Privacy

Reviewed 14 October 2026

Linky is a Discord bot operated by Victor Ivanov. This policy describes the hosted Linky bot. If you run the open-source software yourself, your hosting and data-handling choices apply to that instance.

Messages and attachments #

Discord sends Linky messages and metadata from channels the bot can access. Linky checks whether link fixing is enabled before processing a message for reposting. It uses message text, links, author and explicitly mentioned user IDs, reply references and attachment details to create a reply or replacement with attribution. It also receives command, component and permission information when someone uses its commands or buttons. A manual /fix or Apps → Fix with Linky action processes the supplied link or selected message; personal installation does not enable passive DM processing.

Message text, translated text and copied Discord attachments are handled in the bot's memory. Discord's client library can also cache messages in memory while the bot runs. Linky does not create a separate message archive. The public hosted bot does not prepare new Erome media. Previously published media follows the retention and cleanup described below.

Replies, replacements, copied attachments and translation files are sent back to Discord. They remain Discord messages until deleted and are subject to Discord's own storage and privacy practices. Reply mode keeps the original and its attachments. Replace mode deletes the original only after Linky's replacement checks succeed. Sending and deleting are separate requests, so an error can leave both messages visible. YouTube statistics and comment excerpts have the separate cleanup process below.

Saved server settings #

Linky stores a Discord server ID, enablement, selected channels, posting mode, platform and translation preferences, and YouTube display preference in a settings file so choices survive restarts. The operator can also configure server and channel IDs for existing restricted installations.

Disabling Linky stops reposting in that server; it does not erase the saved setting. Removing the bot does not automatically erase the setting either. Contact the operator if you want stored configuration reviewed or removed.

Repost ownership and synchronization #

Linky saves source and replacement message IDs, author ID, channel and server IDs, posting mode and pending cleanup IDs. This journal supports owner-only Remove actions and keeps replies synchronized with edits and deletions. It contains no message text. Ownership records expire after 30 days, with a 10,000-record limit; pending cleanup can remain longer for retry. Old records are pruned as the bot operates. Removing Linky does not itself erase the journal or Discord messages.

Recent preview observations are kept in process memory as provider-level success/failure counts and timestamps. They contain no message text, links or server IDs. They are used by diagnostics and are lost on restart.

Provider recovery also keeps keyed fingerprints of public posts in memory to distinguish one repeatedly retried post from failures across different posts. These records contain no raw post URLs, captions or Discord IDs. Each provider and preview mode holds at most 128 fingerprints. Evidence qualifies for ordering decisions for 15 minutes and is pruned on later use; a bot restart clears it. This state is not written to disk or sent to the website analytics collector.

Private delivery details #

Linky saves a bounded local history for Details. On a public preview, channel members can open its delivery outcome and timings in a Discord reply visible only to the person clicking. Details on private responses or in DMs remain requester-only. Records contain a random attempt ID, requester, channel and server IDs, the bound output message ID, platform, automatic/manual mode, delivery path, timestamps, stage durations, an observed cache hit or miss when available, and a fixed outcome. They contain no message text, source or media URLs, video bytes, API credentials or arbitrary error text. Stage timings can overlap. A metadata confirmation records Discord's response, not playback on a person's device.

Records are available for up to seven days from the attempt, with a maximum of 4,096 attempts and a 4 MiB history file. Capacity limits can remove older records sooner. Expired records are pruned during operation and on startup, with hourly maintenance while the bot runs; outages or storage failures can delay physical removal. A restart retains completed records when storage is available and marks unfinished attempts as interrupted. Every Details lookup requires the exact bound bot message, channel and server; a button copied elsewhere cannot open the record. Private-response and DM records also require the original requester.

Self-hosted media preparation can show a stage update in the automatic reply or manual command response. Additional album-button progress is private to the member who clicked. These updates describe work such as queueing or downloading and do not include raw provider errors. The history stays on Linky's bot host and is separate from the inactive product-analytics adapter described below.

