Privacy policy

This policy explains what the server access verification service collects and how it is used to protect Discord communities.

Information we process

When you use verification, the service may process your Discord user ID, the Discord server requesting verification, verification timestamps, verification status, and security or moderation events related to that request.

The service stores daily-rotating IP and browser/user-agent hashes generated with a keyed HMAC. These derived security values are used to identify repeated abuse and possible ban evasion, and to support VPN, proxy, or Tor checks. The service does not intentionally retain the raw IP address or raw user-agent as the stored security signal, and it does not create a persistent browser fingerprint. When two Discord accounts share a matching residential-IP or browser/user-agent security signal, the service may retain an internal account-group relationship so later signal changes do not remove that moderation connection.

To classify network connections, the service may send the verification request's IP address to IPinfo and/or ProxyCheck, depending on which network-intelligence providers are configured. Those providers process the request under their own service and privacy terms. The derived network classification and keyed signal are used by EvadeGuard for verification and abuse prevention.

After you accept the verification agreement, the service sets a first-party verification cookie containing a random identifier. We store only a keyed hash of that identifier, not the cookie value itself. The cookie helps recognize a browser that later verifies a different Discord account for alternate-account and ban-evasion prevention. It is not used for advertising or shared with advertisers.

The verification form also sends coarse device characteristics (platform, language, timezone, screen-size bucket, touch type, and CPU-core bucket). The service stores only a daily keyed hash of those values. This low-weight signal is used for risk scoring only and never creates an account-group relationship by itself.

Discord OAuth is used to identify the account requesting verification. To detect unusually similar community-membership patterns, the service stores keyed, non-reversible signals for communities returned by Discord, rather than raw server IDs. It excludes the server being verified, and ignores communities that are common among that server's verified members. These signals are not displayed to moderators as a server list.

How information is used

• To complete verification and assign the configured Discord role.
• To detect suspicious activity and protect participating communities.
• To support moderator review, enforcement, and security auditing.
• To operate, troubleshoot, and secure the verification service.

Sharing and disclosure

We do not sell your information, rent it, or hand it to other people or organizations for their own use. Information may be shared with the Discord server moderators who operate a participating community when it is needed for verification, security review, or moderation.

Network-intelligence providers may process IP addresses as described above to classify VPN, proxy, Tor, or hosting traffic. Discord also processes information when you authorize its OAuth flow. These providers handle information under their own terms and privacy practices.

We may disclose information only when required to do so by valid legal process, such as a lawful subpoena, warrant, or order issued by a judge or other competent governing authority. This includes lawful process from an applicable jurisdiction that cooperates through Interpol. We may also disclose information when necessary to protect the service, users, or the public from fraud, abuse, or an immediate security threat, where permitted by law.

Retention and deletion

Because this is a security and abuse-prevention service, we do not provide user-requested data removal or account deletion. Records may be retained for security, moderation, audit, and legal purposes.

The service may automatically remove expired temporary OAuth sessions and verification records that have passed the system's operational retention period. These housekeeping processes are controlled by the service and are not a user-requested deletion mechanism.

The verification cookie expires after up to two years and can be removed through your browser's cookie controls. Removing it stops future cookie-based matching from that browser, but does not erase a previously recorded account-group relationship.

Security

We use access controls and server-side safeguards intended to protect stored information. No online service can guarantee absolute security, so please do not submit information that is not needed for verification.

Changes to this policy

We may update this policy when the service or its legal requirements change. The current version will be published at this page.

Last updated: October 23, 2026