Privacy Policy — M&F Bot

Scope and operator

M&F Bot is an independently operated community chatbot for M&F YouTube and Kick livestreams and the associated Discord community. This Privacy Policy applies when you interact with M&F Bot in YouTube or Kick live chat, communicate with it on Discord, link your supported platform identities, use the M&F Bot command guide, or access your private M&F Vault collection page.

M&F Bot is operated by an individual in the United States. Questions and privacy requests can be sent to the address in the Contact section.

Information we collect

Public platform and chat information

When you participate in a monitored livestream, M&F Bot may process your public YouTube channel ID, channel name, profile image URL, public live-chat messages and commands, message ID, livestream or room identifier, and message timestamp. When you interact on Discord, it may process your Discord user ID, username, display name, avatar URL, channel identifier, command content, and timestamp. Ordinary server messages can register activity without their message body being saved in the bot database. Kick interactions may include your numeric Kick user ID, username, chat content, message ID, broadcaster identifier, and timestamp. Only explicit !ai, !bot, !mnf, or !chatgpt commands and their prefixed follow-ups request a conversational reply from the locally hosted language model; ordinary greetings and mentions do not trigger it.

Bot account and activity information

The bot creates a community account associated with your platform identity. It may store your virtual-coin balance and transaction history, Discord and Kick activity time, preserved historical YouTube active-chat and last-seen records, daily streaks, ranks, game activity and statistics, collectibles, fishing progress, virtual pets, rooms, titles, community-goal contributions, cooldowns, and other bot progress. Discord and Kick active-chat time and periodic activity rewards operate independently and do not require a linked YouTube identity. YouTube message rewards, including commands and emoji-only posts, credit up to 10 virtual coins once per five minutes, with a 500-coin daily cap before reward tax across linked YouTube identities and monitored streams. Empty posts, stale messages, and messages repeating any rewarded content from the preceding 30 minutes are excluded. The reward ledger records a message-derived fingerprint, transaction timestamp, source-message idempotency key, and credited amount to prevent duplicate rewards, enforce cooldowns, and apply the daily cap; it does not measure whether or how long someone watched. No coins accrue during silence. New YouTube chat-time tracking remains paused and YouTube time-based public rankings remain hidden.

Optional birthdays

If you choose to use !birthday set, we temporarily store the month and day you provide and, optionally, your birth year for confirmation. The bot spells out the date and requires !confirm within 10 minutes before saving it to your public profile and starting the 365-day edit limit. Cancel with !birthday cancel. Confirmed birthdays are public to other users of the bot; providing a year also makes your age public. Birthday commands sent in public chat are visible there. Linked accounts share birthday settings and yearly gift limits. We store edit and gift timestamps to enforce those limits. Use !birthday remove at any time to delete the stored birthday and birth year; the edit and gift limits remain in place. The self-service data-deletion process also clears this profile information. Birthdays use Pacific time.

Linked identities

If you choose to link Discord with YouTube or Kick, the bot stores the platform identifiers needed to associate those identities with one M&F Bot account. One-time linking codes expire after 10 minutes and cannot be reused after a successful confirmation.

Vault access information

If you use M&F Vault, the service stores hashed one-time login codes and hashed browser-session tokens so it can securely display your own bot profile and collections. A secure, HTTP-only session cookie is placed in your browser. The cookie is used only for Vault authentication and is not used for advertising or cross-site tracking.

Historical migration information

Where applicable, M&F Bot may retain historical Streamlabs Cloudbot usernames, watch time, and loyalty points that were imported to preserve existing community progress and match it to an M&F Bot account.

Operational information

The service records limited operational information such as livestream connection status, API usage estimates, successful or failed message delivery, and application errors. The public command-guide website does not require an account and has no forms, advertising trackers, analytics scripts, fingerprinting, or analytics cookies. Like any website, the network and hosting infrastructure must receive a visitor's IP address long enough to return the requested page and protect the service. M&F Bot does not save raw command-guide or Vault visitor IP addresses in its application database or use them to build visitor profiles.

The separate M&F Vault page requires a one-time code and authentication cookie to display a member's own collection. To slow automated code guessing, the Vault converts the connecting address into a one-way, keyed security value held briefly in server memory. The bot uses that value only to count login attempts; it is not written to the bot database and is not used for advertising, analytics, identification, or tracking. Infrastructure providers may independently process limited network metadata under their own privacy and security practices.

How we use information

Information is used to operate and secure M&F Bot; respond to commands; maintain coins, games, pets, collections, goals, ranks, and leaderboards; preserve historical progress while its permitted use is reviewed; link identities at your request; preserve progress across supported streams, Discord, and Kick; archive public livestream chat for community moderation and continuity; prevent spam, duplicate processing, abuse, and unfair transfers; diagnose failures; and comply with legal or platform obligations.

M&F Bot does not sell personal information, sell YouTube API data, use chat activity for targeted advertising, or assign a cash value to its virtual currency.

YouTube API Services

M&F Bot uses YouTube API Services to identify configured livestreams, receive public live-chat messages and associated public channel information, and publish requested bot responses through an authorized bot channel. By interacting with M&F Bot on YouTube, you acknowledge that this service uses YouTube API Services and that your use of YouTube is also governed by the YouTube Terms of Service and Google Privacy Policy.

The OAuth credentials used to publish bot responses belong to the service operator. Viewers are not asked to grant M&F Bot access to their private Google or YouTube accounts. M&F Bot does not access private videos, subscriptions, email addresses, passwords, or private YouTube messages.

