Privacy Policy

Last updated: 8 October 2026

1. About this policy

This policy explains how the Snibbi administration handles information through this community website and Bamu, our Discord bot. It covers visitors, signed-in users, form respondents and people whose activity is processed in the Discord server. For questions or requests, contact the owner, Discord username lilsnibbi, as explained below.

2. What we collect and why

• Discord identity and access. Website sign-in requests Discord's identify and email permissions. We receive your Discord user ID, username, display name and email address, where supplied. The bot retrieves profile images, server membership, roles and related Discord information to display profiles, check access and operate community features. Account records link website and bot activity to your Discord ID.
• Content and participation. We store suggestions, comments, poll questions and votes, attachments, authorship, timestamps and supported edit histories. Votes are linked to Discord IDs to count choices, prevent duplicate voting and let you manage your participation. An "anonymous" poll does not make its database records anonymous.
• Forms and applications. We store the answers you submit, the form version, your account identity or a guest browser identifier, submission timestamps, status, reviewer decisions and notes, and notification delivery records. These support reviewing applications and showing their history. Information requested varies by form. Guest submissions use a cookie whose identifier is stored as a hash with the submission; submitting as a guest does not make the answers themselves anonymous.
• Notification preferences and delivery. We store your Discord ID and notification choices, relevant comment or poll-result snapshots, intended recipients, and delivery attempts, outcomes and message references. This lets Bamu send community updates, respect opt-outs and avoid duplicate notifications, including after downtime.
• Support and moderation. Reports, appeals and tickets can include your description, relevant messages, evidence and uploaded files, the people involved, staff decisions and reasons. Ticket records can include both conversation transcripts and staff discussion transcripts. We use these to respond to requests, review decisions, enforce rules and protect the community.
• Community activity. Depending on the feature, Bamu processes messages and interactions, member joins and departures, invite attribution, AFK messages and return times, minigame scores, advertising activity, starboard posts, presence and voice-channel membership. These power the corresponding server features, statistics and moderation. Voice-channel membership is information about who is in a channel; it is distinct from audio attachments processed by AI features.
• Technical information. Requests include network information such as IP addresses. We use an account ID or IP address for rate limiting, and record operational information such as request paths, error codes, timestamps and bot command context to diagnose problems and prevent abuse. Hosting and delivery services also process requests needed to serve the site and its media.

3. Bamu's AI features

Bamu uses a configured AI service to generate responses, with OpenAI as the default. Administrators may instead select a compatible service or a self-hosted endpoint, which receives the same context described below. In configured server channels it can participate without being directly addressed; authorised direct requests can also trigger it. A response may use recent channel messages and replies from other participants, not just the message addressing Bamu. The AI conversation feature does not accept direct-message conversations.

Information sent to the configured AI service can include message text, Discord IDs and names, message and channel details, role information, stored profile notes, supported image and audio attachments, sampled video images and speech transcripts and results from tools used to answer a request. Tools can retrieve relevant community or connected-service information and perform actions within the requesting member's permissions.

Bamu can save facts or summaries about a member from direct interactions as persistent profile notes for later conversations. Global behavioural guidance is stored separately. Existing stored AI chat records may also remain in our database. AI responses are posted back to Discord and may mention information in their context, so avoid including information you do not want used in a server conversation.

Bamu requests that generated responses are not stored by the AI service and keeps AI continuation context in memory only while answering a turn. When OpenAI is the configured service, it does not use API inputs and outputs for training by default, but may retain abuse-monitoring logs, normally for up to 30 days, subject to its account terms and applicable exceptions; see OpenAI's data controls. Other configured services apply their own data-handling and retention terms. These controls do not delete Discord messages or our stored profile notes.

4. Connected services and other recipients

• Discord provides sign-in, server membership and community messaging. Bot replies, moderation notices, notifications, reports and configured staff webhooks are sent through Discord. Diagnostic reports can include the affected user, command, channel and error context.
• Stripe handles supporter checkout and billing management. We send your Discord ID and email address to associate a customer and subscription with your account. Payment details entered in Stripe's checkout are handled by Stripe. We store customer and subscription references, subscription status, relevant dates, cancellation and payment-failure information to manage billing and supporter roles.
• Last.fm, if you connect it, supplies a username and session key that we store with the connection date. We retrieve profile and listening information for music features. Authorised bot requests can also update your Last.fm account, for example by scrobbling, loving tracks or changing tags. Music information returned to a server conversation is visible there. Disconnecting Last.fm removes the stored connection fields from our account record.
• The configured AI service, OpenAI by default, receives the AI context and supported media described above when Bamu uses AI features.
• Upload, hosting and storage services process the files, requests, database records, caches and operational logs needed to run the service. Uploaded files are stored using our configured Zipline service; Discord also hosts attachments used in server features. Files can retain their original filenames, so check both the file and its name before sharing it.
• Authorised staff and administration tools access records according to their roles and permissions. Form notifications can send applicant identity and, when detailed notifications are enabled, submitted answers to a configured Discord staff channel. If the owner uses a connected administration assistant, records returned through those tools are also provided to that assistant's service.

