Permissions & Privacy

Which permissions does the bot need?

As few as possible. Which permissions are required depends on which modules you switch on:

Permission	What for	Who needs it
Nachrichten senden (send messages)	post replies and embeds	all modules
Links einbetten (embed links)	without this permission Discord does not display embeds at all	all modules
Anwendungsbefehle (application commands)	so that /embed and the rest appear in the first place	all modules
Nachrichten verwalten (manage messages)	edit posted embeds, clean up	Embeds, Moderation
Reaktionen hinzufügen (add reactions)	put the emojis under a role panel	Reaktionsrollen (reaction roles)
Rollen verwalten (manage roles)	grant roles and take them away	Reaktionsrollen, Eigene Befehle (custom commands), Automatisierungen (automations), Einladungen (invites), Geburtstage (birthdays)
Mitglieder moderieren (moderate members)	mute	Moderation
Mitglieder kicken / bannen (kick / ban members)	kick, ban, unban	Moderation
Server verwalten (manage server)	read the invite list	Einladungen
Alle erwähnen (mention everyone)	@everyone on a live notification	Stream-Benachrichtigungen (stream notifications)

You can take permissions away from the bot at any time. It then tells you in its reply what it is missing instead of failing silently — and /check lists all missing permissions at once.

Administrator is convenient, but not necessary. Better give the bot a role of its own with exactly the permissions above and drag it above the roles it is meant to manage in the role list. Discord never allows a bot to grant a role that sits above its own — that is by far the most common cause when something does not work.

What the bot listens in on

Discord calls these "intents". A bot only receives the events it is registered for:

Intent	What for	Particularity
Server	the basis for everything	—
Reactions	Reaktionsrollen, reaction triggers	—
Server members	joins, leaves, role changes	must be switched on in the Discord portal
Invites	counting invites	—

Message contents — where they are read and where they are not

Fishbot has access to message contents (the "Message Content Intent") switched on. That was not always the case, and it is a decision with a reason: a ticket transcript without the messages does not answer the one question it exists for.

Reading therefore happens where a module needs the text:

What for	What happens
Ticket transcript	On closing, the history of the ticket channel is stored — 90 days by default, adjustable down to 0
Starboard	The text of the highlighted message is part of the entry
Stichwort-Reaktionen (keyword reactions)	The bot recognises configured keywords and reacts to them
Abmeldekanal (sign-off channel, GTA RP)	A short excerpt of the sign-off is part of the report

And equally important, where it does not:

• The Logbuch (the server log) never stores message contents. It records that something happened, not what was written — not even when the bot would be allowed to see the text. Deleted messages are therefore not reported at all: a line saying "message deleted" without the content is worthless, and with the content it would be a recording.
• Nothing is collected permanently. Outside ticket channels, no message text ends up in the database. What the bot reads in order to react, it reads and forgets.

Which data is stored?

Always:

• Server: ID, name, icon, owner ID — so that the dashboard knows what it is dealing with.
• Settings: which modules are on, plus their configuration.
• Account: your Discord ID, username, profile picture and email address from the login.
• Record: who changed which module when, or who sent which embed.

Depending on the module switched on:

Module	What is stored
Embeds	the embeds you have created yourself
Reaktionsrollen	panels: message, emoji-to-role mapping, channel and message ID
Eigene Befehle	name, reply text, assigned roles, usage count
Automatisierungen	rules with trigger and actions
Moderation	cases: person affected, moderator, reason, time
Einladungen	who recruited whom, time of joining and leaving
Gewinnspiele (giveaways)	prize, duration, participant and winner IDs
Geburtstage	day and month per member — the year only if someone states it voluntarily
Angeln (fishing)	game progress: catches, coins, equipment, fish book
Streams	watched channel names and the ID of the most recently reported broadcast

Of members, the bot only ever stores the Discord ID, never names or profile pictures — Discord fetches those itself when displaying them.

Protection against abuse

So that nobody uses Fishbot for mass advertising, the service keeps count of a few events: how many direct messages an automation has sent, how many bans have happened in a short time, how often a server has hit the rate limit. What is stored is exclusively the type of event, the number and the time — never a message text and never who was affected. After fourteen days these counts no longer feed into the assessment.

In addition, a server's member count is stored. Only the number, no member list.

What is expressly not stored

No message contents, no voice data, no IP addresses of server members, no payment data. Payment processing runs entirely through Stripe — card details never reach our servers.

Deletion

If you remove the bot from the server, the settings are kept at first, so that nothing is lost when you invite it again. On request in the support Discord we delete all data on a server or on your account completely — likewise, on request, we hand over everything that is stored about you.

There is one exception: moderation cases are not deleted. They belong to the server that created them and document that server's own decisions — a warning cannot be removed from the world by a deletion request.

Individual entries can be removed by each member themselves: /geburtstag entfernen deletes your own birthday. For the server: /befehl loeschen removes a custom command, /rollen loeschen a role panel.