Operator delivery archive #

A separate archive on the Hostinger bot host supports daily reliability reviews. It stores a random attempt ID, timestamps, platform, automatic/manual mode, delivery path, a fixed outcome, elapsed and stage timings, and observed cache hits or misses. It does not store Discord user, server, channel or message IDs, message text, captions, source or media URLs, file bytes, credentials or arbitrary error messages. An attempt ID can connect an archived record to a Details investigation while the latter is retained.

The hosted archive retains up to 30 days within a 64 MiB cap; high volume can remove records sooner. Daily files and maintenance enforce the limits; removing a UTC day can expire its oldest records early. Outages or storage failures can delay physical cleanup. Storage failures, shutdowns or a full queue can leave gaps; the operator report includes coverage and loss information. This archive is private to the operator, is not a public HTTP endpoint and does not broaden who can open Discord Details. It remains on the bot host, separate from the optional website analytics adapter.

Operational logs #

The hosted bot writes operational logs to help diagnose failed replacements, permissions and connection problems. They include timestamps, server and channel IDs, original and replacement message IDs, and error details. Startup logs can include configured server and channel IDs.

Routine success logs do not include message text or attachment bodies. Since 15 September 2026, Linky's error logger records only an allowed error type, numeric API code, HTTP status, known system error code and HTTP method where available. It omits error messages, stacks, request bodies, URLs and attachment bytes. Logs created before that change may contain failed Discord request content until the older files rotate out or are removed. This change does not erase historical logs or change the hosting provider's own logging.

Current Docker logs rotate by size, with up to three files of about 10 MB each per container. This is not a fixed retention period in days; how long a record remains depends on logging volume and container operation. No fixed age-based expiry is configured for these logs.

Preview and translation services #

Linky changes supported links to preview-service URLs: fixupx.com or vxtwitter.com for X, fkinstagram.com (Instagram7) or oginstagram.com for Instagram, tnktok.com for TikTok, bskx.app or fxbsky.app for Bluesky, vxreddit.com for Reddit, fxtwitch.seria.moe for Twitch clips and facebed.com for Facebook Reels and videos. Some translated media uses g.fixupx.com. Discord or your client may request these URLs and their media redirects to display or open a preview. Those services process the requested post URL under their own practices. Reddit app shares that Reddit refuses to resolve can also be looked up through rxddit.com, as described under mobile shares.

When English tweet translation is enabled, Linky sends the tweet's status ID to the FxEmbed API at api.fxtwitter.com and requests an English result. That request does not include your surrounding Discord message, Discord account ID or server ID. The API returns the post's text, author details and media references for Linky to display. The service can see the bot host's network request information.

Linky downloads attachments from the URLs provided by Discord when copying a message and uploads the copies to Discord. The bot runs on a Hostinger-hosted server. Discord, the hosting provider and preview and lookup services have their own infrastructure and privacy practices, which this policy does not replace.

Public article previews #

When article processing is enabled or you explicitly request an article fix, Linky requests the public HTTPS page without cookies or signing in. The publisher and any allowed redirect destinations receive the requested URL and the bot host's network information. Linky sends no surrounding Discord message, Discord account ID, server ID or channel ID. Requests are limited in time and size, and private network destinations are rejected.

Linky reads publisher-supplied article metadata: headline, publisher, description and optional image URL and publication date. It does not use an AI summarizer, send article text to a translation service or bypass access restrictions. The resulting card is sent to Discord, whose media service may request the publisher's image. Posted cards remain Discord messages until removed.

Successful lookups can remain in a bounded memory cache for up to five minutes; failed lookups for 15 seconds. The cache contains article URLs and parsed metadata, not Discord identifiers. Entries expire on later use, eviction or restart. Linky does not save a separate article-content archive. Delivery Details and the operator archive follow their separate limits above and do not store article text or URLs.

An admin can turn off article processing with /settings articles:false. Members can use the same /autofix and single-message bypass choices described below.

