Skip to main content
WilBot
Start chatting
Plain-English data notice

Privacy Policy

Last updated 15 October 2026

The short version

WilBot is a website and Discord app. It processes chat prompts, server messages and feature data to answer requests and run features an administrator enables. If the operator enables web-chat analytics and configures its dedicated secret, WilBot measures activation and repeat use with limited, pseudonymous server-side records; it does not put analytics cookies on your device. Some information is stored; some requests are sent to external AI, search, identity, and media services. Do not send passwords, tokens, payment codes, precise home addresses, or highly sensitive information. This notice describes the current product; a provider’s own handling is governed by its terms and privacy notice too.

01

Who operates WilBot

WilBot is an independent service operated under the WilBot name by the WilBot team. It is not affiliated with or endorsed by Discord Inc. Privacy requests can be sent to [email protected]; service/legal questions can be sent to [email protected]. We do not publish an operator’s personal name or home address on this page. Discord, Google, Twitch, YouTube, and other linked services separately control information they collect on their platforms.

WilBot’s public contact details identify the service brand, not a verified incorporated entity or registered office. The operator’s legal identity and service address have not been independently verified for this notice. This is an unresolved legal-information item, not a claim that the brand name is a registered company.

02

Information the website processes

  • Web chats: prompts, replies, conversation titles, assistant/model choice, timestamps, response duration, and any image/file attachment you upload. Guests are associated with a random browser identity; the signed, HTTP-only wilbot_chat_guest cookie lasts 30 days. Signed-in chats are associated with your account. A conversation you delete is removed from the WilBot chat database by the current delete control; copies already sent to Discord or an AI/search provider are outside that deletion. Guest conversation data is not automatically erased when the 30-day browser cookie expires, so you may lose access to it and need to request deletion by email.
  • Accounts and sign-in: Discord sign-in returns your Discord user profile and the servers Discord authorises WilBot to display, including server identifiers, names, icons, and permissions. Google and other enabled identity providers may return a stable provider account identifier and basic profile details such as verified email, display name, or profile image. WilBot does not automatically merge accounts because email addresses match. If you are signed in, you may explicitly connect another enabled provider from Account settings; WilBot then associates those provider identifiers with one account and moves existing WilBot web-chat history and related web-chat records to that account. If you add a passkey, WilBot stores its public credential key, counter, transport metadata, label, and account association. Device biometrics and passkey-provider secrets are not sent to or stored by WilBot. Discord server permissions still come from Discord and are checked against the Discord identity. Access tokens are used to complete OAuth flows and are not stored as your account password.
  • Optional linked identity: when you choose streamer verification or refresh Discord connections, WilBot uses the selected Twitch, YouTube, or Discord connection data to verify that link and stores the resulting account/link record. The OAuth screen identifies the permissions requested. Do not connect an account unless you want that verification.
  • Images and media: image prompts, style, aspect ratio, selected model, generated image bytes, and basic generation metadata may be saved to the signed-in gallery. Uploaded images/files may be sent to the selected model or media provider for analysis or generation. Some Discord commands also generate or process images, audio, music, or video; availability and providers vary.
  • Shopping and search: a search request, including product terms and any area, budget, condition, or preferences you type, is sent to the search and AI route used for that request. WilBotShop may search public web indexes for retailer and publicly indexed Facebook Marketplace pages. It does not sign in to Facebook or see your private/personalised Marketplace feed. Opening the Facebook link sends you to Facebook, where Facebook applies your own location and account settings. Avoid putting a precise address in a prompt.
  • Usage and security: model/provider selection, quota and feature-use counts, request timing, error and abuse-prevention signals, session records, and technical request information needed to run and secure the service. For web-chat activation and repeat-use measurement, WilBot stores a pseudonymous actor key, guest/account category, event time, entry point, and assistant mode. The analytics records do not contain chat text, replies, raw account/Discord IDs, email addresses, IP addresses, or conversation IDs. Hosting and network providers may separately process connection metadata such as an IP address and user-agent in their operational logs. If you submit a gift card in Discord, the bot processes and stores its brand, amount/currency, code, notes, submission status, and the submitting account/server context, then sends the submission to authorised administrators for manual review and redemption.
03

Information the Discord bot processes

When WilBot is installed in a server, Discord delivers events for areas and features the bot can access. The current bot requests Discord’s privileged message-content intent. It may read message text, author/server/channel/message identifiers, mentions, attachments metadata, and replies to respond to mentions/DMs, translate messages, apply configured filters and anti-spam/AI moderation, operate quotes, and provide context or server features. It does not need to read every channel: Discord channel permissions and administrator configuration control what it can access. A server administrator should tell members what is enabled.

For server-channel context, the bot currently saves a shortened text snapshot of ordinary non-command messages, together with author/channel identifiers and timestamps, in its AI message archive; the code’s default cleanup cutoff is 62 days, configurable by the operator, and cleanup runs opportunistically, so this is not a guaranteed exact deletion deadline. A separate moderation-review sample store is cleaned after 72 hours. Recent room context is also held in working memory. Selected quotes, moderation cases/evidence, warnings, reports, tickets/transcripts, applications, invite and activity counts, levels/economy, reminders, server settings, and user/admin-configured AI memories or knowledge may be stored for their respective features. Their lifetimes vary; server owners can reset some features, and users can use the available memory controls or contact us for a data request.

Deleting a message in Discord does not necessarily erase a WilBot archive, moderation record, quote, ticket transcript, or an AI provider’s copy. A server administrator can disable features, remove WilBot, or use feature deletion/reset controls; an affected person can also write to the privacy contact. Removing the bot stops future bot events for that server but is not itself a complete historical-data deletion.

