Policies
Developer rules
The rules every Lamma app follows to keep people's trust.
People trust Lamma with their conversations. These rules keep that trust when they add your app. Breaking them can get an app switched off.
#Ask only for what you use
Ask for the scopes, intents and permissions your app needs today, and nothing more. The install screen shows people every one of them. If a feature needs message_content or guild_members, say why when you ask for review.
#Be open about your data
Your app runs on infrastructure you choose, outside Lamma. Give your app a privacy policy link that says what it keeps, why, for how long and where. People see it on the install screen.
#Message text stays in its server
The SDKs keep recent messages in memory so edit and delete events can show what changed, and so a mod-log bot can post a deleted message in that server's log channel. That cache has rules:
- Keep it in memory and bounded. lamma.js keeps 200 messages per channel and lamma.py 1,000 in total, oldest dropped first. Neither writes it to disk.
- Drop a channel's messages when the channel is deleted or hidden from the bot, and a server's when the bot leaves it.
- Use cached text only for a feature in the same server, such as its own mod log.
- Never copy message text to your own storage, logs, analytics or other services, and never keep it longer than the cache does.
#Respect what Lamma keeps private
Don't try to work out who is online, who is typing or what people say in direct messages, and don't collect people's details across servers. Lamma doesn't give these to apps on purpose.
#Keep tokens and webhook URLs secret
Store them like passwords. If one leaks, revoke it at once in User Settings › Developer, or make a new webhook URL.
#No spam, no impersonation
Don't post unasked-for messages, mass-mention people, or make an app look like Lamma, Lamma staff or another person. Bots carry an App badge for that reason.
#Reporting security issues
Found a security problem in Lamma or its API? Email lamma.help@gmail.com with the details, and give us time to fix it before telling anyone else.