01. Introduction

SHADO5 is a free Discord security bot and web dashboard, independently operated by a private developer in Germany. This policy explains what information SHADO5 uses to run the website, manage servers and deliver the features administrators enable.

Information comes from Discord, dashboard users, server administrators and configured integrations. Discord and individual servers also have their own privacy practices.

02. Operator & contact

SHADO5 is run by a private individual in Germany, not presented as a registered company. Server administrators choose which features to enable, how they are configured and who can read their server's logs. Those choices do not remove the SHADO5 operator's own data-protection responsibilities.

For general product questions, visit the support server. Public support channels are not a confidential privacy-request channel.

03. Information we process

• Discord information: user, server, channel, role and message IDs; usernames, avatars, server names, permissions and account information used by security checks.
• Settings and activity: enabled features, selected channels and roles, message templates, moderation events, administrative actions and their timestamps.
• Feature data: messages checked by protection rules, CAPTCHA responses, welcome images, giveaway hosts, participants and winners, and saved backup structures.
• Dashboard sessions: sign-in details and server access information needed to keep you signed in and show the servers you may manage.
• Connection information: IP addresses used to limit excessive requests.

You can read public information pages without signing in. Managing a server requires a Discord account with the appropriate access.

04. Purposes & legal bases

SHADO5 processes information to sign you in through Discord, check your access to servers and apply your settings. Enabled features use it to detect configured security events, perform moderation, send community messages, run giveaways and save or restore server structures. Activity records help administrators understand changes and investigate errors.

Data protection law requires a lawful basis for each purpose. Contractual necessity applies only to information needed to provide an agreed service to the person concerned. Legitimate interests require a balance between the purpose and that person's rights. Legal obligations require an applicable duty, and consent must be freely given and withdrawable.

Enabling a feature is not blanket consent from every server member. A server administrator's agreement does not automatically authorise all processing of member information.

05. Verification & protection

• Verify: the bot sends a CAPTCHA image by DM and checks up to three responses within 90 seconds. The code and user are printed to the console; submitted responses are also printed. A configured Discord log can include the code, username, account creation information and avatar, followed by a verification result. Ending the challenge clears its active memory state, not these separate logs.
• Anti-Bot and Anti-Alt: bot status, joins and account age are used for configured checks and kicks. Actions can be reported in the configured log channel.
• Anti-Invite: message content is checked for invitations. Matching messages may be deleted and the author timed out. Logs can include the original message, author and channel.
• Anti-Words: messages and edits are compared with configured words. Matching words and user information can appear in logs, alongside deletion or timeout actions.
• Anti-Nuke: server events, audit-log actors and message activity are used to detect configured patterns. The bot can apply kicks or timeouts, clean up messages and report actions.
• Honeypot: messages in the configured channel can trigger deletion and a kick or ban, subject to exemptions and permissions. Action logs identify the user and result.

These rules can affect legitimate users or miss harmful activity. Contact the server administrators to ask for review of a moderation result.

06. Community features & backups

Welcome & Goodbye uses member information, configured messages, roles and optional DMs. Background images are stored on the service and are publicly accessible by their image URL. Uploads are processed to remove metadata. Do not upload private documents or secrets.

Giveaways store the host, server, channel and message references, prize, timing, participants and winners. Results and participant information may be shown in Discord. Ending a giveaway does not itself erase its stored records.

Server Backup stores supported roles, channels, topics, settings and permission overwrites, which can include member IDs. It does not store a complete message history or member roster. Restore records identify who requested the action, its progress and the restored objects. Shared backups may reveal private server information.

Activity and internal administration logs record relevant users, names or avatar references, actions and times. Internal announcement records also contain copies of published content and Discord message references. Removing a published message does not automatically erase the underlying content or activity records.

07. Website & dashboard

Sign-in uses Discord OAuth2 with the identify and guilds scopes. Discord provides profile and server information so SHADO5 can identify your account and show the servers you are allowed to manage. SHADO5 does not ask for your Discord password.

