Defendr 网络
Defendr 维护一份网络名单，收录在多个服务器上传播钓鱼链接、有害文件或盗号企图的账号。它自己的条目需要证据和两名审核人。此外，它会自动接收 ScammerAlert 社区名单的条目，不作核实，并如实标注。目前每个条目都只是提示：你的版主会在日志中看到中立的说明，不会自动发生任何事。在“全局网络”页面，你决定服务器是否使用已审核的条目，以及是否显示 ScammerAlert 提示。
Defendr 保留什么、保留多久
Defendr 存储的每一类数据、保留时长和删除方式、网络条目的规则，以及保护的局限。
保留期限
由删除任务读取的同一登记表生成，因此本表与实际删除永远不会脱节。
表格以英文显示；以德文版为准。
| 数据 | 保留期限 | 删除方式 |
|---|---|---|
| Temporary personal web-export copies and one-use delivery state | At most 15 minutes of access; keys removed immediately on completion or revocation; encrypted copies removed later in bounded cleanup batches | per-export key disposal on completion, failure, logout, erasure or restore; expiry checks and bounded cleanup |
| Website access logs (time, path template, status, duration, random request ID; no addresses or content) | 14 days, earlier when the storage budget is full; a stopped web server's logs are deleted by a daily task, up to one day later | pruning by the web server at its start and every minute; for a stopped web server the daily task -PruneLogs |
| Website event log (server errors by page and error type, missing texts, failures and refusals between the website and Defendr, failed sign-ins by reason, counts of access-log records dropped, and of access-log files deleted early with the minute their records start; no person, address, URL, cookie, content or session) | 14 days, earlier beyond 4 MiB (the oldest first); a stopped web server's log is deleted by a daily task, up to one day later | pruning by the web server at its start and every minute; for a stopped web server the daily task -PruneLogs |
| Website tunnel log on our server (cloudflared): only errors that stop the connector itself (log level fatal) and warnings about its own connection to Cloudflare (transport log level warn); no requests, requested addresses or IP addresses of visitors | no automatic deletion after a fixed period yet | manual deletion by the operator |
| E-mails to the @defendr.live addresses (contact@, privacy@, security@, including vulnerability reports; Gmail mailbox) | deleted once no longer needed for the request, at the latest three years after the request is closed, unless a legal duty requires longer | manual deletion in the mailbox |
| Website sessions and encrypted OAuth access tokens | 7 days without activity; at most 30 days | logout, erasure/restore invalidation and retention.purge |
| Website security events (sign-in, sign-out, sign out everywhere, ending one other session, a sign-in Defendr undid after Discord had confirmed it; device category and time; no addresses) | 365 days | retention.purge; erasure |
| Receipts of website actions (route, state, result code, times; the request and its idempotency key only as hashes) | 365 days after the action finished | retention.purge; erasure; guilds.purge for server actions |
| Website and account preferences (language, whether Defendr messages follow it, inbox read marker, theme, accent, density, motion) | until the account data is deleted (no time limit); removed on request | erasure |
| Security score history per server (weekly score and part scores, no user IDs) | indefinite (aggregates); with the server's data after Defendr leaves | guilds.purge |
| Message content during scanning | Seconds (memory only) | not stored |
| Detection records (ids, type, action; no message content) | 1825 days | retention.purge |
| Moderation cases (+ events) | 1825 days (owner-set, identical in every server) | retention.purge |
| Message excerpts (opt-in per server) | at most 1095 days, never longer than the case | purge (sealed; crypto-shredding) |
| Uploaded evidence (staff uploads on Safety Records and cases) | 1095 days; record evidence with the record; legal hold suspends deletion; nothing a member attaches is stored | purge + file unlink (crypto-shredding) |
| Reports and co-reporter links | accepted: 1825 days after decision; rejected/spam: 365 days; pending: auto-closed after 90 days | purge |
| Reporter reputation | 1825 days after last report | purge |
| False-positive signals (moderator id, case) | 1095 days | purge |
| Review votes and staff threads | with the reviewed item | purge (+ thread deletion) |
| Appeals (incl. recommendations) | 1825 days after decision or lapse | purge |
| Support tickets (form text sealed; the private thread in the support server) and ticket bans | 1825 days after closing (row and thread); a ticket thread left without its record (after a failed creation or a restore from a backup) is deleted 1825 days after it was created (possibly locked and archived before then) — because no record links it to a member, the team deletes it by hand on an erasure request; ticket bans until lifted | support.tickets (thread first, then the row; a thread without a record by the list of the job, kv.support.orphans); a ban is deleted when lifted |
| Direct-message conversations with Defendr (user ID, the post in the staff channel, time of the last message, muted or not; never the text) | 1825 days after the last message; within an hour of an erasure | ops.dm-chats (the post first, then the row) |
