1. Scope and transparency
This Privacy Policy explains the processing of personal data in connection with the privately operated StormWeatherEU Discord Bot and this separate, static legal-information website hosted on Netlify. It does not govern the independent main website stormweathereu.com. Discord and the external providers identified below have their own privacy notices that may also apply.
Personal data means information relating to an identified or identifiable natural person. Depending on the functions used, this can include Discord user identifiers, usernames, messages, role and channel identifiers, timestamps, moderation events and support correspondence.
The explanations describe the planned configuration and the arrangements communicated by the operator. They must be reconciled with the actual bot settings and provider agreements; a feature should not be presented as active unless it has been implemented and tested.
2. Controller and contact details
The natural person identified in the Legal Notice is the contact for processing activities determined by the operator of this bot. Questions, access requests, deletion requests and complaints can be submitted to kontakt@stormweathereu.com.
Discord, GalaxyBot, Netlify and other providers may act as independent controllers or processors for particular activities. Their actual legal roles depend on the service arrangements and the data concerned; using an outside service does not automatically make every provider a processor acting solely on the operator's instructions.
3. Categories of data
Not every category of data is processed for every user. Depending on the command or server feature, relevant categories include:
- Discord identifiers: user ID, guild/server ID, channel ID, message ID, username, display name and assigned roles.
- Command data: slash-command name, submitted parameters, the time of the request and the minimum information required to return a response.
- Server events: membership changes, permission and role changes, channel changes, actions such as bans or timeouts, and configured audit events.
- AutoMod data: the category of rule violation, associated account, warning count and action taken.
- Tickets: support messages, timestamps, attachments and ticket transcripts, when these functions are used.
- Technical data: request metadata and server logs processed by hosting or API providers.
Data minimisation remains the objective: functions should only access and retain what they genuinely require.
4. Discord as the technical platform
The bot uses the Discord API and Gateway to respond to slash commands and, where enabled, server events. Discord provides information in accordance with the permissions and Gateway Intents granted to the bot. Privileged permissions should only be enabled for functions that actually need them.
Ordinary weather queries do not require users to provide their home address, phone number or Discord password. Discord IDs and other server metadata may nevertheless be used to match responses to requests, check authorisation and perform moderation.
Discord independently processes personal data on its own platform. See Discord's Privacy Policy.
5. Slash commands, weather replies and server functions
For commands such as /wetter, /vorhersage and /warnstatus, the bot handles the location entered by the user and may determine the coordinates or administrative warning region required to respond. This information is used to fulfil the weather request.
Commands about servers, roles, channels, or bot status may process relevant Discord metadata. Depending on channel permissions and the chosen response visibility, the command and reply can be visible to other server members. Users should avoid entering unnecessary personal information as a location or command argument.
Bot messages are not a substitute for official safety instructions and may not reflect events immediately.
6. Weather providers: Open-Meteo, DWD and Bright Sky
Requested weather data may come from Open-Meteo; official German weather warning information may originate from the German Weather Service (DWD), potentially accessed through Bright Sky.
Depending on the request, a city name, geographical coordinates and technical API parameters are transmitted. The bot is not designed to send Discord passwords or complete ticket transcripts to weather APIs. The providers may nevertheless observe requests and the IP address of the bot-hosting server.
Open-Meteo states a retention period of 90 days for webserver logs for its free non-commercial API; this is a provider retention practice, not a retention period for Discord server logs. Refer to the provider's terms for the current version.
7. Message inspection by AutoMod
If AutoMod is enabled on a Discord server, the bot may automatically inspect message content in the configured channels for spam indicators, repeated messages, mass mentions, prohibited invitations or links, specified words, excessive capitalisation and similar patterns.
Message content must be technically accessible for these checks. Temporary inspection is different from permanently storing the whole message. According to the described version of the bot, its own AutoMod event logs are intended to contain the rule category and related identifiers rather than the complete message body. This should be verified in the actual installed version.
Administrators should restrict privileged Message Content access to genuinely necessary use cases and configure exemptions with care.
8. Automated measures, warnings and timeouts
Depending on enabled settings, AutoMod can remove a message, record a warning or apply a temporary timeout after repeated violations. These measures can restrict the visibility of a message or a member's ability to participate temporarily.
