Privacy

DaisyFilter is designed to store as little as possible and to keep player content on your server.

What is stored by default

New installations store metadata plus exact evidence encrypted with AES-256-GCM. Exact evidence is permission-gated and expires after 30 days. Existing installations keep their existing raw-message-storage choice and receive a dashboard/status warning when exact evidence is unavailable.

No data leaves the server

In v1 DaisyFilter performs no network calls. There is no external AI moderation, no webhooks, and no telemetry. Nothing player-generated leaves your server.

Exact evidence (encrypted)

When exact evidence storage is enabled:

• content is encrypted with AES-256-GCM using a key generated into plugins/DaisyFilter/secrets/, outside the normal config files;
• the record ID and surface are bound as authenticated data, so a ciphertext cannot be moved between records and tampering fails decryption rather than returning corrupt text;
• if the key is missing or invalid, DaisyFilter refuses to store raw content rather than writing plaintext;
• decryption happens only on explicit, permission-gated requests (daisyfilter.view.raw), shown to the requesting staff member only.

Keyed hashes and exceptions

Every record stores an HMAC-SHA-256 hash of the strict normalized text. This supports privacy-safe correlation without making the normalized message recoverable. The GUI’s allowlist action stores only matched spans, never the surrounding message, and therefore requires exact evidence to have been retained for that incident.

Retention

Records are purged after the configured retention period (default 30 days). See database.md.

Keep the secrets folder safe

Never commit or share plugins/DaisyFilter/secrets/. Losing the key makes previously encrypted raw content unrecoverable; leaking it defeats the encryption.