Discord MCP

Privacy

Discord MCP stores as little as it can, for as short as it can.

Controller: Sattler Development — see the legal notice and the company privacy policy, which applies in addition to this page.

When you link your account

  • Your Discord user ID, username, display name, avatar hash and locale.
  • Your Discord OAuth token (scopes identify and guilds), encrypted with AES-256-GCM. It is used only to list the servers you are in.
  • Hashes of the access and refresh tokens issued to your MCP clients.

For each activated server

  • The activation and the owner's settings: access mode, allowed and blocked member IDs, allowed role IDs, allowed actions, action limit and mention policy.
  • A cache of roles, channel settings and the owner ID used for permission checks. It expires 14 days after the last activity on that server and is rebuilt on the next use.
  • Short-lived member entries (a few minutes) for permission checks.

Not stored

  • Message contents. Messages are fetched when you ask for them and passed to your assistant, never persisted.
  • Your conversations with your AI assistant — they never reach us. We only see the individual tool calls.

Activity and message log

Every tool call (tool name, server, arguments, result, your user ID and username) is kept for 90 days and shown to the server owner in the dashboard. For messages the bot sends on your behalf we store the message ID, channel, your user ID and username and the time for one year, so /explain can show who sent it. Message contents are not stored.

Deletion

/mcp logout or removing the app in Discord deletes your account record and all tokens immediately. When the bot is removed from a server, that server's settings and cache are deleted.