Hugo Privacy Policy

1. Scope

This policy covers Hugo's Discord bot, the pages hosted by Hugo, and the Hugo dashboard. Discord, Patreon, GitHub, Twitch, YouTube, Tenor, The Cat API, bot-listing sites, and any website you choose to open have their own privacy practices. Server owners and administrators also decide which Hugo features and Discord log channels to enable, who can see those channels, and what configuration text or user IDs they submit.

In this policy, process means that Hugo reads or uses data, including data held briefly in memory. store means that Hugo intentionally writes or sends data to its SQLite database, dashboard session files, backups, a configured Discord channel, or application logs; hosting infrastructure can separately retain its own logs.

2. Data Hugo Processes

Discord Account and Member Data

Discord can deliver account, member, server, channel, role, message, interaction, and voice-state data through Hugo's Gateway subscriptions. Those subscriptions cover guild/member/message events, message content, reactions, typing, polls, moderation and AutoMod, invites, expressions, scheduled events, webhooks and integrations, voice states, and corresponding DM message/reaction/typing/poll events. Hugo does not actively use every subscribed event; an irrelevant or unsupported event is generally ignored after receipt but can first enter Discord.js memory or trigger partial-object fetching. Data Hugo does use includes an account-creation timestamp used to calculate Discord account age for configured age checks. When Hugo joins a server, it fetches the member list and creates or refreshes name records for non-bot members. On bot startup, it again fetches members and refreshes identifiers, usernames, display names, name history, join timestamps, role snapshots, and verification state even if a member has not invoked a feature. The persistent per-server user record can include:

• Discord user ID, username, display name, server join timestamp, last message activity timestamp, and a cached role list.
• Up to 20 previous usernames or display names per user per server.
• Chat XP and level, voice XP and level, reputation, invite count, inviter user ID, and current-period message, XP, voice XP, and reputation counters.
• Birthday announcement preference, birth month and day, optional birth year, the last announced date, and level-alert preference.
• Verification status, CAPTCHA attempt information, jail status, AutoKick message progress, required threshold, and deadline.
• AutoMod infraction history with timestamps, triggered rules or actions, limited trigger details such as a matched word or detected link, and actions taken.

Most of these records are keyed by both server ID and user ID. Exceptions include dashboard sessions and owner-level patron records, which can apply across servers.

Server Settings and Submitted Content

• Server, channel, role, message, emoji, sticker, invite, and owner IDs needed to identify Discord resources; server names, icons, permissions, and related live Discord data may be read or cached for the dashboard and bot features.
• Settings configured by commands or the dashboard, including enabled features, permissions, blocked user IDs, thresholds, cooldowns, per-user command cooldown/last-use timestamps, channels, roles, colors, time zones, language choices, and other options.
• Custom text and URLs supplied for announcements, autoresponses, automessages, sticky messages, role DMs, logs, level alerts, birthdays, awards, reputation, moderation, CAPTCHA, QOTD, bump reminders, Twitch/YouTube alerts, embeds, threads, voice-channel names, flair/color roles, and saved templates.
• AutoMod rules, bad-word lists, thresholds, warning templates, moderation reasons, escalation settings, warnings, moderator IDs, and warning expiry dates.
• Scheduled tasks for reminders, kicks, bans, unbans, timeout-expiry notices, automessages, warnings, QOTD posts, birthdays, awards, and related actions. A task can contain a user ID, channel ID, execution time, reminder text, or moderation reason.
• QOTD pitches and queues, including question text, author ID, username, timestamp, approved questions, skip/shuffle state, and up to 20 recent history entries.
• Saved message/embed templates, including names, content, embed fields, URLs, saver ID, and timestamps.
• Confession and suggestion mappings containing the author's user ID, timestamp, and Discord message ID, capped at 1,000 of each per server. The submission text is kept on Discord rather than copied into Hugo's database. Users authorized to run /reveal—by default, users with Manage Server—can reveal the mapped author.
• Starboard mappings containing original and starboard message IDs and author IDs. Starboard content is copied to Discord, not to Hugo's database.
• Invite-code tracking data, pinned-message IDs and author IDs, reaction-role bindings, group names and membership/channel/permission data, and group notification history.
• Voice-generator settings and active temporary-channel metadata, including generator/spawned channel IDs, owner user IDs, and naming templates.
• Flair role names, colors, and icon URLs; role-DM rules; Twitch/YouTube subscriptions and last-notified IDs; and pending age-alert entries with user, inviter, account-creation, and join information.
• Patron/subscriber status, owner and server trial dates, permanent access overrides, and trial-use records. Hugo does not request or obtain payment-card details from Patreon for billing. If someone improperly puts payment-card data into submitted content, Hugo can process or store it like that content; do not submit it.