For accountability, the bot may process user IDs, the relevant rule, a warning counter, event times and actions. This information may be stored in the bot configuration on its host or posted to designated log channels.
Automated actions may produce false positives. The operator should maintain proportional settings, enable meaningful human review and avoid automatically treating every flagged message as proof of wrongdoing.
9. Human review and appeals
Members who believe an AutoMod warning or timeout is unjustified may appeal through a support ticket operated by GalaxyBot. The approximate time, channel and type of moderation action can help identify the event. Sensitive information unrelated to the appeal should not be submitted.
Under the operator's stated internal procedure, only the owner and administrators make final decisions on AutoMod appeals. Moderators can help process or forward cases but should not make the final decision. This is an internal division of responsibilities, not a waiver of users' legal rights.
10. Server logs and documented events
The StormWeatherEU Discord Bot may record configured security and administrative events in designated Discord channels. Examples include joins and departures, message deletion or editing, role and channel changes, bans, kicks, timeouts, voice-channel changes and Discord audit-log entries.
A typical log entry records the event type, timestamp and relevant Discord identifiers; depending on available data, it may also show the acting user and a stated reason. For some events it is technically impossible to determine a responsible account reliably.
Server logs serve traceability and security purposes. They should not be treated as an unrestricted archive of members' communications.
11. Access to standard and elevated logs
The intended audience for standard server logs, ticket logs and AutoMod warnings is the owner, administrators and authorised moderators. Elevated logs, specifically changes to administrator or moderator permissions and bot configuration, are reserved to the owner and administrators.
According to the operator's information, access to the separate GalaxyBot dashboard is limited to the owner. This is distinct from the private ticket log channel on Discord, where authorised administrators and moderators may view copies.
These rules only protect data if matching channel permissions, team permissions and bot configuration are actually implemented. The operator should review them regularly and prevent public access to confidential logging channels.
12. Support tickets provided by GalaxyBot
Support cases and appeals are handled with the separate third-party service GalaxyBot, rather than the self-developed weather and moderation bot. When transcript functionality is enabled, GalaxyBot can process messages, attachments, Discord user IDs and timestamps. The provider describes encrypted storage in its Privacy Policy.
A GalaxyBot team dashboard is not required for the existing ticket system. The operator previously stated that no team roles were configured for this project. Access permissions for any dashboard account or Discord log channel must be considered separately.
According to the operator, full ticket transcripts are sent to a private Discord log channel and are not deliberately copied to the independent StormWeatherEU bot's Infynix server. That statement does not rule out GalaxyBot's own storage of tickets and associated metadata.
13. Ticket transcripts, deletion and the 30-day objective
Operator's own Discord copies: The stated organisational goal is to delete complete ticket transcripts posted in the private Discord log channel manually no later than 30 days after closure, unless there is a concrete, lawful reason to keep a particular case longer. Automatic deletion has not been implemented or verified.
GalaxyBot copies: GalaxyBot's published privacy information links deletion of transcripts to deletion of the corresponding ticket record. Closing a Discord ticket channel or deleting a posted Discord copy must not be described as guaranteed removal of every record held by GalaxyBot. A reliable deletion procedure for the actual account and any backups remains to be confirmed.
Attachments: GalaxyBot publishes a 30-day rule for stored attachments without Plus, whereas different storage practices may apply to Plus. This must not be confused with an automatic 30-day deletion of every text transcript.
If a person requests deletion, the operator should check both the Discord copy and the records that can be controlled at GalaxyBot; where necessary, the provider should be contacted. An outcome should not be promised before the relevant deletion has actually been verified.
14. Periodic review of other records
Server logs: The operator intends to review retained log entries at least once every 30 days and manually remove those no longer needed. There is no blanket automatic 30-day deletion setting.
AutoMod warnings: Authorised moderators may remove warning records manually. Their continued necessity should also be reviewed at least once every 30 days. No individual automatic deletion date has been configured for each warning.
Records should not be retained indefinitely simply because deletion is manual. Cases subject to an actual dispute or a legitimate obligation may require a separately justified retention decision.