These services operate under their own terms and privacy practices. Processing may take place outside Australia; this policy does not promise that all storage or processing stays in Australia. External links, embedded media and images may also cause your browser to contact another service.

5. What other people can see

Public pages include published articles, events, staff information, polls and aggregate poll results. Public community displays can include Discord names, avatars, activities and voice-channel participation. Public content can be viewed without signing in and may be copied or indexed by others.

Suggestions and their comments are shown to members with access, together with author names and avatars. Member-only posts and server messages are visible to the people with access to those areas. Starboard and similar bot features can repost messages within the server. Do not treat a post or attachment as a private message to the administration.

Applications, appeals, moderation records and ticket transcripts have more limited access through the service, such as the submitting user, ticket participants or authorised staff as appropriate. Staff-only material is not included in every user-facing view. A page's access controls do not necessarily protect the direct URL of an uploaded file; someone with that URL may be able to retrieve it.

6. Notifications

Bamu sends service messages through Discord, including support and moderation messages and configured application decision DMs. Application decision messages can include the outcome, a reviewer note and a link to the submission; delivery depends on the form's settings and Discord allowing the DM.

The following community DMs are enabled by default, with separate preferences checked before sending:

• Suggestion comments: a new comment can notify the suggestion's author and previous commenters, excluding the person posting that comment. The DM can include the comment and a link to the suggestion.
• Poll results: when a poll first changes from open to closed, its author and voters can receive aggregate results and a link to the poll, excluding the person closing it. Reopening and closing the same poll again does not send another result notification. Result DMs do not identify individual voters or their choices.

Use /notifications in Snibbi to view or change either preference, or the turn-off button in a community DM to disable that category. Discord privacy settings or blocked DMs may prevent delivery, and queued notifications may arrive after downtime. Turning off a category does not delete the underlying content or votes, or turn off separate moderation, support or application decision messages.

7. Cookies and browser storage

The website uses an encrypted, HTTP-only session cookie for sign-in, short-lived cookies for Discord and Last.fm authorisation, and a guest cookie to recognise guest form submissions. The sign-in session expires after seven days. Signing out clears the session; clearing a guest cookie can prevent the browser from accessing its previous guest submissions.

Browser storage is also used for appearance preferences, saved form drafts, upload-deletion receipts and recovery of staff content drafts. Clearing site data removes locally stored copies, not records already submitted to our systems. On a shared device, sign out and consider clearing local drafts and site data when finished. Blocking required cookies can prevent sign-in and guest-submission features from working.

8. Retention and deletion

Leaving the Discord server does not automatically delete or anonymise your data. The bot records a departure date and retains account and community history. Leaving can archive open tickets while preserving their transcripts. Signing out, disconnecting Last.fm or cancelling a subscription also does not erase unrelated records or copies already sent to another service.

There is no single automatic expiry period for all stored records. Content, votes, applications, notification preferences and delivery history, moderation and support history, AI notes and other records can remain until an applicable deletion process or authorised action removes them. Available deletion controls have different scopes: removing a ticket channel, for example, can preserve a staff transcript, and removing a file reference may require separate file cleanup. Discord, Stripe, Google and other services may retain their own records under their policies.

Contact lilsnibbi to request deletion or clarification about a particular record. Identify the account and information concerned without sending passwords or access tokens. We may need to verify account ownership and consider records needed for unresolved support, moderation, billing, other people's rights or applicable legal obligations. This policy does not promise immediate or complete erasure from every service or from copies other people have made.

9. Security and your choices

The service uses encrypted session cookies, permission checks, request validation, protections against forged browser requests and rate limits. These controls reduce risk; they do not guarantee that storage, transmission or every third-party service is secure.

• Access your data: sign in and use Download My Data on your profile. It exports the account-linked records supported by that feature, including community activity and application history. It is not an export of every Discord message or third-party record and excludes credentials and some restricted information. Contact us about information missing from it.
• Manage integrations: disconnect Last.fm from your profile, manage supporter billing through the site's Stripe billing link, or revoke the website's authorisation in Discord. Those actions have different effects and do not act as a general deletion request.
• Manage participation: use the editing, deletion and notification controls provided for the relevant feature. You can choose not to sign in, submit optional content, connect Last.fm or use AI features. Other members' requests can still include recent shared-channel messages as AI context; contact staff if you need help identifying where AI is enabled.
• Request correction or raise a concern: contact Discord username lilsnibbi by direct message, or use a support ticket in Snibbi if you cannot reach the owner that way. Explain the information or privacy concern and the outcome you are seeking. The same contact handles access, deletion and privacy complaints.

10. Changes to this policy

We update this page as the site's and bot's data practices change and revise the date above. Check this page for the current policy.