As i like to point out first. Would I abuse the data? No way I develop a plugin using hundreds of hours, to then abuse the data why would I want to destroy all that. Also i ordered a server costing me 60€ + the one-time setup fee 150€. So already this project have cost me 210€. Ok i wanted a new VPS (now i run my own Virtual Center

) And i already paid like 40€ a month for the webhost + the vps i used before so with a little extra i can now host more sites, and run several virtual machines. But enough about that.
Luckily many of the guys in this forum knows a huge bit about security. I have had a few persons come to me with recommendations, where and what security measures i needed to increase to make plugin / server as safe as possible. This is a topic many feels is something that should be kept quiet however security through obscurity is never a good method of security. If someone comes over glitches on my site then tells me how to increase its security I thank that person for coming to me and telling me "hey this and this needs improvements".
As for the data itself, all i can do is guarantee that i will never sell or redistribute any data that can be used to ever identify a user. Also in an upcoming update (soon) it will be possible to use a "paranoid" mode where nickname and server is not required. And will give the user ability to call their bots whatever they want.
Also once i am satisfied with the data transfer from plugin <---> server i intend to put a encryption layer on top of the data. Even tho i see no reason why anyone would want/should to be able to read this data. Which means the security risk lays on the users end. (Wifi with no encryption, random proxy server, public network...) And even then the market for collecting the data used for this plugin has no to little use for anyone.
Passwords are always stored in a safe method. Using hashes such as MD5, SHA1 then seeded random salt as a "just in case" measurement.
Database wise i plan using memory tables for data that could be considered "sensitive" which is mainly Nick name + Server name. A memory table is a table that is not physically stored on the machine anywhere but runs entirely in the "ram". Thus when server is restarted/stopped/truncated/whatever all the data in this table is lost forever. Then a physical database would ONLY store a reference id to look-up nickname / server from the memory table.
Code:
SELECT Name, Server FROM memory_table_01 WHERE sha1_hash = 'A REF HASH ID HERE';
If no rows are returned, names would look something like "Bot123020", "Server02310310", until that bot ever sings back on. Since then memory table is updated with the hash + the Nick name + Server name.