15. Hosting of the Python bot by Infynix
The operator hosts the separately developed StormWeatherEU Discord Bot at Infynix. The host can technically process hosting-related log data, configuration files and, depending on activated features, records of Discord events and AutoMod warnings.
The bot token is a confidential credential. It should not appear in public log channels, screenshots or support requests. Technical access to hosting systems should be restricted, and available security controls should be enabled.
Infynix describes a German server location and publishes legal information. The applicable technical log and backup retention periods, access arrangements and potential international transfers have not been conclusively verified for this individual hosting account. No guarantee of exclusively German processing is made.
16. Netlify legal website and access logs
This separate legal-information website is a static HTML/CSS website hosted by Netlify. When serving a page, Netlify may process technical request information such as IP address, date and time, request path, browser or device information and security-relevant connection metadata.
The operator has indicated that optional Netlify Analytics has not been enabled. This does not mean that the provider processes no technical request logs. See Netlify's Privacy Policy.
The legal-information website is not the main StormWeatherEU website, and this notice does not attempt to cover any additional tracking or functionality on that separate main site.
17. Cookies, local storage and embedded content
The supplied legal website consists of static pages with no dedicated analytics scripts, advertising trackers or contact form. The language selection is implemented as ordinary links to static German and English pages; it does not require a language-preference cookie.
Hosting providers and external websites opened through links may employ their own technical measures. If third-party embeds, analytics, consent tools or other functionality are added later, the privacy information and any applicable consent requirements must be reviewed before activation.
18. Email enquiries
Visitors may contact the operator using the email address in the Legal Notice. In that case, the content of the message, the sender's address and any voluntarily supplied information are processed to address the enquiry or a legal request.
Users should avoid sending identity documents, passwords or unrelated sensitive information through ordinary email. Correspondence is kept only as long as necessary for the purpose and any applicable legal obligations, then deleted. Exact retention may differ for a concrete legal dispute.
19. Purposes and potential legal bases
Processing may be necessary for handling requested bot commands, operating support tickets, protecting users and the server against misuse, reviewing moderation actions, and meeting legitimate record-keeping or statutory obligations.
Depending on the circumstances, relevant GDPR grounds may include Article 6(1)(b) (where a contract applies), Article 6(1)(f) (legitimate interests), Article 6(1)(c) (legal obligations) or Article 6(1)(a) (consent, where genuinely requested). The exact legal basis should be allocated to each real processing activity rather than assumed to be identical for every function.
Where legitimate interests are relied upon, the need for the data and the interests and rights of affected users must be assessed.
20. Recipients and external service providers
Depending on the requested features, data can be processed by Discord, GalaxyBot, Infynix, Netlify, Open-Meteo, the DWD and Bright Sky. These providers perform different functions: communications, ticket handling, bot hosting, static-site delivery, weather forecasts and warning data access.
The fact that a provider is listed does not mean every member's ticket contents are sent to every provider. In particular, full GalaxyBot ticket transcripts are not intentionally uploaded to Infynix for this separate bot, according to the operator.
Current provider notices and relevant contractual conditions should be consulted. Access by authorised server staff is also limited according to their roles.
21. International data transfers
Use of Discord and Netlify may involve processing outside the European Economic Area, including the United States. Providers describe mechanisms such as adequacy decisions, the EU-US Data Privacy Framework where applicable, and Standard Contractual Clauses. The applicable mechanism depends on the provider and data flow.
Use of a German hosting location does not automatically rule out support access, backups or processing elsewhere. Any relevant requirements of Chapter V GDPR must be assessed based on current contractual and factual information.
See the linked official provider privacy statements for further details. This notice does not provide an unverified assurance that all data stay within Germany.
