, privileged or otherwise. It has no way to read your server's messages, so this is not a promise it could break.
• No user records. No usernames, no user IDs, no member lists, no roles held by anybody, no avatars. There is no user table.
• No email addresses. There is no sign-up and no account to make.
• No payment details. Paying goes through Discord's own Premium Apps billing. Vigil never sees a card number and has no checkout of its own. All it gets back from Discord is an entitlement ID saying a given server is paid up.
• No cookies, no analytics, no tracking. There is no dashboard, and the only website is www.vigilbot.net, which is this page, the terms, and a front page that links to both. What that site does is further down.

A custom message template is the exception, because it is stored word for word. The next section covers it.

What arrives, and what is kept

When somebody runs a slash command, Discord's request includes who ran it. Vigil needs that to answer the right person. It is used to send the reply and it is not written to the database.

Two things you type at the bot are stored, because they are settings rather than messages: the source you asked it to watch, and the custom message template if you write one. A template is stored exactly as written, so do not put anything private in one.

Why any of it is stored

To run the thing the server asked for. Under UK GDPR that is legitimate interests for the free tier, and performance of a contract for the paid one. None of it is used for advertising or profiling.

Who else sees it

• Discord, because the notification is posted there and because paid plans are billed there.
• YouTube (Google) and Twitch (Amazon), when Vigil subscribes to their push feeds. They get told which channel is being watched and where to call back. They are not told anything about your server or its members.
• Cloudflare, whose tunnel carries the traffic to the bot.
• Hetzner, who host the server the bot runs on, in Nuremberg, Germany.

None of it is sold to anyone.

The controller is in the UK and the server is in Germany, so the data is stored in the EEA. UK law treats the EEA as an adequate destination, so nothing extra is needed for that hop. Traffic on its way there crosses Cloudflare's network, which spans more countries than the EEA does. That is transit rather than storage, and it is how anything reaches a server over the internet.

This website

www.vigilbot.net is three static pages on Cloudflare Pages. They set no cookies, run no analytics, and there is nothing to log into. Cloudflare serves them, so it handles your IP address the way any web host does, and its own terms cover that.

There is deliberately no analytics on this site. Knowing how many people read a privacy policy is not worth contradicting the sentence above.

Keeping it safe

Traffic to the bot is HTTPS only. Nothing arriving from outside that could change anything is acted on until its signature has been checked, which is what stops a forged push being treated as real. Secrets live in environment variables and never in the code, and the database is not reachable from the internet.

None of that makes it unbreakable. If something goes wrong that affects the data described here, the ICO gets told within 72 hours, Discord gets told because it is their data too, and anyone affected gets told where the risk to them is high.

How long it is kept

/unwatch deletes that one subscription and the delivery records that belong to it. Removing the bot from the server deletes everything held for that server, every subscription and every delivery record together.

One thing outlives both: the shared record of a watched source, which is stored once and used by every server watching it. It goes when the last server watching that source stops.

Delivery records are kept for 90 days and then deleted. They exist so the bot can tell it has already sent something and so /status can show you it is alive.

Your rights

Under UK GDPR you can ask to see what is held about you, correct it, have it deleted, restrict what is done with it, object to it, or take it elsewhere.

In practice Vigil almost certainly holds nothing about you personally, because it builds no records about individual members. If you want to check anyway, or you want a server's data deleted, email privacy@vigilbot.net and say which server. A server administrator can also delete the lot themselves by removing the bot.

Anything sent to that address gets an answer within one month, which is the limit UK GDPR sets.

You can complain to the Information Commissioner's Office at ico.org.uk at any point, whether or not you asked us first.

Children

Discord's own terms require users to be 13 or older, or older where local law says so. Vigil asks for nothing about individual users of any age and builds no records about them.

Changes

If this policy changes, the date at the top changes with it. Nothing here is going to quietly get worse without the date moving.