Warden Privacy Notice

Warden is a moderation app for Root communities. It checks messages in the channels a community chooses against that community's rules, removes or holds messages that break them, steps in when the same members keep breaking them, and keeps a record of what its moderators do. This notice explains what Warden stores, why, who can see it, and how long it's kept.

Warden is run by Bit ("we" or "us"). Warden is an independent app. It isn't made or run by Root.

What we collect

Warden reads new and edited messages in channels a community leader has assigned to it in Root, under "Channel assignment" in the app's settings. If Root won't share that assignment, Warden checks every channel it can see instead, and its Overview says so. Most messages are checked and then forgotten. Warden only saves something when there's a reason to.

When a rule catches a message, Warden saves a case with:

• The message ID, the channel, and the author's Root user ID.
• The author's display name in the community at the time.
• Up to 500 characters of the message, so moderators can see what was caught.
• Which rule caught it, the part that matched (for example a blocked word or a link's site), and any strike points it added.
• When it happened, and whether a moderator kept or removed it after review.

When a moderator acts, such as a warning, time out, kick, ban, note, or removing strike points, Warden saves a case with the member's and the moderator's user IDs and display names, the reason the moderator gave, and when. Kicks and bans made with Root's own tools are recorded too, with who made them when Root says.

To run time outs, Warden saves which roles it took from the member, so it can give them back when the time out ends. It also keeps the end time of bans it knows about. If a timed-out member still manages to post, Warden saves a note with the member and the channel, at most once an hour per channel, so leaders can fix the timeout role.

Private messages to members. When Warden tells a member why it acted (for example "Message removed" with the reason and any strike points), it saves a copy so the member can read it again on their own status page.

When someone joins, Root tells Warden the new member's user ID and the roles they already have. If the community picked join roles, Warden keeps the member's user ID in a short waiting list until the roles are given, usually a few seconds, or until a join wave ends. If the community turned on the greeting, Warden posts it in the chosen channel, mentioning the new member by name. Normal joins aren't recorded. Warden saves a case only when something needs a moderator's attention: a join wave, or Root refusing a join role or the greeting (with the member it was for).

Settings. The community's Warden settings, word and link lists (with who added each entry and when), the names of watched channels, the join roles and greeting channel, the community's own versions of Warden's messages (with who last changed each one and when), who last saved settings, and which release notes the owner has seen. Each settings change, including every change to a message, is also recorded as a case listing what changed. To store members' private messages compactly, Warden also keeps a compression dictionary built from the community's own message wording.

Kept only in memory, never saved: a short fingerprint and time of each member's recent messages, used by the flood and duplicate rules and dropped within the rules' time windows; a member's roles, looked up only when a message mentions a role and a rule needs them; when Warden last posted a public notice about a member in a channel, so it doesn't repeat itself; the times of recent joins, to spot join waves; who was greeted in the last day, so someone who leaves and rejoins isn't greeted twice; and counts of join roles given or refused since Warden last started; the channels where timed-out members posted since Warden last started; and the IDs of Warden's own recent posts, so it never checks them.

Warden doesn't save direct messages, voice audio, reactions, attachments, or messages that don't break a rule. Messages typed into the Settings test box are checked and not saved.

How we use it

We only use this information to moderate the community it came from: to enforce its rules, to work out each member's strike points and the next step on its strike ladder, to show moderators the audit trail and member records, and to show each member their own standing. The Analytics tab shows counts worked out from the same saved cases. Nothing extra is collected for it.

We don't show ads. We don't use analytics or tracking tools. We don't sell this information or share it with anyone else. We don't use it to train AI models.

Who can see it

• The community owner and the roles or members a community leader picks in Root as Warden's moderators and admins. They can see the audit trail, member records, the review queue, and analytics. Only admins and the owner can change settings.
• Each member can see their own strike points, any running time out or ban, and the private messages Warden sent them, on their own status page. Members can't see anyone else's record.
• The member's notifications. When Warden acts, it can send the member a Root notification with a short reason. If the community turns on public notices, Warden also posts a short line in the channel saying the member's message was removed and why. The community decides the wording of these messages; Warden fills in the details when it sends them and never names the moderator who acted.
• Greetings. If the community turns on the greeting, everyone who can read the chosen channel sees it, with a mention of the new member. Warden's messages never ping @everyone, @here, or roles.
• When something changes, Warden tells open copies of the app that something changed. Each person's app then asks for the details, and only people with access get them.
• Root hosts Warden and its database. Each community gets its own separate copy. Root's Privacy Policy covers how Root handles hosting and backups.

Warden data isn't end-to-end encrypted.

How long we keep it

• Each community picks how long history is kept under "Keep history for" in Warden's settings: 30, 90, 180, or 365 days. The default is 90 days.
• Cases and members' private messages are removed once they're older than that. Strike points stop counting sooner if the community sets a shorter window for them.
• Ended temporary bans are forgotten at the next cleanup. Saved roles are deleted when the time out ends and the roles are given back.
• A new member leaves the join roles waiting list as soon as their roles are given, when they leave or are banned, or after a day at most.
• A compression dictionary is deleted once no saved private message needs it. The community's own message wording is kept until an admin changes it or goes back to Warden's default.
• Warden keeps its database under 490 MB. If it gets that big, the oldest private messages and then the oldest cases are removed early. If it ever reaches 495 MB, new cases are saved without the message text and members' copies of private messages aren't kept, until there's room again.
• The community owner can clear the whole audit trail at any time from Warden's Settings tab. That deletes every case and every private message copy immediately and can't be undone.

Cleanup runs every hour while Warden is running. If it's paused, cleanup picks up again when it restarts. Deleted records are overwritten in the database file, not just unlinked.

If a community removes Warden, Root deletes that community's Warden data. Root's own backups follow Root's policies.

Your choices

If you're a member of a community that uses Warden, you can see your own record on your status page, and you can ask that community's leaders which channels are watched, how long history is kept, or to remove strike points they think were given in error. They can shorten the retention period, and the community owner can clear all saved history.

You can also ask us in Warden support on Root for a copy of your data, to fix something, or to have it deleted.

Changes to this notice

If we change this notice, we'll update the effective date at the top and post about it in Warden support on Root.

Contact

Bit
Support: Warden support on Root

For questions about your Root account, contact Root Support.