CAPTCHA Challenge Data

Hugo's CAPTCHA is generated locally; it does not use reCAPTCHA, hCaptcha, or another CAPTCHA provider. Stored challenge records can contain Discord message IDs, component/modal identifiers, labels, and the expected answer. There is no time-based expiry: Hugo keeps at most the latest 50 records per server and removes older records when a later challenge is stored. Submitted answers are compared in memory; when server logging is enabled, a failed answer, the expected answer, and the user's identity can be posted to that server's Discord log channel.

Dashboard Session Data

Signing in requests only Discord's identify and guilds OAuth scopes, not the email scope. The server-side session can contain:

• Discord OAuth access and refresh tokens, token expiry and login timestamps, OAuth state, and a CSRF token.
• A cached Discord user object, which can include ID, username, display/global name, avatar, and related profile fields returned by Discord.
• A cached list of your Discord servers and the ownership, icon, and permission information returned by Discord.

The user profile is reused without another Discord request for up to one minute and the server list for up to five minutes, but stale copies can remain in the session until overwritten or until the session is destroyed or expires. Separate server-memory caches hold fetched Discord channel, emoji, and role data for one-minute freshness periods, with at most 500 server entries per resource type and a cleanup sweep every five minutes. The browser receives a signed session identifier, not the raw OAuth tokens.

Operational and Security Data

Application console output can contain timestamps, feature names, server/channel/user IDs, usernames or server names, raw Error objects, stack traces, SDK/API diagnostic fields, and action results. Configured Discord error-log messages can contain feature context and the error's message. Either can include IDs, content, or URLs associated with the failed operation. Dashboard audit messages can identify the signed-in Discord user who changed a setting, and rejected dashboard access can log the user's ID and target server ID. The dashboard can also log Content Security Policy violation reports, which may include document, source, and blocked-resource URLs. The application does not define a fixed retention period for host console logs.