You may review or revoke an API Client’s access to Google or YouTube data at Google Account third-party connections. Revoking access through Google does not itself submit a request to delete information held by M&F Bot; use the deletion procedure below as well. Viewers are not normally asked to authorize M&F Bot through Google OAuth, so this revocation option is generally relevant only to the operator account that authorized the bot.

Data retention

Raw chat messages, completed delivery records, and bot-managed Discord archive copies are normally retained for up to 14 days for reliable delivery, duplicate prevention, moderation support, and troubleshooting. Archive copies are then queued for automatic deletion from Discord. Conversational AI context is held only in the running bot's memory, is limited to the recent conversation, and expires after ten minutes of inactivity. It is not written to the bot database; users can clear it sooner with !ai reset or !ai forget. Optional saved AI memories are separate: !remember stores a harmless preference for up to 180 days, !forgetmemory deletes saved viewer memories, and !memoryoff disables and deletes them. Moderator-approved community memories may be kept for up to 365 days.

Public YouTube channel names and profile images used for account identity are re-fetched through the YouTube API before they become 30 days old. If a channel can no longer be retrieved, its stored YouTube identity metadata is removed and replaced with a non-identifying account label. Public live-chat collection and these metadata refreshes use an API key. The operator's OAuth authorization is kept separate and used only to publish requested bot responses from the authorized M&F Bot channel.

YouTube message-reward fingerprints and source-message keys are removed on the normal chat-retention schedule (normally 14 days). Those reward ledger entries are deleted after 30 days without subtracting the already-earned coins from the account balance.

Balances, game progress, transaction records, collections, linked-account associations, and imported historical progress are kept for as long as needed to provide the persistent community account and maintain the integrity of the economy, subject to the user controls and deletion process below. Expired linking and Vault login-code records are routinely removed after a short cleanup period. Vault browser sessions expire after no more than 30 days and may be revoked sooner by the member. The Vault's one-way login-attempt counters are memory-only and expire automatically; they are not part of backups. Other operational records may be retained for troubleshooting, security, quota management, backups, and legal compliance.

After a verified deletion request, M&F Bot will delete or irreversibly anonymize information associated with the requester as soon as possible and no later than seven calendar days. This includes information in active application systems and, where it is controlled by M&F Bot, copies sent to M&F Discord archive channels. Transaction records that must remain for security, fraud prevention, or ledger integrity will be stripped of the requester’s platform identifiers, display name, avatar, and other information that could reasonably reconnect the record to that person.

Rotating backups are not used for ordinary access. If a backup containing information covered by a completed deletion request is restored, that deletion request will be reapplied before the restored service is returned to normal operation. Information that M&F Bot does not control, including the original message or account data held by YouTube, Google, or Discord, must be deleted through that platform’s own controls.

Your choices and requests

You can avoid new bot processing by not sending messages or commands in configured livestream chats and by not interacting with M&F Bot on Discord. Account linking and M&F Vault access are optional. You may sign out a browser from the Vault page or privately send !vault revoke to M&F Bot on Discord to revoke all active Vault sessions.

How to use secure self-service deletion:

Use !deletedata to delete the linked profile without joining a blocklist. A later interaction may create a completely new blank profile.
Use !deleteandblock only when you also want every linked identity placed on the no-recreation blocklist. Those identities are ignored until each one explicitly sends !startfresh; that command creates a blank profile and does not restore deleted progress. Discord deletion commands must be sent to M&F Bot in a private DM.
For either option, the bot states the selected consequence and provides a one-time code that expires after 10 minutes. Review the warning, then send !confirmdelete <code> from the exact same YouTube, Discord, or Kick account that requested deletion. Use !canceldelete instead if you change your mind.
After successful confirmation, the linked profile is deleted or irreversibly anonymized automatically. This also clears saved viewer AI memories, pending conversation work, birthday data, retired-game records, and Vault access. The platform-provided account ID—not a typed display name or username—is used to verify ownership, so another person cannot submit or confirm deletion for your profile.

If self-service deletion is unavailable, or if an older Discord archive copy predates the bot’s exact message-ID deletion mapping, email mnfcommunity@gmail.com with the subject “M&F Bot Data Deletion.” Include the relevant YouTube, Discord, or Kick username, but never send a password, OAuth token, or other account credential. The operator will verify control through the relevant platform identity and complete any remaining deletion as soon as possible and within seven calendar days. You may use the same address to request access, correction, or unlinking.

Deleting information held by M&F Bot does not delete messages, channel information, or other data held by YouTube. To delete information from YouTube, use YouTube’s own account and content controls. To revoke Google or YouTube authorization previously granted to an API Client, use Google Account third-party connections.

Security

Reasonable technical and organizational safeguards are used to protect bot data, including restricted administrative access, separate service credentials, expiring single-use linking and Vault codes, hashed session tokens, secure HTTP-only same-site cookies, read-only Vault access, and access controls around the bot’s server and database. No internet service or storage system can be guaranteed completely secure.

Children’s privacy

M&F Bot is not directed to children under 13 and does not knowingly seek personal information from children under 13. If you believe a child has provided personal information through the bot, contact us so the situation can be reviewed and appropriate action taken.

Changes to this policy

This policy may be updated when M&F Bot’s features, data practices, or legal obligations change. The effective date at the top of this page will be revised when an update is published. Material changes may also be announced through the M&F community’s usual channels.

Contact

For privacy questions, account requests, or concerns about M&F Bot, email mnfcommunity@gmail.com. Please do not send passwords, OAuth tokens, or other account credentials.