Your session stores profile information, cached server information and the access token and expiry used to communicate with Discord. Server-side permission checks control access to each workspace. Signing out ends the current session and clears its cookie; it does not delete every server setting or historical record.

08. Cookies & sessions

The necessary shado5.sid cookie keeps track of your dashboard session. It contains a session identifier, while the associated sign-in information is stored on the server. Its configured lifetime is 12 hours, although session renewal can affect expiry. Signing out clears the cookie.

The application has no identified analytics or marketing-cookie integration. Google Fonts and Discord-hosted images still make external browser requests, as explained below. The session-cookie lifetime is not a deletion deadline for all SHADO5 data.

09. Storage & retention

SHADO5 stores server settings, sign-in sessions, giveaway records, backups, uploaded welcome images and activity or administration records. Active CAPTCHA challenges and temporary caches are held in memory. Discord messages and operational logs are separate records.

Expired sessions are periodically cleared. Saving welcome settings can remove uploaded images that are no longer referenced. Existing controls allow backups to be deleted or replaced. Ending a CAPTCHA challenge clears its active state, but not information already written to logs.

These deletion controls apply to particular records, not everything associated with an account or server. Removing the bot, signing out or revoking Discord access does not automatically erase all historical records, Discord logs or backup copies.

10. Recipients & transfers

Discord provides sign-in, APIs and media hosting, and receives bot messages and moderation actions. Its own processing is described in the Discord Privacy Policy.

For vote-required features, Top.gg receives the relevant Discord user ID and bot identifier so SHADO5 can check voting eligibility. SHADO5 temporarily caches the result. Voting is free and supports the project's visibility; opening a vote link connects your browser to Top.gg.

Google Fonts and Discord's CDN receive connection information, including your IP address, when your browser requests their assets. Hosting and infrastructure services may also process information stored or transmitted through the service. External services may process information outside the European Economic Area.

Configured messages and announcements are visible to their Discord audiences. Server activity is available to authorised dashboard users, while internal administration records are restricted to operator admins. Any disclosure required by law is subject to the applicable obligation.

11. Your rights & deletion

Subject to the applicable conditions, you can request access to your information, correction, erasure, restriction of processing or a portable copy. You can object to processing based on legitimate interests and withdraw consent where consent is used. You may also complain to a data protection authority, including where you live or work.

A request should identify the relevant user or server and the information concerned. Never include passwords, access tokens or CAPTCHA codes. Identity checks should be proportionate to the request.

Server administrators can help with their own settings and logs, but this does not replace your rights against the SHADO5 operator. Do not submit confidential privacy requests in a public Discord channel.

12. Security & younger users

SHADO5 checks authentication and server permissions, separates access to different servers, protects settings changes against forged requests, limits excessive requests and validates image uploads. These measures reduce risk, but no online service can guarantee absolute security.

Discord's age and eligibility requirements apply when using Discord. SHADO5 does not introduce a separate age threshold in this policy.

13. Updates to this notice

This policy may be updated to reflect changes to SHADO5's features, data handling or applicable requirements. You can return to this page to read the current version. Changes to this policy do not remove your privacy rights or turn use of SHADO5 into blanket consent.

For service use and responsibilities, read the Terms of Service.

01. Introduction

SHADO5 is a free Discord security bot and web dashboard independently operated by a private developer in Germany. It provides security, moderation and community management features to help server administrators protect and manage their communities.

All existing features are free to use. There are no premium plans, subscription fees or paid features. The project currently receives no advertising revenue, donations or other project income.

02. Access & eligibility

Use Discord in line with its Terms of Service, including its age and eligibility requirements. Only configure servers you are authorised to administer, and keep your account credentials private.

Do not access another user's session or bypass server permission checks. The Privacy Policy explains how SHADO5 handles information; using a feature is not blanket consent to all data processing.

