Discord developer rules and what they mean for ZipGuard

Read on 2026-11-01 from Discord's current pages. Quotes are short and paraphrases are close; the links are the source of truth. Anything marked "unverified" was not confirmed from a primary page that day.

Sources fetched:

• Developer Policy: https://support-dev.discord.com/hc/en-us/articles/8563934450327-Discord-Developer-Policy
• Developer Terms of Service: https://support-dev.discord.com/hc/en-us/articles/8562894815383-Discord-Developer-Terms-of-Service
• What are Privileged Intents: https://support-dev.discord.com/hc/en-us/articles/6207308062871-What-are-Privileged-Intents

Data we may collect and keep

• Policy 15: API data may be used only "as necessary to provide your Application's stated functionality". ZipGuard's stated functionality is join screening, moderation tooling and server protection. Every column in the data statement maps to one of those.
• Policy 16: do not use API data "to profile Discord users, their identities, or their relationships with other users". ZipGuard scores a single join with signals from that join and that server. It keeps no cross-server identity graph. The shared ban list is opt-in, limited to servers with the same owner, and stored as salted hashes.
• Policy 17 and 18: no disclosure to data brokers or advertising networks; no selling or licensing API data. ZipGuard has no ads, no paid tier and no data products.
• Policy 19: do not re-identify or reverse hashes. We hash for our own storage; nobody, including us, reverses them. The salt lives only in the bot database.
• Policy 20: no mining or scraping. The bot only reads events Discord sends it.
• Policy 21: "Do not use message content obtained through the APIs to train machine learning or AI models (including large language models) unless express permission is granted by Discord." Consequence: the planned Jebadiah scam classifier must be trained on data that is not Discord message content, or with Discord's written permission. Running a classifier on live messages to protect the server is use for stated functionality; training on those messages is not allowed without permission. The scoring model trained on join metadata and moderator overrides does not touch message content.
• Policy 7: do not contact users outside Discord using API data. ZipGuard collects no email or phone, and the breach runbook notifies inside Discord.

Retention and deletion

• Developer Terms 5(b): "promptly update the API Data upon request from us or the applicable user" and "promptly delete the API Data when (a) retaining it is no longer necessary for your Application's stated functionality" and in the other listed cases, unless law requires retention. ZipGuard keeps join records and reports 90 days and deletes a member's rows at once on /forget-me.
• Developer Terms, termination: on termination or loss of API access, "delete any cached or stored API Data you have in your possession or control". If the app is ever shut down, the database and the pilot store are deleted.
• Developer Terms 5(b): API data may be shared only with a Service Provider acting for us, when the law requires it, or when the user expressly directs it. Our hosts (the VPS provider and Cloudflare for the website) are service providers and must agree in writing to use the data only for us. Open item below.

Security and breach notification

• Developer Terms 5: "commercially reasonable efforts to protect API Data from unauthorized access or use", including "(i) encryption of the data at rest and (ii) maintaining administrative, physical, and technical safeguards". Done 2026-11-01: the database lives on a LUKS2-encrypted volume on the host, and the bot refuses to start if that volume is not mounted.
• Developer Policy, Handle Data with Care: "we require developers to notify Discord and affected users of potential unauthorized access to API Data, as described in Section 5 of the Developer Terms." The breach runbook notifies affected owners and members within 72 hours and now also notifies Discord.
• Developer Terms 5: comply with GDPR, UK GDPR, LGPD, CCPA and CPRA, and provide and adhere to a privacy policy. The data statement at zipguard.dev/data is the privacy notice today; a formal privacy policy and terms page is Jason's item.

Privileged intents

• "If your app has fewer than 10,000 users, you may access Privileged Intents by enabling them in the Developer Portal. However, once your app reaches 10,000 users, your app requires review for continued access." Users are counted as unique users across all servers the app is in; the owner gets 90 days to apply once the threshold is reached.
• Message Content "controls access to message content data across our APIs, including fields like content, embeds, attachments, and components". Server Members is the other privileged intent ZipGuard uses. Enable a privileged intent only when the use case requires it. ZipGuard requests Message Content only when LINK_DEFENSE is on.
• Unverified: whether app verification is required before an app can be added to more than 100 servers. Earlier notes in the PRD said so; this was not confirmed from a primary page on 2026-11-01. Check the App Verification page before the pilot passes 75 servers.

Rules that touch join screening, auto-kick and auto-ban

• Nothing in the three pages forbids kicking or banning members through the API at a server administrator's instruction. Limits on rate and on bulk moderation live in the API documentation and in Discord's Terms of Service, which were not read for this note. Unverified: any rule specific to "verification" or "alt detection" apps.
• Policy 16 (no profiling, no discrimination on protected characteristics) is the rule most relevant to scoring. ZipGuard's rules use account age, avatar presence, public badges, invite and timing. None is a protected characteristic.
• App Review: Discord "may also require that you submit your Application for our review and approval" at usage thresholds or to review compliance, and may request certifications and attestations. Keep this document and the data statement current so review is a formality.

Blocks or risks for ZipGuard's design

• None that block the current design.
• Two changes made because of this reading: training a classifier on Discord message content is off the table without Discord's permission, and the database moved onto an encrypted volume the same day.

Open items

• Written service-provider agreement covering the VPS host and Cloudflare for API data (Developer Terms 5(b)).
• Confirm the 100-server app verification rule from the App Verification support page.
• Read the Discord Terms of Service and the API documentation for moderation rate limits before raid mode and anti-nuke run on large servers.
• Formal privacy policy and terms page (Jason, legal).