Lyx stores the minimum needed to run a Discord bot with per-server settings. There are no advertising trackers, no analytics scripts and no data sales.
What is stored
- Discord account: your user ID, username, display name and avatar, only when you sign in to the dashboard.
- OAuth tokens: access and refresh tokens, encrypted with AES-256-GCM before they touch the database. They are used only to read your guild list and to refresh your session.
- Server data: guild ID, name, icon, owner ID, member count and the settings you configure.
- Moderation records: case numbers, action type, target and moderator IDs, reasons, durations and timestamps.
- Leveling: XP totals, levels, message counts and the last time XP was granted.
- Utility data: suggestions you submit and reminders you create, including the channel and time.
- Audit log: which settings were changed, by whom, and when.
What is not stored
Lyx does not store message contents beyond what appears in a moderation case reason or a log entry you configured. There is no message archive, no voice recording and no presence history.
Cookies
The dashboard uses one cookie, lyx_session. It is HttpOnly, SameSite=Lax,
Secure in production, and signed with HMAC-SHA256. It contains your Discord user ID and an expiry
time — no tokens, no settings.
Where data lives
- Supabase hosts the Postgres database. Tables have row level security enabled and the public API key has no access.
- Cloudflare terminates TLS and routes the three hostnames through a tunnel.
- Discord provides identity, guild membership and the message events the bot subscribes to.
Retention and deletion
Server settings and moderation records stay while the bot is in the server. Removing the bot does not immediately delete them, so re-adding it restores your configuration. To have a server's data or your account data deleted, ask in the support server with the server ID or your user ID. Deletion requests are handled manually and confirmed.
Your choices
You can sign out at any time, which clears the session cookie. You can disable any module in the dashboard, which stops the bot from processing the events that module needs. You can remove the bot to stop all processing for a server.
Contact
Privacy questions go to the support server.