Privacy controls & data management

Principles

Data minimization - only collect what a feature needs.
User control - you decide what is stored and can delete it.
Transparency - /context view shows what is kept.
Encryption - sensitive fields are encrypted per-field with AES-256-GCM.
No privileged intents - Mellow cannot read your members' messages. It only sees DMs, messages that mention or reply to it, and text you give it through a command or the "Check on this message" context menu.

What Mellow stores

Always (needed to function)

Your Discord user ID.
Your preferences (personality, timezone, language, reminder settings, privacy toggles).

Only if you use the feature

Mood check-ins (mood, intensity, activity, note - note and activity encrypted).
Coping tool usage, journal entries (encrypted), gratitude entries (encrypted), coping plan (encrypted).
Ghost letters (encrypted, visible only to you).
Your safety plan (encrypted, visible only to you), if you write one.
Your country, quiet hours, and weekly recap / daily prompt settings, if you set them, and when the last recap or prompt was sent so they are not repeated.
A custom conversation style note, if you have Mellow+.
Conversation history, if context_logging is on (content encrypted).
Crisis events, if crisis_detection is on (details encrypted).

Per server (visible to that server's admins)

Guild settings and feature toggles.
System log entries, if system_logs is enabled.
Crisis alert notifications, if crisis_alerts is enabled.

User privacy settings

Set with /preferences set:

Setting	Default	Effect when off
`context_logging`	on	Messages are not stored for AI context; responses are less personalized.
`crisis_detection`	on	Your own messages are not screened for crisis indicators.
`crisis_dms`	on	Mellow will not DM you crisis support.

Server privacy settings

Admins use /guildsettings set:

context_logging:false - disables AI context logging for the server.
crisis_alerts:false - disables crisis alert notifications for the server.
system_logs:false - disables system logging for the server.

Seeing your data

/context view - how much conversation context is stored and your privacy settings.
/preferences view - all your current settings.
/profile - your check-in, coping, ghost letter, and journal activity.

Admins:

/guilddebug - the server's stored configuration and status.
/guildcontext - how context and privacy are handled in the server.

Deleting your data

/context clear - permanently deletes your stored conversation history.
/coping plan clear:true - clears your coping plan.
/coping journal delete:<n> - deletes one journal entry.
/safetyplan clear - deletes your safety plan.
Turn off future logging with /preferences set context_logging:false.

Your data on the dashboard

On the

dashboard

The Mellow Dashboard

Manage your preferences, Mellow+ status, data, and servers from the web.

, under Your data:

Download my data gives you a JSON file of everything Mellow stores about you, decrypted so you can read it: preferences, mood check-ins, journal, gratitude entries, ghost letters, coping plan and tool usage, safety plan, crisis events, and conversation history.

Delete my data permanently erases, in one step:

Mood check-ins, journal and gratitude entries, ghost letters, coping plan, favourite tools, and coping tool usage
Your safety plan
Crisis events
Stored conversation history
All of your preferences
Your dashboard sessions

Some things are kept, deliberately:

Feedback, reports, and system log entries are kept but detached from your account, so the team can still act on them without knowing who you are.
Your account record stays with your display name replaced by "Deleted user". This is so bans and moderation decisions still apply if the same Discord account returns. It holds no personal content.
Mellow+ purchase records synced from Discord are kept, because they belong to Discord's billing and are needed to honor an active subscription.
Server settings belong to the server, not to you, and are unaffected.

Deletion cannot be undone. Both features are free and need no approval from the team. If you cannot use the dashboard, contact the team:

Crisis data

When a crisis is detected, Mellow provides resources to the user, records the event (details encrypted), and, if the server has crisis_alerts enabled, notifies the configured moderator channel. Passive detection alerts moderators only; it does not contact the user. Crisis event records are kept for safety follow-up until you delete them. Delete my data on the dashboard removes them.

See

Crisis Safety

How Mellow screens for crisis and why it responds the way it does.

and the Privacy Policy.

Privacy Controls