| Data subject requests; processing restrictions | 1825 days (accountability; content minimized and sealed); restrictions 1825 days after lifting | purge |
| Active network listing | no automatic expiry; re-review reminder after 12 months (a status change always needs a staff decision) | re-review reminder + purge 1095 days after close |
| Quarantined imported listings (811 + 4) | until reviewed; reminder after 6 months (OD-7) | review decision |
| Closed Safety Records (revoked/rejected/expired) | 1095 days | purge |
| Member flags: hijacked account / raid cohort / network hint shown | 72 hours / 7 days / 30 days | member-flags.expire |
| Member flag: pending verification | at least 24 hours, as long as the server's kick-unverified delay + 1 hour | member-flags.expire |
| Member flags: join-gate quarantine role / suspect role applied by Defendr | while the role is held; 30 days after leaving | reconcile jobs + member-flags.expire |
| Raid cohorts (metadata only) | 365 days | purge |
| Incidents | 1825 days | purge |
| Anti-nuke role strips / structure snapshots / deleted entities (2.1) | 30 / 7 / 14 days | purge |
| Lockdown records | 1095 days after end | purge |
| Verification challenges | 24 hours | purge |
| Interactive UI state (sealed) | ≤ 24 hours | ui_state.purge |
| Pending messages (outbox) | content wiped when sent or given up; rows 7 days (sent) / 30 days (failed) | purge |
| Config revisions; preset and migration card decisions | last 100, max 1 year; decisions 90 days | purge |
Audit log (ops_audit): staff access incl. evidence views, and each website action (user ID, action, server, time, outcome, receipt and request ID) | 1825 days; kept on erasure (accountability) | purge |
| Staff membership | 1825 days after deactivation | purge |
| Anonymous network signals (2.1) | 48 hours | purge |
| Premium entitlements (2.2) | 30 days after end | purge |
| Application logs (no content) | 90 days | rotation |
| Global mirror (#global-logs, staff channel): ids, action and event types, counts and times of Defendr's actions and of the moderation, report and appeal events handled through it (moderator and staff ids included), the names Discord showed for the server, the channel, the member and the moderator or staff member at that moment, and the listed threat value a link or invite Defendr detected matched; never message content | kept until the operator deletes it (owner-set retention, decision of 2026-09) | operator (Discord channel) |
| Error events (redacted) | 365 days | purge |
| Statistics aggregates (no user IDs): counts per day, server and metric, incl. per reason code and per detection family | indefinite | — |
| Setup answer "Where did you find Defendr?" (per server, optional; not assigned to a person) | with the server's configuration: 90 days after Defendr leaves (or immediately if configured) | guilds.purge |
| All guild data after Defendr leaves | 90 days (or immediately if configured); cancelled by re-invite | guilds.purge |
| Local backups | 14 daily / 8 weekly / 6 monthly | prune |
| Offsite backups (encrypted) | 14 daily / 8 weekly / 12 monthly | restic forget/prune |
| v1 history dossiers | not migrated; destroyed at v1 decommission (T+30 d, encrypted archive destroyed after 90 d) | owner runbook |
网络条目的规则
一条记录是怎么运作的
条目需附证据提出，由两人审核，之后生效十二个月，并在结束前两周重新审核。名单上的任何人都可以申诉；申诉期间条目被冻结。ScammerAlert 名单的条目不经审核自动接收，仅作为警告显示；Defendr 从不因此自行采取任何操作，版主在加入卡片上选择的封禁或踢出是该版主自己的案件。当 ScammerAlert 撤回或删除条目时结束。
Defendr 做不到的事
- 它无法查看或保护没有访问权限的频道。
- 没有任何保护能拦截一切。Defendr 以精准为先，因此可能有诈骗漏网，而误判可以撤销并申诉。
- 它从不对服务器所有者采取行动。
Cookie 与存储
Section 25(2) no. 2 TDDDG (strictly necessary for the service you explicitly asked for); no consent needed
| 名称 | 用途 | 保留期限 |
|---|---|---|
| __Host-sid | keeps you signed in after you sign in | until you sign out; at most 30 days (the session ends after 7 days without activity) |
| __Host-oauth | protects the Discord sign-in against forgery and replay | 10 minutes; deleted after the sign-in |
| __Host-lang | shows the website in the language you picked | 1 year or until you change it |
| __Host-theme | shows the website in the colour scheme you picked | 1 year or until you change it |
| __Host-motion | turns animations off or on as you chose | 1 year or until you change it |
| __Host-accent | shows the website in the accent colour you picked | 1 year or until you change it |
| __Host-density | shows lists and tables as dense as you chose | 1 year or until you change it |
| defendr.setup.v1.<Server-ID> | so that reloading the page does not discard your answers; nothing goes to Defendr before you press "Check and finish" | until the setup is saved, you press "Cancel setup" or you close the tab |
| __cf_bm | protecting the website against bots and attacks | 30 minutes |
| cf_clearance | spares you the check on every page view | as set in Cloudflare, 30 minutes by default |
| _cfuvid | fair request limits per visitor | until you close the browser |
| cf_chl_* | runs the security check | only during the check, at most until you close the browser |