03. What SHADO5 provides

SHADO5 offers Verify, Anti-Bot, Anti-Alt, Anti-Nuke, Anti-Words, Anti-Invite and Honeypot protection. The dashboard also provides server-structure backups, Welcome & Goodbye messages, optional welcome DMs and roles, giveaways, activity logs and access controls.

Features depend on the settings you choose and the bot's Discord permissions. Some features require a Top.gg vote. These votes are free and are used solely to increase the project's visibility, not as a payment or subscription.

04. Server administration

Choose channels, roles, exemptions, thresholds and moderation actions carefully. Give the bot the permissions its enabled features need. Discord's role hierarchy can limit what it can do.

Control who can change settings, access the dashboard and read log channels. Review automated actions and tell members about the features active in your server. Your responsibility for these choices does not remove the operator's own legal duties.

05. Automated protection

Configured protection may delete messages, time out, kick or ban members, and record moderation results. Verify checks CAPTCHA responses before granting a role. Honeypot can act on messages in a designated channel. Community features may also assign roles automatically.

Security rules can produce false positives or miss abuse. Test settings, monitor the results and review disputed actions. SHADO5 is not a guarantee against every attack. Permissions, Discord availability and rate limits may delay or prevent actions.

06. Backups & restoration

Backups save supported server structures and settings, not message history or a complete membership archive. Managed roles, permission hierarchy and Discord limitations can prevent an exact recreation.

Restore missing and Full Restore have different effects. Full Restore can delete existing channels and roles to recreate the saved structure, subject to technical safeguards. Messages in deleted channels are not recovered from a SHADO5 structure backup.

Check the selected backup, target server, warnings and confirmation before restoring. Keep an independent recovery plan. Share a backup only when you have authority to disclose its metadata and permission information.

07. Content & community features

Use only messages, images and prizes you have the right to provide. Make sure you have any permissions needed for SHADO5 to store and deliver that content as configured. Welcome messages may appear in server channels or DMs, and uploaded images are publicly accessible by URL. Do not upload secrets or private documents.

Giveaway hosts are responsible for the prize and applicable participation rules. Selecting a winner does not deliver the prize. Existing intellectual property rights remain with their holders; submitting content does not by itself transfer ownership.

08. Acceptable use

Do not use SHADO5 for raids, harassment, unlawful surveillance, unauthorised access or destructive actions against another server. Do not bypass permission or voting checks, abuse APIs, or submit material you are not entitled to use.

Keep passwords and tokens out of templates, prizes, backups and announcements. Report a suspected vulnerability through a private, confirmed operator contact rather than exploiting it or posting sensitive information publicly.

09. Availability & external services

SHADO5 relies on Discord, hosting, its database and Top.gg voting checks. Maintenance, outages, rate limits, platform changes and permission changes may interrupt or limit features. Status reports describe observed conditions, not a guarantee of uninterrupted availability or a fixed recovery time.

External services have their own rules and policies. SHADO5 cannot override Discord's permissions, limits or platform decisions.

10. Responsibility & your rights

Security tools and backups have practical limits, so review settings and restoration warnings carefully. These warnings do not remove your legal rights.

Liability for intentional or grossly negligent conduct, injury to life, body or health, and other liability that cannot lawfully be excluded remains unaffected. Mandatory consumer and other statutory rights continue to apply.

11. Ending use & changes

You can stop using SHADO5 by signing out of the dashboard, revoking Discord authorisation or removing the bot from a server you are allowed to manage. These actions do not automatically delete all stored settings, logs or backup records. See the Privacy Policy for information about data and deletion controls.

Service information and these terms may be updated as SHADO5 changes. An update does not override mandatory legal rights.

12. Contact

For general questions about SHADO5, visit the support server.

Public support channels are not a substitute for a confidential legal or privacy contact. Do not post private account details or sensitive personal information there.