1. Heimdall
  2. Guides
  3. Privileged intents
WLWhitelabel guide

Applying for Discord privileged intents.

Your bot runs Heimdall on Bifröst's infrastructure, so the hard part, the data handling, is already done. This guide gives you every answer Discord's intent form asks for, ready to paste and filled in with your bot's name.

The copy buttons unlock once you enter a name, so you never paste a placeholder. It's saved in this browser only.

  1. 1Do you even need to apply?

    You don't have to count members or guess. Discord sends an official DM to the account that owns the bot's Discord application (the token owner) the moment it passes 10,000 unique reachable users. No DM means no action: just switch the intents on in the Bot tab and carry on.

    The DM from Discord

    “Your app (YourBot) has reached 10,000 users… your app's access to privileged intents now requires review.” It gives a hard Submit by date, 90 days from the message. The bot keeps working in the meantime, but if you miss the date the privileged intents are switched off.

    Since 10 June 2026 the trigger has been 10,000 unique reachable users (it used to be a count of 100 servers), and App Verification is now separate from intent review. A whitelabel bot is capped at 3 servers, but a few large servers can still pass 10,000, so it's the DM that tells you, not the server count.

  2. 2Which intents to request

    • Server Members IntentTick
    • Message Content IntentTick
    • Presence Intent Heimdall never reads presenceLeave off

  3. 3Application details

    What does your application do?

    YourBot runs Heimdall, an all-in-one Discord community-management platform operated by Bifröst Development Ltd. It provides moderation and automod, support tickets and modmail, message and audit logging, message translation, Minecraft account linking with whitelist and role sync, Tebex store lookups, and a real-time web dashboard with role-based permissions. Server administrators enable and configure each feature for their own server. The Heimdall platform is documented at https://heimdall.gg.

    • Do you have a public Privacy Policy?Yes

    Where is your Privacy Policy available?

    YourBot runs on the Heimdall platform operated by Bifröst. Its Privacy Policy is published at https://bifrost.gg/privacy and linked from the footer of every page on our website (bifrost.gg). The policy explicitly covers branded bot instances operated by Bifröst. It is also referenced from our Terms of Service at https://bifrost.gg/terms.

    Privacy Policy link:

  4. 4Server Members Intent

    Why do you need the Server Members intent?

    YourBot runs Heimdall. Its permission system gates every staff action, on both the bot and the web dashboard, on a member's roles (Allow, Deny or Inherit), which requires member objects and role data. The intent is also used for moderation (role and hierarchy checks, and member lookups for warn, mute, ban, kick and the mod log), join and leave handling (welcome messages, autoroles and join/leave logging), member-count gating, and the Minecraft integration that syncs Discord roles with Minecraft whitelist and group state.

    • Storing API data off-platform (outside Discord)?Yes
    • Storing API data for 30 days or less?No
    • Encrypting the data you store at rest?Yes

    How do users ask for their data to be deleted?

  5. 5Message Content Intent

    Why do you need the Message Content intent?

    YourBot runs Heimdall. Message content is read to power features each server's admins opt into: modmail (relaying messages between a user's DMs and the staff thread), tickets (generating conversation transcripts for the server operator), automod (scanning content against the server's configured word, pattern and spam rules), moderation logging (showing what a deleted or edited message said, using a temporary cache held for up to 14 days), translation (translating messages on request via DeepL), and optional AI assistance when a server enables it.

    • Can users opt out of message content tracking?No
    • Storing message content off-platform?Yes
    • Storing message content for 30 days or less?No
    • Used to train machine learning or AI models?No
    • Encrypting the data you store at rest?Yes

    How do users ask for their data to be deleted?

  6. 6Screenshots to capture

    Each intent needs links to screenshots or a short video showing the use case working. Capture them in your own bot's server, not a Heimdall-branded one, then host them on imgur or paste a Discord CDN link.

    Server Members

    • The dashboard permissions page (Allow, Deny, Inherit)
    • A mod action that uses a member's roles
    • A welcome message or autorole on join
    • Minecraft role-sync settings

    Message Content

    • A ticket transcript
    • A modmail relay (DM to staff thread)
    • Automod catching a message, plus the infraction
    • A message log of a deleted message
    • A translation

  7. 7Acknowledge and submit

    Tick the certification box. It covers apps “owned or operated by an entity”, and Bifröst Development Ltd operates your bot, so you have the authority to certify on its behalf. Then submit.

    Reference docs:

Every answer here is true because your bot runs the same Heimdall software on the same encrypted infrastructure. If you operate the underlying Discord application yourself, you're the data controller for your server and Bifröst is your processor. If Bifröst owns it too, Bifröst is the controller. Either way, the data is handled exactly as described.