GDPR Compliance
Your data-protection rights and how to exercise them.
GDPR and your rights
Mellow is a small open-source project. This page explains what data is processed, the legal basis for it, and how to exercise your rights. It is not legal advice, and if you self-host Mellow you are the data controller for your instance.
Data processed
| Category | Examples | Basis |
|---|---|---|
| Account | Discord user ID, username | Necessary to provide the service you requested |
| Preferences | personality, timezone, reminder and privacy settings | Necessary to provide the service |
| Wellbeing content | check-ins, coping records, journal, gratitude, ghost letters, coping plan | Consent, by using the feature |
| Conversation history | messages stored for AI context, if context_logging is on | Consent (/preferences set context_logging:false to withdraw) |
| Crisis events | recorded when crisis screening flags a message | Legitimate interest in user safety |
| Guild settings | per-server configuration | Necessary to provide the service to that server |
Sensitive fields are encrypted at rest (see
).Your rights
- Access -
/context view,/preferences view,/profileshow what is stored. For a full copy, ask the team. - Rectification - change your data with
/preferences setand the relevant commands. - Erasure -
/context cleardeletes conversation history; other commands delete individual records; for full deletion, contact the team. - Restriction / objection - turn off
context_loggingandcrisis_detectionin/preferences set. - Portability - request an export from the team; it is provided as JSON.
- Withdraw consent - at any time, via the preference toggles above.
Exercising your rights
- In Discord:
/preferences,/context,/profile. - Contact: [email protected], or the support server, or a GitHub issue.
Requests are handled by the maintainer on a best-effort basis, normally within 30 days.
Processors
- Discord - the platform Mellow runs on.
- Anthropic - processes messages sent to AI features. Anthropic does not train on API data.
Retention
Data is kept until you delete it or request deletion. Crisis events are kept for safety follow-up. System logs are short-lived and operational.
Self-hosting note
If you run your own instance, you control the database and are responsible for GDPR obligations for your users, including responding to their requests and reporting any breach to your supervisory authority.