Mobile shares and personal auto-fix preference #

Instagram, Reddit, TikTok and Facebook share links can require a redirect lookup. Linky requests the shared URL from the platform and follows only allowed public HTTPS redirects on that platform, without cookies or account sign-in. For Facebook /share/r/ and /share/v/ links, this is a cookie-free request to facebook.com. If Reddit refuses an app-share lookup with HTTP 403, 429 or a server error, Linky sends the share path, without its query string, to the third-party FixReddit resolver at rxddit.com and uses the result only if it redirects to a Reddit post. The platforms, and rxddit.com when that fallback runs, receive the requested URL or share path and the bot host’s network information, not surrounding chat text, cookies or Discord identifiers.

/autofix enabled:false saves your server/account ID pair on the bot host so your automatic-fix choice survives restarts. The response is private. The file contains no message content and is limited to 1 MiB and 10,000 pairs; it does not silently expire your choice. /autofix enabled:true removes the pair. Leaving a server does not itself erase your preference, so it can apply if you return. Removing Linky clears that server’s pairs when the bot receives the departure or next connects successfully. Operator backups require separate deletion. Manual commands and explicit retries remain available.

Optional Instagram caption translation #

Instagram caption translation is optional. Run /settings in your server to check whether the operator has made it available and whether your server allows it.

When enabled by the operator and allowed by the server's settings, Linky requests the public post's full caption, author and media details from Instagram7 at fkinstagram.com using its post code. Linky sends caption text to Google Cloud Translation Basic to request English. These requests do not include your surrounding Discord message, Discord account ID, server ID or channel ID. The caption itself can contain names or other personal information written by its author. Instagram7 and Google receive the bot host's network request information; Google also receives the operator's API credentials.

This feature translates the written post caption. It does not read text inside images, transcribe audio or video, or translate general chat. Manual /fix and Apps → Fix with Linky actions do not request caption translation. Linky posts a single-paragraph excerpt of up to 300 visible characters, including an ellipsis when shortened, with the author and source-language label. It does not add a full-caption text attachment. This display limit does not shorten the caption sent to Google for translation. Media previews use the caption-free gallery mode at g.fkinstagram.com or g.oginstagram.com, whose media requests follow the preview-service handling above. When translation is unavailable, native captions remain controlled by the preview provider.

Caption and translation results are cached in memory for up to five minutes. A separate usage file stores only the budget date and reserved character count, with no captions or Discord IDs. The default limit is 15,000 characters per day, resetting at midnight Pacific time. If the caption lookup or translation fails, or the budget is exhausted, Linky continues its normal preview checks without a translation. A missing media preview still keeps the original message.

Server admins can disable this feature with /settings translate_instagram:false. It does not require members to connect a Google account. Google's handling of translation requests is described in its Cloud Translation data usage FAQ.

YouTube metadata #

When YouTube extras are enabled and an eligible link is shared, Linky sends its video ID to the YouTube Data API for available public counts and, if configured, one public comment selected by YouTube's relevance order. Preview-only and manual fixes make no statistics requests; counts-only skips comments. Button clicks can request a recent snapshot. These requests do not include your surrounding Discord message, Discord account ID, server ID or channel ID. Google receives the bot host's requests and API credentials. Linky does not ask members to authorize a Google account or access private YouTube data.

The bot caches returned metadata in memory for up to five minutes. Compact counts appear on buttons below the native video. Clicking counts or Top comment opens a private reply with the available information. These values are snapshots, not live counters.

Before publishing buttons, Linky saves message and channel IDs, video IDs and an expiry time. Older records can contain a companion-card message ID or character lengths for legacy cleanup. The file contains no message text, counts or comments. After 24 hours, Linky removes the public YouTube buttons while retaining the video and other controls; expired buttons cannot request new details. Private replies already shown follow Discord's handling of ephemeral messages. Cleanup runs at startup and periodically. Permission changes, removal of the bot or an outage can delay public cleanup; failed records remain for retry. Contact the operator about an inaccessible message that needs removal.

