Privacy controls & data management

Principles

Data minimization - only collect what a feature needs.
User control - you decide what is stored and can delete it.
Transparency - /context view shows what is kept.
Encryption - sensitive fields are encrypted per-field with AES-256-GCM.
No privileged intents - Mellow cannot read your members' messages. It only sees DMs, messages that mention or reply to it, and text you give it through a command or the "Check on this message" context menu.

What Mellow stores

Always (needed to function)

Your Discord user ID.
Your preferences (personality, timezone, language, reminder settings, privacy toggles).

Only if you use the feature

Mood check-ins (mood, intensity, activity, note - note and activity encrypted).
Coping tool usage, journal entries (encrypted), gratitude entries (encrypted), coping plan (encrypted).
Ghost letters (encrypted, visible only to you).
Conversation history, if context_logging is on (content encrypted).
Crisis events, if crisis_detection is on (details encrypted).

Per server (visible to that server's admins)

Guild settings and feature toggles.
System log entries, if system_logs is enabled.
Crisis alert notifications, if crisis_alerts is enabled.

User privacy settings

Set with /preferences set:

Setting	Default	Effect when off
`context_logging`	on	Messages are not stored for AI context; responses are less personalized.
`crisis_detection`	on	Your own messages are not screened for crisis indicators.
`crisis_dms`	on	Mellow will not DM you crisis support.

Server privacy settings

Admins use /guildsettings set:

context_logging:false - disables AI context logging for the server.
crisis_alerts:false - disables crisis alert notifications for the server.
system_logs:false - disables system logging for the server.

Seeing your data

/context view - how much conversation context is stored and your privacy settings.
/preferences view - all your current settings.
/profile - your check-in, coping, ghost letter, and journal activity.

Admins:

/guilddebug - the server's stored configuration and status.
/guildcontext - how context and privacy are handled in the server.

Deleting your data

/context clear - permanently deletes your stored conversation history.
/coping plan clear:true - clears your coping plan.
/coping journal delete:<n> - deletes one journal entry.
Turn off future logging with /preferences set context_logging:false.

For a full account deletion (every check-in, coping record, crisis event, ghost letter, journal and gratitude entry, plan, and all preferences), contact the team:

When a crisis is detected, Mellow provides resources to the user, records the event (details encrypted), and, if the server has crisis_alerts enabled, notifies the configured moderator channel. Passive detection alerts moderators only; it does not contact the user. Crisis event records are kept for safety follow-up and can be removed on request.

See

Crisis Safety

How Mellow screens for crisis and why it responds the way it does.

and the Privacy Policy.

Privacy Controls