01 Scope & Hosting
This policy describes information handled by Lofi, the self-hosted Discord music bot published in the Discord-lofi repository by mob5824, when its features are used. It applies to an instance operated by or for the Maintainer. It does not replace Discord’s privacy policy or the policies of audio, hosting, or other services.
Each self-hosted instance stores its own configuration and history on the machine selected by its operator. The Maintainer does not automatically receive that local data and cannot access or delete records from an instance they do not operate. If you use a community-hosted copy, contact its operator about their practices.
02 Information Processed
Depending on enabled features, station type, and use, a Lofi instance may process or store:
| Category | Examples | Why it is used |
|---|
| Discord and server details | Server, channel, and user IDs; voice-channel state; slash-command and playback-control activity. | Connect to the right server and voice channel, authorize actions, and operate playback. |
| Playback history | Server ID, station name or ID, track title, voice-channel ID, requester ID when available, start/end times, end reason, listening duration, and peak listener count. | Support dashboard history, activity, and listening summaries. Track-play rows may also include station, title, time, server, and listener count. |
| Configuration and credentials | Discord bot token, dashboard key, per-server settings, custom station URLs, and optional channel or station settings. | Connect to Discord and remember operator-selected settings. Credentials must be kept secret. |
| Local library and generated audio | When enabled, filenames and audio metadata needed to scan a local music folder; rendered Studio Lofi cache files. | Find and play the operator’s local audio or cache music generated on the host. Local paths may be shown to authenticated dashboard users. |
| Dashboard and technical data | A temporary dashboard session cookie; the client network address used for login throttling and login security logs; runtime diagnostics. | Authenticate dashboard users, limit repeated login failures, and operate or troubleshoot the instance. |
Lofi uses Discord slash commands and does not require privileged Message Content, Presence, or Members Gateway intents in its published setup. Discord still processes information on its platform. Lofi is built for outbound music playback, not for recording voice conversations; audio from local or generated sources is sent to Discord voice when played.
03 How Information Is Used
The instance uses information to connect to Discord, join or leave voice channels, play the selected source, handle commands, show current playback and history to authenticated dashboard users, store operator settings, and diagnose operational problems. User IDs may be associated with playback requests or dashboard actions when available.
For online audio stations, Lofi connects from its host to the configured stream or source provider. For local files and Studio Lofi, audio is read or generated on the host and sent through Discord voice for playback to the connected channel.
04 Storage & Retention
By default, Lofi stores its SQLite database (lofi.db), configuration, logs, and generated-audio cache on the host running the bot. The exact location can vary by operating system and operator configuration. The operator may move the data directory, database, or log, and may store backups with a selected host or provider.
- Playback sessions, track plays, and activity events do not have a universal automatic expiry in the published implementation. They remain until the operator deletes or resets the database.
- Configuration and logs remain according to the operator’s setup. The application log may rotate, but copies made by a service manager, host, or backup system are outside the bot’s control.
- Generated audio cache files can be recreated and may be deleted by the operator. The operator’s local music library is maintained separately from the database.
Removing the bot from a Discord server or uninstalling the program does not necessarily erase its data directory, backups, bot token stored in the environment or configuration, or messages already sent through Discord.
05 Sharing & Audio Sources
- Discord: The bot sends commands, playback status, and audio to Discord. Voice participants can hear audio while it is played. Discord handles account, server, interaction, and voice traffic under its own privacy practices.
- Online station providers: When a network station is used, the bot host connects to YouTube, a radio provider such as SomaFM, or the operator’s configured source. Those providers may receive ordinary connection data, such as the host’s public IP address and requested stream URL, and apply their own logging and privacy practices.
- Instance operator and host: The operator and people with access to the machine, dashboard, database, configuration, logs, or backups may be able to view the information described above. Infrastructure providers may process stored files or network traffic for that operator.
- This website: Project pages are hosted by GitHub Pages and request fonts from Google Fonts. Those providers may process connection information under their own policies.
The Maintainer does not automatically receive data from independently hosted copies and does not sell their local playback records.
06 Access, Correction & Deletion
- Self-hosted or community-hosted Lofi: Contact the instance operator. Only that operator controls the database, configuration, logs, and backups and can handle requests about those records.
- An instance operated by the Maintainer: Email with “Lofi privacy request” and enough information to locate the instance and record. Do not send a bot token or dashboard key.
- Discord or audio-provider records: Contact the relevant provider for information it controls. Removing Lofi does not remove information those services retain.
Requests are limited to information the recipient controls and may require verification. Deleted database entries may remain in backups until those backups expire or are replaced.
07 Security
The Lofi dashboard is bound to the local machine by default and requires a private dashboard key. This reduces exposure but cannot guarantee security. The instance operator is responsible for protecting the bot token, dashboard key, host, local files, database, logs, and backups. Use HTTPS and appropriate network restrictions if enabling remote dashboard access.
Do not share credentials with the Maintainer or put them in public issues, screenshots, logs, or source control. If a credential is exposed, rotate it using the relevant provider’s controls.
08 Children’s Privacy
Lofi is not intended for anyone below Discord’s minimum age requirement or a higher minimum age that applies in their location. Server operators should consider the ages of their members and must not collect information from children contrary to applicable law. Contact the instance operator if you believe information was collected improperly.
09 This Website
The project and policy pages are static pages hosted by GitHub Pages. They do not contain a submission form or first-party analytics. The theme preference may be saved in your browser’s local storage; the site code does not send that preference to Lofi. Google Fonts is requested from Google to render the selected typefaces. GitHub and Google may process connection data under their own policies.
10 Changes to This Policy
This policy may be updated when Lofi’s implementation, deployments, or legal requirements change. A revised “Last updated” date will appear at the top of this page. An independently hosted instance may have additional practices set by its operator.
11 Contact
For questions about this policy or privacy requests concerning an instance operated by the Maintainer, contact . Include “Lofi privacy” in the subject and do not include credentials.
Project: ·