Public YouTube community previews use a separate, cookie-free request to the public /post/ page. YouTube receives the post URL and host network information; Linky sends no Discord IDs or surrounding text. Parsed creator, text and image URLs use a bounded memory cache. Results may be reused for up to one minute (failed lookups: 15 seconds); expired entries are removed on later lookups, eviction or restart. Posted cards remain Discord messages until removed. Private, members-only and unsupported post formats are not fetched through an authenticated account.

YouTube's own privacy practices apply to its services. See the Google Privacy Policy and YouTube Terms of Service.

Analytics #

The deployed bot described by this policy does not send a separate product-analytics event stream. Operational logs and saved server settings still exist as described above. A future analytics feature will be described here when it is introduced.

This website #

The appearance selector saves your System, Light or Dark choice in this browser when local storage is available. System follows your device's appearance setting. This preference is not sent with website analytics.

This website records daily page-view and invite-button counts, grouped by page and a broad source category such as Google, ChatGPT or GitHub. These counts are not unique people and do not connect a visit with a Discord installation. Linky's measurement code does not set cookies, create visitor IDs or store full referrers, IP addresses or user agents. It honors Do Not Track and Global Privacy Control.

This website is hosted on Vercel. Its measurement requests pass through Vercel to an existing collector hosted through OpenAI Sites on Cloudflare. Linky forwards only the measurement event, without browser cookies, IP addresses, user agents or full referrers. These hosting providers have their own technical request processing and logging. Linky's database uses a 90-day reporting window. Expired rows are removed on the next measurement, report or maintenance operation; an idle database may retain expired rows until that operation. No fixed hosting-log or backup expiry is claimed here.

The separate bot-event collector is implemented for a future rollout, but the hosted bot currently sends no events to it. Public rollout will update this policy to describe its pseudonymous server keys and operator controls.

Your choices and requests #

An administrator with Manage Server can use /setup to select channels or disable Linky, and /settings to choose Reply mode, disable platforms or translation, and select YouTube display. Members can use /autofix for a persistent per-server opt-out or include !nolinky to skip a message. Only the original sharer or manual requester can use Remove on their preview. Moderators retain Discord's native moderation tools. /help reports current channel scope. Disabling new YouTube processing stops new button lookups but does not stop cleanup of previously posted extras while Linky retains access.

Erome video preparation #

The public hosted bot no longer prepares new Erome previews. Existing hosted files and message bindings retain their cleanup lifecycle; disabling new processing does not erase files already shared with Discord. The preparation described below applies to self-hosted instances and explains the earlier hosted data flow. Self-hosted operators are responsible for their own storage, workers and data handling.

On a self-hosted instance, an Erome album supplied in an allowed server channel causes Linky to request the album page and the selected video or JPEG/PNG image from Erome. It starts with the first video, or the first supported image in an image-only album. When that instance provides media hosting, Load next item requests one further item when an eligible channel member asks. Members need permission to view and send messages, with no active timeout. The default channel policy allows age-restricted channels; a server admin can allow ordinary channels with /settings erome_channels:all. This preference applies to automatic and manual previews; DMs remain excluded. Linky sends the album URL as the media request's Referer, without Discord account IDs, server IDs or surrounding message text. Erome receives the bot host's request information. Linky does not request search results, related albums, avatars or video posters.

Video preparation and image validation use private directories in the bot container's memory-backed temporary storage. The directory is removed when the process finishes, fails or is cancelled; stopping the container also clears this storage. The scheduler retains its resource allowance until cleanup finishes and stops admitting work if cleanup fails.

Attachment requests for the same canonical album, selected item and output budget share a preparation job. Linky retains at most 32 successful attachment variants, their canonical album URLs, item fingerprints and output budgets in process memory for five minutes from completion, with a maximum of 128 MiB of cached media. Different upload allowances use separate variants so a larger file is not returned to a smaller-limit request. Timers remove expired entries; eviction or a bot restart can remove them sooner. This cache is never written to disk and does not include Discord account or server IDs. Failed preparations are not cached. Each request must still pass its own channel eligibility checks before delivery.

