Who operates these apps
OpenACAI operates Modstoke Sentinel and Modstoke Radio as public preview apps for Discord servers. Server owners install them as server apps; personal account installation is not supported. Each server's stored data, context and playback queues are separate.
This bot-specific supplement describes their data handling alongside the OpenACAI privacy policy. See also the Discord app terms and app setup information.
Sentinel: moderation and community features
Sentinel stays inactive in a new server until its owner configures the required channels. Once configured, it can see messages and member events in Discord channels it has permission to access. It uses them for moderation, aggregate community statistics, self-assigned roles, crew finding and help. Bans and conversation features are off by default.
Model processing runs locally on the hosting server through a loopback connection, without cloud AI processing. Servers share one model worker, which processes one request at a time; their contexts remain separate. Recent moderation context holds up to six message excerpts per channel in memory for about three minutes. Information handled by these bots is not sold for advertising or used for AI training.
The local moderation ledger retains user, channel and message IDs, timestamps, fingerprints, evidence labels, actions and reviewer information for up to seven days, capped at 1,000 entries. A separate removal ledger is retained for seven days. Moderation log messages posted to Discord have separate retention controlled by Discord and the server.
Crew posts, preferences and statistics
Active crew records include raw crew text, display names, host IDs, regions, requirements and timing. They remain until the crew is closed or expires, with expiry periods of one to 24 hours. Cleanup can be delayed if the bot cannot access the Discord post. Closed posts can remain on Discord.
Crew alert subscriptions and opt-out user IDs persist. Use /crew alerts to stop crew alerts; /companion quiet opts you out of companion interactions. These controls do not delete all moderation records.
When a member leaves, Sentinel cleans up their crew subscriptions and closes their owned crews; departure is not a blanket deletion of all records. Community statistics are aggregate. Configured channel and role IDs remain while the bots operate.
Radio: requests and voice playback
Radio uses Discord's guild and voice-state intents and does not request the Message Content intent. It keeps slash-command request URLs and generated track numbers in memory for playback. Radio is self-deafened in voice channels and does not record voice audio.
Downloaded media is temporary and cleaned up after a track; startup cleanup also removes leftover downloads. Stopping the queue clears its in-memory contents.
Fetching media from Discord's CDN or YouTube sends requests from the hosting server to those providers. Spotify link cards open the original site; Radio does not provide full Spotify voice playback.
Hosting and other services
The bots run on a VPS hosted by InterServer. Sentinel's local JSON configuration, preferences and case records are encrypted with AES-256-GCM, with the key held separately through protected system credentials. Radio's temporary media uses a private memory-backed runtime directory. Swap is disabled for both bot services and the local model service. Operational logs are also kept as part of running the service. The short retention periods above describe the specified bot records, not every operational log or Discord message.
Discord independently processes and retains messages, posts, interactions and other platform information under its own policies and server settings. Media providers also process requests under their own policies. Deleting a local bot record does not remove copies held by Discord or those providers.
Removing Sentinel from a server
When Sentinel is removed from a server other than its home Modstoke deployment, it closes that server's local state and purges its local server data folder. Discord posts, moderation logs and other copies retained by Discord remain subject to Discord and server controls. This folder cleanup does not promise deletion of every operational log or independently retained copy.
The home Modstoke deployment and its configuration remain controlled by the operator. Contact OpenACAI for deletion requests that go beyond the automated controls.
Privacy questions and deletion requests
Contact OpenACAI at [email protected] or through the OpenACAI contact page for privacy questions or deletion requests. Identify the bot, your Discord user ID and the relevant server or record so the team can locate the information. Do not send passwords or account tokens.
Opting out, leaving the server and deleting data are different actions. Use this contact route to request deletion beyond the controls described above. Requests concerning information retained independently by Discord may also need to be directed to Discord or the server moderators.