Permissions and hosting
Bots and integrations operate only within permissions a server manager grants. Developers may host full bots independently or use the opt-in, bounded hosted command runtime. Uploaded command source is stored with the application and shared with its accepted collaborators. Hosted commands run on demand without network access, packages, timers or background processes. Document your service’s operator, privacy practices and support contact before inviting users to connect.
Credential handling
Keep bot, API and webhook secrets on a trusted server, rotate exposed credentials, and honour permission revocations. Do not scrape private conversations, evade quotas or request an account password. Rate limits and Gateway reconnect limits are shared abuse protections.
Data and responsibility
Use member data only for the authorised purpose, minimise retention and provide deletion procedures. Do not sell or share private content without a lawful basis. Integrations must follow applicable law and platform rules. We may revoke unsafe applications. Australian mandatory consumer rights remain preserved.