What a Discord bot can see, and what to ask before installing

Installing a bot grants a third party structured access to your community. Most of that access is necessary and unremarkable; the parts worth thinking about are specific and few.

What it receives by design

Channels its permissions allow. Not what it uses — what it can see. A bot with Administrator bypasses channel overwrites entirely, which includes private staff channels, appeal channels and anything else the role structure was built to protect.

Server membership. With the GUILD_MEMBERS intent, the full member list with roles and join dates.

Message content. Only with the MESSAGE_CONTENT intent. Without it, a bot receives message events with the text removed. This is the single most meaningful line in a bot’s data profile, and it is visible before you install: the intents are listed in the developer portal and, for verified bots, reviewed by Discord.

A moderation bot, an anti-spam system or an auto-responder genuinely needs it. A poll bot, a ticket panel or an economy game that works entirely through slash commands does not.

What it keeps is entirely the vendor’s choice

The platform imposes nothing. Discord’s own audit log keeps 45 days of administrative actions; a bot may keep message content indefinitely, or for an hour, and nothing external decides which.

That makes retention a question you have to ask, and the answer is a fact about the product rather than an opinion:

• What is stored? Message content, or only IDs and counts?
• For how long? A stated number, not “as long as necessary”.
• Where? Which jurisdiction, which provider.
• Can you delete it? Is there a purge on removal, and does it cover backups?
• Can you export it? Self-service, or a support ticket?

Why the export question matters most

Every other answer becomes moot if the data is unrecoverable. A vendor with a long retention window and a working export is a lower risk than one with a short window and no way out, because the first is a decision you can reverse.

It is also the cheapest thing to verify: run the export once, before you depend on it. A vendor confident in their product has no reason to make leaving difficult, and the ones that do have told you something useful.