1. Introduction and scope
This Privacy Policy explains how The English Hub (“we”, “us”, “our”) processes personal data when you use our public website at https://eng-hub.org, participate in our Discord community, or interact with our SCOUT moderation bot.
We process personal data in accordance with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), the German Federal Data Protection Act (BDSG) where applicable, and other relevant European and national data-protection rules, including rules on cookies and similar technologies (e.g. the German Telecommunications Telemedia Data Protection Act — TTDSG — and the EU ePrivacy framework where implemented).
This policy does not govern Discord’s own platform. When you use Discord, Discord Inc. processes data under its own terms and privacy policy. We provide links in section 14.
2. Controller and contact
Data controller: The English Hub
Website: https://eng-hub.org
Privacy contact:
enghub@ve.ms
For legal identification of the controller (including postal address), see our Imprint. Due to sustained online abuse, full provider details are not published openly but are provided on legitimate request; we aim to respond within 24 hours on business days.
We have not appointed a Data Protection Officer (DPO). Under Art. 37 GDPR, appointment is not mandatory for our current processing activities. For all privacy enquiries, contact the address above.
3. Personal data we process
“Personal data” means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).
3.1 Public website (eng-hub.org)
When you browse the public website, we or our hosting provider may process:
- Technical access data: IP address, date and time of request, requested URL/path, HTTP method, status code, amount of data transferred, referrer URL, and browser/user-agent string (web server and security logs).
- Public snapshot content: Discord usernames/display names, aggregated activity counts (leaderboard), scheduled event titles and times, announcement text, and staff display names/roles — all from periodic JSON snapshots generated by our bot, not live database queries.
- Team page: staff display names and roles from a cached snapshot; profile images are self-hosted placeholders only (no requests to Discord avatar CDNs).
- Help centre: when you read articles, the same technical access data applies. If you log in as an authorised wiki editor, see section 3.4.
- Email contact: if you email us, we process your email address, message content, and any personal data you include.
On the public website we do not use:
- Analytics or advertising trackers (e.g. Google Analytics, Meta Pixel);
- Third-party font, script, or style CDNs on public pages (assets are self-hosted);
- Non-essential cookies or similar storage on ordinary browsing;
- Open, anonymous file-upload forms (legacy upload URLs redirect to our evidence guide).
We apply restrictive security headers on public pages (including Content-Security-Policy and X-Frame-Options) to reduce tracking, injection, and clickjacking risks.
3.2 Discord community
When you join or use our Discord server, we and our moderation tools may process data made available through Discord or generated in the community, including:
| Category | Examples | Typical purpose |
|---|---|---|
| Identifiers | Discord user ID, server ID, channel ID, role IDs, message ID | Moderation, logging, permissions, support |
| Profile data | Username, global/display name, server nickname (incl. history), avatar URL stored in our systems | Whois, search, identification, safety |
| Communication content | Truncated or logged message text, reactions context, voice join/leave events, timestamps | Statistics, investigations, rule enforcement |
| Moderation records | Warnings, notes, watchlist entries, ban/sanction data, staff actions | Server safety, appeals, audit trail |
| Direct messages to the bot | Message text, DM channel ID, sender ID | Support workflow forwarded to staff channels |
| Appeal/report data | Information you submit in tickets or appeal channels | Reviewing reports and ban appeals |
3.3 SCOUT moderation bot
SCOUT is operated for our Discord server. It reads and stores moderation-relevant data as configured by staff (logging, whois, search, statistics, watchlist, notes). Access to sensitive bot commands requires staff authentication. Processing is limited to what is necessary for operating a large moderated community.
3.4 Restricted internal areas (staff only)
Separate password-protected areas (e.g. internal moderation panels under /mod/ and
/bt/) are not part of the public website. Authorised staff who log in may
receive strictly necessary session cookies (HTTP-only, SameSite) to maintain authentication. These areas may
use different technical setups (including third-party libraries on staff login pages). Only authorised
personnel should access them. This policy’s public-website statements do not describe those internal tools in
full; staff use is governed by internal rules and access controls.
