Privacy

DaisyFilter is designed to store as little as possible and to keep player content on your server.

What is stored by default

New installations store metadata plus exact evidence encrypted with AES-256-GCM. Exact evidence is permission-gated and expires after 30 days. Existing installations keep their existing raw-message-storage choice and receive a dashboard/status warning when exact evidence is unavailable.

What leaves the server

There is no telemetry and no external AI moderation. DaisyFilter never sends anything anywhere to make a filtering decision — the engine runs entirely on your server, and a default installation makes no outbound call carrying player data at all.

Four things can leave. You switch two of them on yourself; the other two are unavoidable.

	Sends	Default
plugin.yml libraries:	Nothing. Downloads the SQLite/MariaDB drivers and JDA from Maven Central at first boot.	Always
Licence validation	Your licence key, machine id, MAC address, OS and IP — to license.daisy.cat, on every start. No player data.	Always
discord.yml — bot	Incident metadata and the masked preview. The message itself only when show-full-message is turned on, or when a permitted role clicks Reveal.	Off
discord.yml — webhook	Incident metadata and the masked preview, never raw content. Used only when the bot cannot deliver.	Off

Licence validation

DaisyFilter is a paid plugin and checks its licence at every startup, against https://license.daisy.cat over HTTPS. This cannot be turned off, and it is the one outbound call a default installation makes that carries anything about you.

What is sent: the licence key, a hardware id derived from the machine, its MAC address, operating system and version, Java version, and the connecting IP. No player data of any kind — no names, no UUIDs, no messages, no moderation records. The filtering engine still never sends anything anywhere to make a decision.

Two consequences worth planning for:

• A server with no outbound internet access cannot run DaisyFilter. There is no cached or offline mode, deliberately, not even after a successful first start.
• If validation fails, DaisyFilter does not start — and the rest of your server does. Chat, commands, signs, books and anvils are then unfiltered. The console says so in those words. Check for it after any restart that follows a network change.

The Discord bot, and player content

The bot is the one feature that can export what a player typed, and it is off by default in two ways: the whole integration is disabled until you configure it, and even then show-full-message starts off. An alert carries the masked preview, and the message itself only reaches Discord when a role holding daisyfilter.view.raw clicks Reveal — which returns it privately to that one person.

Turning show-full-message on puts the message into the alert for the whole channel. Understand what you are choosing:

• The access control becomes your Discord channel’s permissions, not daisyfilter.view.raw. Anyone who can read the channel can read flagged messages — including Discord staff bots and anyone added to the channel later.
• Discord history has no expiry. DaisyFilter purges its own records after 30 days (see Retention); alerts already posted stay until someone deletes them.
• Content sits on Discord’s servers, under Discord’s terms, in whatever jurisdiction they operate. If your players are children, or you operate somewhere with data-protection obligations, that is a decision to take deliberately — the flagged messages are exactly the sensitive material those rules exist for.

Leaving show-full-message off keeps player content on your server while staff are still told an incident happened and can still act on it.

Point the bot at a channel only senior staff can read. Setup and the permission model are in discord.md.

Exact evidence (encrypted)

When exact evidence storage is enabled:

• content is encrypted with AES-256-GCM using a key generated into plugins/DaisyFilter/secrets/, outside the normal config files;
• the record ID and surface are bound as authenticated data, so a ciphertext cannot be moved between records and tampering fails decryption rather than returning corrupt text;
• if the key is missing or invalid, DaisyFilter refuses to store raw content rather than writing plaintext;
• decryption happens only on explicit, permission-gated requests (daisyfilter.view.raw), shown to the requesting staff member only.

Keyed hashes and exceptions

Every record stores an HMAC-SHA-256 hash of the strict normalized text. This supports privacy-safe correlation without making the normalized message recoverable. The GUI’s allowlist action stores only matched spans, never the surrounding message, and therefore requires exact evidence to have been retained for that incident.

Retention

Records are purged after the configured retention period (default 30 days). See database.md.

Keep the secrets folder safe

Never commit or share plugins/DaisyFilter/secrets/. Losing the key makes previously encrypted raw content unrecoverable; leaking it defeats the encryption.