Privacy Policy
Effective 2026-07-31. This covers the hosted MadHoney bot and the dashboard at madhoney.nomadsgalaxy.com, operated by Nomads Galaxy.
What we store
The database holds three kinds of record about people:
Server configuration - for each server: the chosen role and channel IDs, your verify message, banner design settings, your per-channel gating choices, whether ban sharing is on, and your compromised-account and raid-mode settings. We also record who first configured the server and who last changed a setting. For each person, we record the Discord ID, username, and timestamp. Your staff can use this information to see who changed the configuration.
Ban log - when MadHoney acts on an account (or an admin undoes it): the Discord user ID, username, server ID, channel name, and timestamp. Kicks and quarantines are also recorded. Each entry has an incident ID that groups the messages from one spam event. It also has the account's catch count for that server. Flags show whether MadHoney withheld the entry from the universal ban list or detected it during a burst. Ban entries provide the data for the log channel and the dashboard's ban list. For opted-in servers, they also provide the data for cross-server ban sharing.
Appeals - if a server turns appeals on: that a given user appealed a given ban, and when. We do not store the text of the appeal.
The database also holds operational state that is not about people: dashboard actions queued for the bot to run, and failover status. Neither contains message content.
Data storage
The database is Cloudflare D1, so Cloudflare stores the above on our behalf and their privacy policy covers that storage. The bot keeps a mirror copy on its own machine. This copy lets the bot continue to work if D1 is unavailable. We do not send this data to a third-party analytics, logging, or moderation service.
Message content
The honeypot acts because of where a message is posted, not because of what the message says. MadHoney processes message content for two moderation purposes. First, a ban report can include the text and images from the message that triggered the honeypot. MadHoney sends this report to your private moderator-log channel so your moderators can review it. Second, MadHoney compares a member's messages across channels to detect a compromised account. It flags near-identical messages that the account posts in three or more channels inside a short window. The default window is five seconds; a server can set it between one and sixty seconds.
MadHoney processes message content in memory. It does not write message content to the database. The ban log stores only IDs, usernames, timestamps, and channel names. MadHoney does not store message content outside Discord and does not use it to train a model.
What we don't do
We do not use analytics, tracking pixels, or advertising. We do not sell or share data with anyone. The bot generates the captcha. No third-party captcha service receives information about your members.
The dashboard
Logging in uses Discord OAuth with the identify and guilds scopes: we receive your Discord username, ID, avatar, and your server list with permission flags, and use them only to show you the servers you can manage. Sessions live in server memory and disappear on logout or when the bot restarts. The only cookie is a session ID; there are no tracking cookies.
The site is served through Cloudflare's edge, which handles TLS and caching, and loads fonts from Google Fonts.
The universal ban list and your data
If a MadHoney honeypot bans you in any server, the record (your Discord user ID) goes to the universal ban list. Servers that opted in to the list may ban you when you join them. An admin unbanning you removes that effect everywhere.
Two things deliberately keep entries off that list. If a server's honeypot fires many times in a few minutes, MadHoney treats the burst as unexplained. It kicks the accounts instead of banning them. It does not add the accounts to the universal ban list until a moderator confirms the incidents. Thus, one misconfigured server cannot ban you everywhere. Servers that have not finished setup do not add accounts to the list. If you believe MadHoney added you to the list in error, ask the server that banned you to undo the ban, or open a GitHub issue and we'll look at the record.
Retention and deletion
Server configuration persists so the bot re-arms if it's re-invited; kicking the bot stops all processing for that server. Ban log entries are kept so ban sharing and the Undo button keep working. To have your server's configuration or a specific ban record deleted, open a GitHub issue from an account that can prove server ownership.
Changes
If what we store ever changes, this page changes with it, along with the effective date above.