04

Why we use information

  • To provide the chat, account, AI, search, media, moderation, community, and server-administration functions you or a server administrator request.
  • To remember conversations, settings, user-requested memories, and server configuration; calculate usage and apply limits.
  • If web-chat analytics is enabled by the operator, to measure first successful web chat, daily active use, and seven-day return use with the limited pseudonymous records described above.
  • To prevent spam, abuse, fraud, and security incidents; investigate faults; maintain service availability; and enforce the Terms.
  • To validate paid entitlements and manually review the gift-card codes users choose to submit through Discord.
  • To respond to privacy, safety, legal, billing, and support requests and comply with legal obligations.

For UK users, the likely legal bases include providing a requested service or taking steps requested before a contract, legitimate interests in operating and securing the service, consent where a feature specifically relies on it, and legal obligation. Server owners decide whether to enable server features and their community rules; the data-protection roles of the operator and an administrator can depend on the feature and context. The operator should document that allocation for each feature.

05

AI, search, and other recipients

To answer a request, WilBot sends the necessary prompt, relevant conversation context, selected model, and any required attachment to the configured provider. The route can change by feature, model, availability, or operator configuration. Providers present in the current code include Google Gemini, OpenRouter (which can route to different underlying models), Groq, Cerebras, Mistral, OpenAI, Together AI, Fireworks AI, ElevenLabs, and image/media providers including Pollinations; only some routes are active for a given request. Search may use Bing, Google, Brave, DuckDuckGo, YouTube, Wikipedia, or another source appropriate to the feature. Discord, Google, Twitch, and YouTube receive data when you use their sign-in or verification flows. Hosting/database operators and authorised WilBot administrators may also handle service records.

WilBot does not train its own public foundation model on chat messages. This does not mean every external provider has identical retention or training terms: provider data-use policies vary, and some models may be served through a routing service. Do not send material you are not entitled to share. Check the provider’s current privacy/data-use terms before selecting a model for sensitive material. We do not control provider-side retention, regional routing, or processing after a request leaves WilBot.

Providers and infrastructure may process information outside your country, including in the United States. The exact route, destination, and transfer safeguards depend on the configured supplier and its contract. We cannot promise that every optional provider uses the same location or transfer mechanism. Ask [email protected] about the safeguards for a particular route.

06

Retention and deletion

  • Web chat messages and uploaded attachments remain associated with a conversation until you delete that conversation or we action a valid deletion request. The delete control now removes local message and attachment records. Conversations deleted before this update may have been soft-hidden rather than physically erased; contact us if you want us to remove those legacy records. Guest chat records are not automatically erased with the 30-day cookie. Provider copies, Discord messages, legal records, and backups may follow separate schedules.
  • If web-chat analytics is enabled, detailed events are eligible for deletion after 30 days. Chat submissions also remove expired events opportunistically; an operator can schedule the standalone analytics-cleanup command daily to remove them even when chat is inactive. That schedule must be configured by the operator and is not enabled automatically by a website release. A minimal pseudonymous activation record, containing the first-success time, guest/account category, entry point, and assistant mode, has no automatic expiry so WilBot can distinguish first-time use from return use. It is erased with the detailed events after an operator verifies and processes an account-deletion or privacy request. Deleting a conversation does not remove this separate record. The site currently has no self-service account-deletion control.
  • Generated web images and their prompts remain in the private gallery until a verified deletion request is completed; the gallery currently has no per-image delete control.
  • Discord AI message archive: default cutoff 62 days, configurable 7–120 days; cleanup is opportunistic rather than a precise deadline. Moderation review samples: 72 hours. Other server records remain while needed for the feature, until an administrator/user removes them or a request is completed. Some legal/security records may be kept longer where necessary.
  • OAuth state and verifier cookies: 10 minutes. Passkey challenge cookies and server-side challenges: up to 5 minutes and single-use. Passkey public credentials remain until removed or the associated account is erased. Signed account session: usable for up to 14 days; expired server-side session rows are not yet covered by a verified scheduled purge. Guest-chat identity cookie: 30 days. Browser preference storage lasts until you clear it.

To request access, correction, restriction, objection, portability, or erasure, email [email protected]. Tell us which WilBot feature/server is involved and enough information to locate the record; share Discord identifiers only privately if we need them to verify the request. We may need reasonable proof of identity and may explain a legal reason if we cannot comply fully. You can first ask the relevant server administrator to use server feature controls. If UK data-protection law applies, you may complain to the Information Commissioner’s Office.

07

Automated moderation and AI limitations

WilBot can classify messages, flag likely spam or policy violations, and—if the server administrator configures automatic action—delete messages or apply warnings, timeouts, or other Discord actions. AI classifications can be wrong and may reflect incomplete context. Ask the server’s moderators to review or appeal a server action; administrators remain responsible for their settings and human review. WilBot does not make a promise that a model will correctly understand context, intent, slang, reclaimed terms, or translation.

Chat, code, research, shopping, study, writing, translation, image/audio/video, and support responses can be inaccurate or incomplete. Do not rely on them as professional legal, medical, financial, safety, or emergency advice. Web and shopping snippets can be stale; verify facts, prices, stock, condition, distance, shipping, returns, and seller details with the original source.

08

Children, security, and changes

Use WilBot only if you meet Discord’s minimum age and the minimum age that applies in your location and for the selected provider. WilBot is not designed as a children’s service. Do not submit a child’s personal information unless you have authority and a lawful basis to do so.

We use safeguards such as OAuth state/PKCE checks, signed HTTP-only session cookies, access checks, input limits, and rate controls. No online service can guarantee absolute security. For a security concern, use the security page. We may update this notice as features or providers change; the date above is the latest published revision.