Discord Translator sends the text of messages you choose to translate to the translation provider you select, and nothing else, to nobody else.

WHAT IS SENT. When you enable translation for a server, or double-click text, the message text and the language pair are sent to translate.googleapis.com. If you set the provider to DeepL and enter your own API key, they go to api-free.deepl.com or api.deepl.com instead, together with that key. Nothing else is ever transmitted.

THIS INCLUDES OTHER PEOPLE'S MESSAGES. They did not consent to translation. You are responsible for complying with the policies of the servers you use this in.

WHAT IS NOT SENT. Nothing goes to the author of this add-on. No telemetry, no analytics, no account information, no identifiers. There is no update check and no cloud sync.

WHERE THINGS ARE STORED. Settings and the translation cache are stored locally in your browser, under discord.com. A DeepL API key you enter is stored there too, which means any script running on that page could read it. If that matters to you, use the desktop build for DeepL.

WHAT ENFORCES THIS. The add-on's background script holds an explicit list of the three hostnames above and refuses any request to any other host, matched on the full hostname. That list, not the page's security policy, is what constrains where your text can go.

DIRECT MESSAGES are excluded by default. Enabling includeDMs sends them too.

CONTENT SECURITY POLICY. This add-on removes Discord's Content-Security-Policy header, inherited from the Vencord/Equicord framework it is built on, so that themes you install can load their own images and fonts. This lowers one of the page's defences for as long as the add-on is installed. Translation does not depend on it.

Full notice: https://github.com/charlie754/Discord-Translator-Client/blob/main/PRIVACY.md