3. Messages, DMs, Media & Voice

• Regular messages: Hugo reads message content and metadata when needed for commands, XP, autoresponses, sticky messages, autothreads, reputation, starboard, AutoMod, honeypot, moderation, and logging. Full ordinary chat messages are not intentionally copied into Hugo's primary database. Discord.js's in-memory cache is limited to 200 messages per channel but has no time-based message sweeper in Hugo, so an inactive channel's cached messages can remain until count-based eviction or process restart. Separately, AutoMod can retain full and normalized message content in memory for up to 24 hours, capped at 50 messages per user per server, to evaluate repeated-message rules.
• Content you submit to a feature: reminders, custom responses, announcements, QOTD pitches, templates, moderation reasons, configuration text, and similar content are stored because the feature cannot work without them.
• Discord logs and reposts: if a server enables logging, Hugo can post message edits/deletions, message content, attachment copies, AutoMod previews and trigger details, CAPTCHA failures, member/role/channel/thread events, and moderation data to Discord. Starboard posts, confessions, suggestions, QOTD posts, and configured messages also live on Discord. Discord and the server's channel permissions and retention practices apply to those copies.
• Direct messages: Hugo can send configured role, reminder, moderation, or owner DMs. A DM received by the bot can enter Discord.js's in-memory message cache before Hugo ignores it, under the same count-based cache and restart behavior described above, but no Hugo feature intentionally copies received DM content into the database or a log channel.
• Voice: Hugo processes voice-channel join/leave and related state needed for voice XP, temporary channels, and logs. It does not listen to, record, transcribe, or store voice audio.
• Media: Hugo can download Discord-hosted attachments, emojis, stickers, avatars, or user-supplied images into memory so it can validate, convert, proxy, or re-upload them. Those temporary buffers are not intentionally retained after the operation, although resulting copies may remain on Discord.
• Other in-memory caches: Hugo hydrates Discord.js member caches and uses the library's user, member, channel, role, and related object caches without a Hugo-configured time sweeper or general count limit, so those non-message objects can remain until Discord invalidates them, Hugo clears a relevant cache, or the process restarts. Separate lookup helpers reuse fetched user/member/channel/role objects for up to five minutes, keep confirmed not-found results for 30 seconds, and clear an idle server's helper cache after ten minutes. Moderation audit-log results are reused for up to one minute and processed entry IDs for up to five minutes.

4. How Data Is Used

• Provide requested commands, dashboard controls, scheduled messages/actions, role automation, temporary voice channels, feeds, reminders, and other configured features.
• Calculate XP, levels, rankings, reputation, invite statistics, activity, awards, cooldowns, and feature eligibility.
• Verify members, enforce AutoKick/AutoMod/moderation rules, retain warning history, restore applicable roles/settings, and support server safety logs.
• Remember server configuration, avoid duplicate notifications/posts, associate anonymous submissions with authors for authorized moderation, and resume scheduled work after restarts.
• Authenticate dashboard users, confirm that they can manage a server, maintain session security, and prevent abuse.
• Determine premium access and prevent repeated trial use.
• Diagnose failures, protect the service, recover from data loss, and maintain reliability.

5. Sharing and External Services

Hugo does not sell personal data. Its application code does not include third-party advertising, behavioral analytics, tracking pixels, AI/LLM processing, or hosted error-monitoring services. Data is disclosed only as needed for the following:

• Discord: Hugo receives data from and sends commands, messages, embeds, attachments, roles, channel changes, moderation actions, and OAuth requests to Discord. Dashboard avatars and server icons may load directly from Discord's CDN, which receives ordinary web-request information such as your IP address and user agent.
• Server users and administrators: messages, DMs, reposts, moderation results, logs, and other configured outputs are disclosed to the Discord users who can access their destination. Server owners, administrators, moderators, or users authorized to run relevant commands can also receive member identifiers, configuration details, anonymous-submission author reveals, and other information needed for the feature.
• Hosting and network infrastructure: the machine, operating system, network, and any hosting provider or reverse proxy used for a deployment can process application files, the live database, local backups, session files, requests, IP addresses, and console output. Hugo's source code does not identify a deployment provider, physical location, or infrastructure-log retention period; those depend on the Operator's deployment.
• GitHub, only when remote database backup is configured: Hugo sends a compressed copy of the complete SQLite database to an operator-selected repository through the GitHub API. This includes the stored server and user data described above. GitHub processes that backup under its own terms and the repository/account access configuration.
• Twitch and YouTube: when a server configures feed notifications, Hugo sends the configured public streamer/channel identifier to the relevant service, processes public stream/video details needed to build the Discord alert, and stores the resolved channel details and latest notified stream/video ID. Twitch uses Hugo's application credentials rather than an end user's Twitch account; YouTube public pages and feeds are requested without end-user YouTube authentication.
• Bot listings: Hugo can send its bot/application ID and total server count to Top.gg, Discord Bots GG, and Discord Bot List. Its public command structure can also be uploaded to Discord Bot List. These payloads do not include per-user records or server configuration.
• Media and utility providers: the cat command requests an image from The Cat API. The dashboard can ask Tenor for a GIF selected by URL, and Hugo uses Discord media/CDN hosts for Discord assets.
• URLs supplied by users or administrators: if a feature is asked to fetch an image or other allowed remote resource, the destination host receives the URL request and ordinary server-side network metadata. Source URLs for configured server-specific bot avatars or banners can be stored for later re-fetching, while embed media URLs can be passed to Discord for fetching or proxying. Do not put secrets in a URL submitted to Hugo.
• Patreon, premium role checks, and other links: the public pages link to third-party sites. If you follow a link or purchase a subscription, that provider handles the visit or payment under its own policy. Hugo does not query Patreon for billing or payment-card data. To refresh premium status, it uses Discord to inspect whether the current server owner is a member of Hugo's configured supporter server with the qualifying role; a refresh can fetch and cache that Discord server's full member and role data. Hugo stores the resulting access/trial status. Payment-card data someone improperly includes in submitted content can still be handled like that content.
• Legal and safety needs: data may be preserved or disclosed when reasonably necessary to comply with law, protect users or the service, investigate abuse, or enforce applicable terms.