The attachment path does not maintain a persistent media archive or log album/CDN URLs. The preview is uploaded to Discord and remains there until removed, under Discord's storage practices. Automatic Erome previews follow the server's posting mode: Replace deletes the original Discord message only after complete preview and attachment checks and final source and settings checks; Reply keeps it. Manual fixes and Retry keep the source message. Attribution and source album links remain in the repost. Failed checks, changed messages or missing permissions preserve the source.

For hosted original videos, Linky downloads compatible files of up to 24 MiB through the bot host and regional workers on Vercel. The workers receive the source video and album URLs and portions of the video, without Discord account IDs, server IDs or surrounding message text. Hosted JPEG/PNG images of up to 8 MiB are downloaded by the bot host. Erome receives requests from those hosting services. Linky validates the complete file before making its hosted URL available to Discord. Original delivery retains the source file's bytes, including any metadata inside the file.

Hosted MP4, JPEG and PNG files are saved on the bot host with random media IDs. Storage records include each file's type, size, content hash, creation time and the Discord preview message IDs bound to it. Files are retained while they have preview bindings. Confirmed removal of a preview releases its binding; a file is deleted after its last binding is released. Storage or Discord failures may delay cleanup. Automatic preview removals have a saved retry record; failed cleanup of a manual preview may need operator assistance. Files without preview bindings become eligible for cleanup after 15 minutes. A short reservation protects an in-progress publication from cleanup. The store admits at most 4,096 files and 10 GiB; it can reject new preparation when full.

Hosted reuse first checks the current album and source headers, including the file size and strong validator, then checks the stored file's type, size and complete content hash. An in-memory cache holds up to 64 metadata entries eligible for reuse for five minutes; expired entries are removed on access, eviction or restart. A separate private index allows reuse across restarts. It stores keyed digests of the album/source/validator identity, media IDs, hashes, sizes, types, native dimensions, video duration/frame rate and last-use times. It stores no raw album or source URL and no Discord IDs. The index is capped at 1,024 entries and 2 MiB. Entries expire seven days after their last use. Expired descriptors are removed during index activity, on startup and by minute-by-minute maintenance while the bot runs; outages or storage failures can delay physical removal. Removing an index entry does not keep or delete the media file: preview bindings govern file retention.

An active Load next item session keeps the requester, server, channel and output/source message IDs, canonical album URL, ordered item fingerprints, and loaded media URLs/sizes in process memory. Sessions last up to 24 hours, with at most 512 sessions, and expire sooner on eviction, removal or restart. Each gallery is limited to 10 items and 192 MiB total. A session expiry stops further loading; it does not remove already published items or their durable preview bindings. Eligible channel members can add items, subject to current channel policy, permissions, timeout checks and existing rate limits. Their clicks do not change the session's original owner or transfer Remove access. After a successful automatic replacement, the session uses its owner and output binding without requiring the deleted source message. Reply and message-context sessions retain source checks.

The hosted media URL is accessible to anyone who has it, including Discord's media service. Linky does not upload a second attachment for that delivery mode. Messages with source attachments to copy use attachment delivery instead. Removing Linky's hosted file does not erase copies already held by Discord or another recipient. The same Erome channel policy and Replace/Reply behavior apply to both delivery modes.

For privacy questions or deletion requests, email victor.n.ivanov@gmail.com. Include the server ID and a short description of the request. The operator may need to confirm that you are authorized to make a request for that server. Do not send bot tokens or unnecessary private messages.

Deleting a stored setting does not delete messages already sent to Discord. Requests involving Discord messages, accounts or provider-held data may also need to be made through the relevant service. The operator will explain what can be removed from Linky's own systems and any limits affecting the request.

General, non-sensitive bugs can be reported in GitHub issues. Issues are public; use email for private information and security reports.

Policy changes #

This page will be updated when Linky's data handling changes. The date at the top identifies the version you are reading.