3.5 Help wiki editors
Authorised editors who sign in to maintain help articles receive a session cookie for authentication. Editor accounts (username, password hash, role) are stored locally on our server. Casual readers do not need an account and receive no login cookie.
4. Purposes and legal bases (Art. 6 GDPR)
We process personal data only where a legal basis applies. The main bases we rely on are:
| Purpose | Legal basis | Notes |
|---|---|---|
| Providing and securing the public website; detecting abuse and attacks | Art. 6(1)(f) — legitimate interests | Our interest in a stable, secure website; your interests are protected by minimal logging and short retention where possible. |
| Displaying public leaderboard, events, announcements, and team information from snapshots | Art. 6(1)(f) — legitimate interests | Community transparency and engagement; only aggregated or already public Discord profile names are shown. |
| Operating the Discord community and enforcing rules | Art. 6(1)(f) — legitimate interests; Art. 6(1)(b) where users request support | Necessary to protect members, investigate incidents, and run a safe learning environment. |
| Processing DMs and support messages sent to the bot | Art. 6(1)(b) — steps at the request of the data subject / pre-contractual | When you contact us for help, processing is necessary to handle your request. |
| Responding to emails and exercising data-subject rights | Art. 6(1)(c) — legal obligation; Art. 6(1)(f) — legitimate interests | GDPR compliance and communication with users and authorities. |
| Staff authentication in restricted panels and wiki editor login | Art. 6(1)(f) — legitimate interests | Protecting moderation tools and editorial content from unauthorised access. |
Where we rely on legitimate interests (Art. 6(1)(f)), we balance our interests against your rights and freedoms and process only what is necessary. You may object to processing based on legitimate interests (see section 12).
We do not generally process special categories of personal data (Art. 9 GDPR). Please do not share health, biometric, or other sensitive data in public channels or DMs unless necessary; if you do, we may delete or restrict it where appropriate.
5. Cookies and similar technologies
5.1 Public website
The public website is designed to work without non-essential cookies. We do not use cookie banners on public pages because we do not deploy analytics, advertising, or cross-site tracking technologies there.
5.2 Strictly necessary cookies
Strictly necessary session cookies may be set only when you:
- Log in to the help wiki as an authorised editor; or
- Access password-protected staff tools you are authorised to use.
These cookies are required for authentication and security (Art. 6(1)(f) GDPR; § 25(2) No. 2 TTDSG — no consent required for strictly necessary storage/access). They are typically session-based or short-lived, HTTP-only, and not used for tracking.
5.3 Browser storage
Some internal staff interfaces may use local or session storage for UI preferences (e.g. theme). This applies only to logged-in staff tools, not to ordinary public browsing.
5.4 Discord client
The Discord application and website set their own cookies and storage. Please refer to Discord’s Privacy Policy.
6. Sources of data
- From you: messages, reports, appeals, emails, and profile information you choose to share.
- From Discord: API and gateway events (profile updates, messages in logged channels, voice activity metadata, etc.).
- Automatically: server logs when you visit the website; bot logging as configured.
- From staff: moderation notes and decisions entered by authorised moderators.
7. Recipients and processors
Personal data may be accessed by:
- Authorised moderators and administrators — on a need-to-know basis for community safety and support.
- Discord Inc. (USA) — platform operator; data is processed when you use Discord and when our bot uses Discord’s API.
- Infrastructure host (ve.ms) — provides server hosting for this project free of charge. ve.ms processes technical hosting data (e.g. server logs, stored files) as an infrastructure provider. ve.ms does not control community content or perform editorial review. Abuse reports relating to hosting may be submitted via ve.ms.
We do not sell personal data. We do not share data with advertisers or data brokers. Processors act on our instructions only where applicable and must implement appropriate safeguards.
8. International transfers
Discord Inc. is based in the United States. When you use Discord or when our bot communicates with Discord’s API, personal data may be transferred outside the European Economic Area (EEA). Discord publishes information on international transfers and safeguards (including Standard Contractual Clauses) in its privacy documentation.
Website and bot data stored on our infrastructure is hosted within arrangements provided by our hosting provider. Where transfers outside the EEA occur, we rely on appropriate safeguards under Chapter V GDPR (e.g. adequacy decisions, Standard Contractual Clauses, or equivalent mechanisms offered by the recipient).