6. Dashboard Cookies and Technical Data

• The dashboard uses one necessary, signed session cookie (default name hugobot.sid). It is HTTP-only, SameSite=Lax, and Secure in production. The cookie has a rolling one-hour expiry; authenticated sessions also have an absolute seven-day limit from login.
• A successful logout destroys the current server-side session and clears its cookie. If session destruction fails, the logout endpoint returns an error and the session or cookie can remain until a later successful logout or expiry. Hugo does not use advertising cookies and does not store dashboard data in browser localStorage or IndexedDB.
• The dashboard temporarily uses client IP addresses as rate-limit keys for abuse prevention. API and login limiter entries use 15-minute windows; security-report and media-proxy limiter entries use one-minute windows. Hugo does not write IP addresses to its SQLite feature database and does not configure an application access log, although limiter cleanup timing, a hosting provider, or a reverse proxy can affect actual technical-log retention.
• Authenticated emoji-proxy and Tenor-proxy responses tell the browser to cache the returned media privately for up to one hour. This browser HTTP cache is separate from localStorage, IndexedDB, and the dashboard session cookie.
• Browsers can automatically send a Content Security Policy violation report to Hugo. The report is rate-limited and written to the application console for diagnosis.

7. Retention, Backups and Deletion

• Primary database: unless a specific limit applies, settings and user records remain until they are overwritten, reset, or explicitly deleted. A member leaving a server does not generally remove their XP, names/history, role snapshot, invites, reputation, activity, or birthday record. Most feature records are server-scoped; dashboard sessions and owner-level patron records are not.
• Removing Hugo: when Hugo leaves a server, it clears scheduled-task rows and several server-specific runtime caches. Persistent settings and member rows are not automatically deleted. Contact Hugo's owner to request deletion.
• Automatic limits: name history is limited to 20 entries; QOTD recent history to 20; and confession and suggestion mappings to 1,000 each per server. AutoMod keeps no more than 250 infraction records from the preceding 30 days when that user's next infraction triggers cleanup; a dormant user's older records can remain longer. Current CAPTCHA challenge storage is capped.
• Feature lifecycle: successfully completed, terminal, or cancelled scheduled tasks are removed; transient failures can remain for retry. Period award counters reset after a completed award run or an explicit reset; failed or retried runs can retain them. AutoKick progress can be retained while disabled so tracking can resume. Expired warnings are marked inactive rather than erased. Starboard tombstones are eligible for 30-day pruning when later starboard activity runs cleanup. Birthday opt-out disables announcements but does not erase the stored date. Other feature records remain until their feature removes them or they are reset/deleted.
• Dashboard sessions: authentication normally expires after one hour without rolling renewal and cannot remain valid beyond seven days from the original login. The file store's cleanup sweep normally runs hourly, so an expired session file can remain until a later sweep. Logout and invalid-authentication paths attempt to destroy the file, but a destruction failure can delay physical deletion.
• Local backups: Hugo attempts a full database backup at startup and then daily, keeping at most one nonempty dated backup for a given UTC day. Creation uses a temporary full-database file that Hugo attempts to rename or remove immediately; a later successful backup run also removes stale temporary files older than 24 hours. During a successful run, dated local backups older than seven days are removed. Temporary or dated files can remain longer while the service is offline or if backup or cleanup fails.
