Privacy, consent, and limits
Handle evidence and recorded-session artifacts within server scope, explicit consent notices, visibility rules, and honest persistence limits.
- Audience
- moderator · senior reviewer · team lead · server admin
- Availability
- free · premium preview · private beta access
- Maturity
- alpha · partial
Last reviewed
On this page
Collect the minimum material the job needs
Evidence, attachments, recordings, and transcripts can contain sensitive server context. Operators should collect only what the supported workflow needs, preserve provenance, honor consent and visibility controls, and avoid promising indefinite availability.
Consent and artifact boundaries
| Checkpoint | Operator duty | Limit to disclose |
|---|---|---|
| Before collection | Use the supported notice/consent flow and confirm purpose | Consent, recording, and transcription are separate states |
| During review | Keep material inside the narrow authorized case/session view | Record access may not include every source or attachment |
| When sharing | Share the minimum visible summary through supported handoffs | Copied URLs and screenshots do not grant permission |
| When unavailable | Record the missing artifact and continue only with verified remaining evidence | Local files, source messages, and generated artifacts can be unavailable |
Check purpose, consent, status, and visibility
Confirm purpose and scope
Identify the selected server, case/session, collection purpose, and minimum required material.
Check: Collection stays within one supported workflow.
Verify notice, consent, and status
Read the explicit session or artifact status rather than assuming it from channel presence.
Check: The record distinguishes notice, consent, capture, processing, and availability.
Review through guarded surfaces
Open evidence or transcript material only in its supported record view.
Check: Visibility checks remain in force.
Document limits
Record missing, redacted, inaccessible, partial, or failed artifacts in the decision context.
Check: Reviewers can distinguish evidence from absence or uncertainty.
Sensitive material stays within its supported server-scoped workflow, with consent and artifact status stated accurately.
Understand sensitive data by surface
| Surface | Data | Minimum handling |
|---|---|---|
| Cases/evidence | Source messages, files, comments, decisions, restricted material. | Keep in guarded Case; share record reference and safe summary. |
| Staff notes | Attributable staff observations and member context. | Use policy-relevant facts; avoid unnecessary personal data. |
| Voice Evidence | Session metadata, recordings, transcripts, participant/consent state. | Verify purpose, notice, consent, visibility, and artifact status. |
| Imports | External source messages, parsed actions/activity, provider/actor data. | Use approved sources and preserve provenance/confidence. |
| Activity | Metadata-only member/voice/message/role/channel/server events. | Use narrow time and event filters; do not infer content. |
| Exports | Downloaded copy of visible records/notes/Cases/member history. | Narrow dataset, secure destination, controlled retention/deletion. |
| Support report | Safe identifiers, state, time, reproduction. | Exclude credentials, evidence, transcripts, exports, and unrelated personal data. |
Separate notice, consent, participation, recording, and transcript
| Checkpoint | Proves | Does not prove |
|---|---|---|
| Purpose/notice | The session’s intended use and recording notice were presented. | That each participant consented. |
| Consent | The participant used the implemented consent control for the supported session. | That recording started or every artifact was produced. |
| Participation/admission | The participant entered/spoke under the session workflow. | Consent for other sessions or indefinite reuse. |
| Recording state | Capture started/stopped as reported. | Successful transcription or persistence. |
| Transcript/recording available | A stored artifact exists and is visible to the current viewer. | Indefinite retention or permission to redistribute. |
| Case evidence preservation | An authorized artifact/reference was attached to a Case. | A broader audience or altered consent purpose. |
State the retention limits
- Source Discord messages can be edited, deleted, or become inaccessible.
- Local evidence and recording files can be unavailable after storage, host, or retention changes.
- A transcript can be partial, failed, or absent even when a session existed.
- Activity has a documented default 180-day retention and can have collection gaps.
- Exports are point-in-time copies and are not guaranteed universal archives.
- Imported history depends on supported formats and accessible source history.
- No guide promises indefinite retention, cross-host durability, cross-server portability, or restoration of unavailable artifacts.
Respond to a privacy or visibility incident
Stop exposure
Remove or stop sharing the material where authorized; disable the affected optional surface if necessary.
Check: The audience does not widen.
Preserve safe facts
Record server, route/surface, record ID, time, viewer role, and non-sensitive status.
Check: Investigation can begin without copying content.
Assess scope
Identify which roles/users could view, download, or receive the material.
Check: Containment targets the actual exposure.
Correct the boundary
Fix the narrow permission, visibility, export, channel, or role mapping.
Check: Least privilege is restored.
Verify with test accounts
Confirm intended allowed and denied access.
Check: The intended test role can open the surface, while the control role is denied.
Notify appropriately
Use the server lead and published security/privacy contact with minimum data.
Check: The incident reaches the authorized contact without unnecessary private data.
Document unresolved copies
Acknowledge exports/screenshots/notifications that cannot be recalled.
Check: Impact is not understated.
Document missing or unavailable artifacts
ModFlow does not promise universal capture, arbitrary uploads, access to deleted source messages, indefinite artifact persistence, or permission bypass. Public docs do not expose infrastructure procedures.
A cross-workflow state is unclear
What you see: The visible status, permission, source, or execution result does not support a confident next action.
What may be happening: The viewer may be reading a stale surface, a narrowed view, a separate lifecycle stage, or a partial operation result.
What to do
- Stop collection if consent or purpose is unclear.
- Reopen the guarded case or transcript record and read its current status.
- Treat unavailable material as unavailable rather than reconstructing it from private copies.
- Escalate privacy or access concerns through the published contact path without including sensitive content.
Give notice for expanded data workflows
Server notices and access reviews should address enabled event-log destinations, dashboard Jail relay, appeal DMs and internal notes, Watchlist and No Contact relationship processing, staff evaluations, selected Google or Microsoft assignment files, and any approved MIRA/OpenAI investigation. Explain recipients, retention, correction routes, and how Discord or provider copies differ from ModFlow records.