22. Retention periods: current verified position
Retention varies depending on the data category and on which organisation holds it. An external provider's stated retention period is not the same as the operator's own policy.
| Category | Rule / current status |
|---|---|
| Ordinary and elevated Discord server logs | Manual necessity review at least every 30 days; unnecessary entries are removed. No automatic blanket 30-day purge. |
| AutoMod warnings | Removed by authorised staff manually; necessity reviewed at least every 30 days. |
| Own ticket-transcript copies in Discord | Target of manual deletion within 30 days after closure, unless a concrete lawful longer-retention reason exists. |
| Transcript records at GalaxyBot | Provider links deletion to deletion of the related ticket record; complete deletion in the particular setup is not yet confirmed. |
| GalaxyBot stored ticket attachments | Provider describes 30 days without Plus; different rules may apply with Plus. |
| Open-Meteo free API technical webserver logs | Provider states 90 days; these are not the operator's Discord server logs. |
| Netlify / Infynix logs and backups | No single verified retention period for the operator's actual hosting configuration. |
| Email contact | Only for as long as required to handle the matter and any legitimate legal follow-up. |
References: GalaxyBot, Open-Meteo.
23. Data security and confidentiality
Access to private log channels and ticket data is intended to be role-based. Configuration and administrative access should be limited to authorised persons; credentials must remain confidential. Suitable technical protections, updated dependencies and careful permission management support these objectives.
No online service can guarantee absolute security. A suspected disclosure or misconfiguration should be assessed promptly, and legal notification requirements must be considered if a personal-data breach occurs.
24. Required data and sensitive information
Basic Discord identification and command metadata may be technically necessary to use bot commands. Providing additional personal information in tickets is generally voluntary, although certain details may be needed to investigate an individual request.
Members should avoid submitting special-category personal data, identity documents, passwords and third-party private information unless there is a specific lawful need and suitable protection. The service is not designed to collect sensitive information for routine weather commands.
25. Access, rectification, erasure and restriction
Subject to applicable law, data subjects may request access to personal data, rectification of inaccurate data, erasure, and restriction of processing under Articles 15–18 GDPR. Requests can be sent to the email address in the Legal Notice.
The operator may need enough information to verify that the requester is entitled to the relevant Discord records, but should not ask for unnecessary identity documents. Rights relating to data independently held by Discord or GalaxyBot may also require contact with the respective provider.
Not every request requires immediate deletion if overriding lawful grounds for retaining specific data apply. The response must explain the relevant position appropriately.
26. Objection, data portability and consent
Where processing is based on legitimate interests, affected users may have a right to object under Article 21 GDPR. Where legally applicable, Article 20 GDPR provides a right to data portability. Consent, where used as a legal basis, may generally be withdrawn for the future.
The precise applicability of these rights depends on the type of processing. A moderation appeal is different from a request to exercise statutory data-protection rights, though both may be submitted to the operator through the appropriate contact channel.
27. Complaints to a data protection authority
Data subjects may lodge a complaint with a competent supervisory authority if they believe personal data are being processed unlawfully. For a controller established in North Rhine-Westphalia, the State Commissioner for Data Protection and Freedom of Information NRW (LDI NRW) is a relevant authority.
Contacting the operator first is welcome, but it does not eliminate a person's right to contact a supervisory authority.
28. Official information from providers
- Discord – Privacy Policy
- Netlify – Privacy Policy
- GalaxyBot – Privacy Policy
- GalaxyBot – Cases documentation
- Infynix – Legal information
- Open-Meteo – Terms and privacy
- Bright Sky – Weather API
- DWD – German Weather Service
These external pages are managed independently by the relevant providers and may change over time.
29. Review status and remaining checks
The operator's statements about access controls, log content and manual 30-day reviews should be checked against the actual Discord channel permissions, GalaxyBot configuration and deployed Python code.
The main outstanding checks concern a reliably documented procedure for deleting closed GalaxyBot cases (including any provider-side copies or backups), and the retention and potential transfer arrangements for technical logs and backups at Infynix and other hosts. Provider statements cannot be replaced with assumptions.
Until those points are confirmed, this policy deliberately avoids guaranteeing automatic deletion of all transcripts or that all personal data are processed exclusively in Germany. A qualified legal review is recommended before relying on the text as a final compliance assessment.
30. Changes to this Privacy Policy
This Privacy Policy will need updating if new bot commands collect additional information, new providers are integrated, logging or access controls change, or updated information about retention and deletion becomes available.
Draft status: 30 October 2026. The published wording should reflect the actual technical and organisational arrangements, and material changes require a new review.