Privacy.

Karvo stores only the data needed to provide the Discord features a server chooses to use and to operate the web Control Centre.

Data Karvo may store

Depending on enabled features, this can include Discord server and user IDs, server configuration, moderation cases, staff notes and member history, role-management state, ticket records and transcripts, form/application submissions, poll and giveaway records, leveling/reputation data, automation definitions and execution history, saved embed templates and send history, recent message content/attachment metadata when persistent logging history is enabled, server-local birthday day/month values, and aggregate usage counters. Karvo also stores runtime health data such as bot version, gateway ping and last heartbeat.

Dashboard sessions

The Control Centre uses Discord OAuth to identify you and determine which servers you can manage. The Discord access and refresh tokens are kept only in the server-side session used for that login so Karvo can renew the session and periodically re-check which servers you are still allowed to manage. Dashboard cookies are HTTP-only and, on HTTPS deployments, Secure. Authenticated sessions expire after inactivity and logout attempts to revoke the active Discord access token.

Purpose and access

Server data is used to provide Karvo features, maintain configuration, support staff workflows, generate requested transcripts/exports and operate the service. Access to guild configuration is limited to Discord users with appropriate server-management permissions. Private staff data such as notes and moderation records is not exposed through public profile pages. Birthday registration is scoped to the individual Discord server. Karvo stores only day/month for the birthday feature and does not use it to derive or publish age, create a network-wide birthday list, or send birthday-wish DMs.

Retention and deletion

Server owners and authorised staff can remove many records directly through Karvo's controls. If a server stops using Karvo, its owner can request removal of remaining stored server data through Karvo's support channel. Persistent logging message context is retained only for the configured guild retention period (7 days by default, configurable from 1 to 30 days) and is pruned automatically; a cached entry is also removed after its message deletion is logged. Some other short-lived operational logs or backups may persist temporarily for reliability and abuse prevention.

Sharing

Karvo does not sell user data. Data may be processed by the infrastructure providers required to host the bot, website and database, or disclosed when required by law or necessary to protect the service and its users.

Last updated: 1 October 2026.