terms-of-service social-media
Are Discord bots allowed to store deleted messages and let people view them?
<p>There are many Discord bots around which look at messages sent by users, but are they legally allowed to store messages in files, and even store messages which were since deleted by the users who sent them?</p>
<p>I'm asking this question because my friend recently built a Discord bot which does just this. It includes a command (<code>showlog</code>) which sends some of the log in Discord. For example, this is some of the data which that bot recorded:</p>
<pre><code>BubkisLord - yeessss (Official Year 9 GATE - spam)
BubkisLord - ahahaha (Official Year 9 GATE - spam)
BubkisLord - showlog (Official Year 9 GATE - spam)
BubkisLord - MAUH HAHAHAHAHAHA (Official Year 9 GATE - spam)
BubkisLord - yeyesss (Official Year 9 GATE - spam)
BubkisLord - showlog (The Server Of Bubkis - 🙂-general)
Spock - ? (The Server Of Bubkis - 🙂-general)
BubkisLord - showlog (The Server Of Bubkis - 🙂-general)
BubkisLord - good (The Server Of Bubkis - 🙂-general)
</code></pre>
<p><em>Anyone in the same server as the bot can view the log.</em></p>
<p>Another one of our friends asked a question about whether it was actually allowed to store the deleted messages of users, and that got us confused. It might <em>not</em> be allowed, because if someone chooses to remove their content, it shouldn't be easily accessible to everyone, and it especially shouldn't be accessible to everyone in any server which that bot is in.</p>
<p>But I skimmed through Discord's Terms of Service, and the Discord API Developer Policy, and could find no reference. Is it allowed? Is it not?</p>
<p>By the way, all people affected at this point in time are living in Australia (specifically, Western Australia).</p>

<h2>It may be legal or it may not</h2>
<p>For example, if any of the users are in the European Union, then the GDPR applies and the person storing the information is a data controller and has legal obligations. These include, having a legitimate reason for storing them, storing them only for as long as necessary for that reason, notifying the individuals that the data is being stored and why, deleting it upon a users request etc.</p>