• Optional GitHub backups: when enabled, Hugo attempts to gzip-compress the full backup and commit it to an operator-selected GitHub repository. During a successful remote-backup run, it attempts to delete dated backup files older than the configured 1-to-3,650-day window, which defaults to 30 days. That pruning creates a deletion commit; failures, older Git objects, repository history, provider caches, or provider backups can retain data longer than the configured window.
• Discord and operational logs: deleting a live database row does not delete messages, attachments, or log embeds already sent to Discord. Console/infrastructure log retention depends on the deployment environment and is not fixed by Hugo's application code.
• Deletion scope and backups: whole-server deletion logically removes live settings, member rows, and scheduled tasks, but does not automatically remove server or owner-level premium trial/entitlement records, dashboard sessions, Discord-hosted messages, operational logs, or existing backups. Hugo does not explicitly enable SQLite secure deletion, so deleted bytes can remain in free database pages or write-ahead-log files until SQLite reuses, truncates, vacuums, or overwrites the relevant storage. Copies can remain until a later successful local-backup cleanup and, if remote backups are enabled, for longer in GitHub history or provider backups.

8. Security

Hugo's primary store is a local SQLite database. Dashboard OAuth sessions are kept in local session files. Security measures in the application include production HTTPS-only session cookies, HTTP-only/SameSite cookie settings, OAuth state and CSRF validation, session-ID regeneration, a seven-day absolute login limit, request and response size limits, input validation, permission checks, rate limits, timeouts, security headers, and restricted session-directory permissions where the operating system supports them.

The live SQLite database, dashboard session files, local backups, and optional gzip GitHub backups do not have application-level at-rest encryption in Hugo's code. Their confidentiality depends on host filesystem protections and, for remote backup, the operator's GitHub account, repository visibility, credentials, and access controls. No service can guarantee absolute security.

9. Your Choices and Requests

• Server administrators can disable features, reset many settings, remove configured entries, and control access to Discord log channels. Individual commands allow users to manage certain data such as reminders, leveling alerts, confessions, suggestions, and whether birthdays are announced. Some feature controls disable use without erasing the underlying record.
• Removing Hugo or leaving a server does not by itself erase persistent records. Blocking the bot also does not delete them.
• You may ask for access, correction, or deletion of applicable Hugo-held data by contacting Hugo's owner. Include your Discord user ID and, for server data, the server ID. Additional proof may be required to confirm identity or server authority.
• There is no automated full-data export endpoint or comprehensive self-service per-user deletion function. Requests are handled manually.
• For content already stored by Discord, including server log messages, contact the server's administrators or Discord as appropriate; Hugo's database deletion cannot remove every Discord-hosted copy.

10. Children

Hugo's Discord bot and dashboard are not intended for anyone who is not permitted to use Discord, is under 13, or is below a higher minimum age required by Discord or applicable law. If you believe Hugo has stored data relating to a child who should not be using the service, contact Hugo's owner so it can be reviewed and deleted where appropriate. See the Terms of Service for eligibility rules.

11. Changes to This Policy

This policy may be updated when Hugo's features, storage, integrations, or legal obligations change. Unless a revision states a later date, the effective date is the date displayed at the top. Continued use after that date is subject to the revised policy.

12. Contact

For privacy questions or requests, contact glefs on Discord or use Hugo's support server.