9. Retention
We keep personal data only as long as necessary for the purposes above, unless longer retention is required by law:
- Web server logs: typically days to a few weeks, depending on host configuration and security needs; then deleted or anonymised.
- Public JSON snapshots: overwritten each time the bot rebuilds them; not a permanent archive of all historical data.
- Bot moderation and activity logs: rolling retention, typically up to approximately 90–182 days depending on log type and configuration; older entries are deleted automatically unless needed for an ongoing investigation or legal hold.
- Moderation records (bans, serious notes, watchlist): may be retained longer where necessary to protect the community, defend legal claims, or handle appeals — balanced against your rights.
- Email correspondence: retained as long as needed to handle your enquiry and for reasonable documentation periods, then deleted unless legal obligations require longer storage.
- Wiki editor accounts: retained while the account is active; deleted or anonymised when no longer required.
When retention periods expire, data is deleted or irreversibly anonymised where possible.
10. Security
We implement appropriate technical and organisational measures under Art. 32 GDPR, including access controls for staff tools, HTTP-only session cookies where applicable, blocking public access to data directories, security headers on public pages, rate limiting on sensitive endpoints, and restricting file uploads on the public site. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.
11. Automated decision-making and profiling
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR that produces legal or similarly significant effects. Moderation decisions are made by human staff (possibly informed by bot logs and statistics).
12. Your rights under the GDPR
Subject to conditions and exceptions in the GDPR and BDSG, you have the following rights:
- Right of access (Art. 15): confirmation whether we process your data and a copy of relevant information.
- Right to rectification (Art. 16): correction of inaccurate personal data.
- Right to erasure (Art. 17): deletion where applicable (“right to be forgotten”).
- Right to restriction (Art. 18): limit processing in certain circumstances.
- Right to data portability (Art. 20): receive data you provided in a structured, commonly used format where processing is based on consent or contract and carried out by automated means.
- Right to object (Art. 21): object to processing based on legitimate interests; we will stop unless we demonstrate compelling grounds or need the data for legal claims.
- Right to withdraw consent: where processing is based on consent, withdrawal at any time without affecting prior lawful processing.
To exercise your rights, contact enghub@ve.ms. We may need to verify your identity (e.g. via your Discord account) before responding. We aim to reply within one month (Art. 12(3) GDPR); complex requests may be extended by a further two months with notice.
Note: Some Discord profile data (e.g. username) is controlled by Discord; you can also manage settings in your Discord account. Erasure on our side may not delete data held by Discord or other users’ screenshots outside our control.
13. Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement (Art. 77 GDPR).
In Germany, supervisory authorities are the data protection commissioners of the federal states (Landesdatenschutzbehörden) for most matters, and the Federal Commissioner for Data Protection and Freedom of Information (BfDI) for certain federal-level cases. A list of German authorities is available via the European Data Protection Board (EDPB).
We encourage you to contact us first at enghub@ve.ms so we can address your concern directly.
14. Discord and third-party services
Our community runs on Discord. Relevant third-party policies include:
Our website may link to external sites (e.g. Discord invites, documentation). We are not responsible for their content or privacy practices. Review their policies before providing personal data.
15. Children
Our services are not directed at children under 16 years of age (the minimum age for information-society consent in Germany under Art. 8 GDPR in conjunction with § 22 BDSG). We do not knowingly collect personal data from children under 16 without appropriate parental authority. If you believe a child has provided us data, contact us and we will take steps to delete it where required.
Discord requires users to meet Discord’s minimum age requirements in their jurisdiction. Parents and guardians should supervise minors’ online activity.
16. Obligation to provide data
There is generally no statutory or contractual obligation to provide personal data to browse the public website. However, operating in Discord and contacting support necessarily involves processing identifiers and messages you send. Without certain data, we may be unable to investigate reports, process appeals, or respond to your requests.
17. Changes to this policy
We may update this Privacy Policy to reflect legal, technical, or organisational changes. The “Last updated” date at the top will be revised accordingly. Material changes may additionally be announced on Discord or the website where appropriate. Continued use after publication of an updated policy constitutes acknowledgment of the changes where permitted by law.