We don’t request your messages, password, or account token. Temporary OAuth access is used on the server, never saved to disk, and revocation is attempted immediately after verification.
A random verification session cookie expires after 10 minutes. Its temporary display name is held in server memory and removed within a minute of expiry. This app doesn’t fingerprint devices or detect alternate accounts.
Verification also requests the email permission to collect your Discord account email and its verified status, when provided. Successful verifications store your username, display name, avatar reference, public badges, account creation date, server nickname, join date, and reported rejoin status, along with server and role IDs.
Connection logs include your IP, estimated city/region/country, provider-supplied approximate city coordinates, and network provider/ASN supplied by Cloudflare. Coordinates retain the provider’s precision; extra decimal places do not mean the location is accurate. Browser family, major version, and operating system are estimated from the request’s user-agent; the full user-agent is not stored. These estimates may reflect a VPN or shared network and are not device GPS or a device fingerprint.
When GeoLite2 is enabled, the owner dashboard also uses your logged IP to calculate a current location estimate and reported accuracy radius from a local MaxMind database on the bot host. Visitor IPs are not sent to MaxMind for lookup. GeoLite results are shown when logs are read and are not saved in the permanent log database. This product includes GeoLite Data created by MaxMind.
Returned verification flows with a valid authorization state are logged with success, failure or cancellation, a reason and stage, start/end times, duration, connection details, and your Discord ID/display name if authentication has completed. Invalid or replayed links, owner sign-ins, and browsers closed before returning are excluded. Verification profiles, email, counts, connection logs, and attempt logs are stored permanently in Cloudflare D1 with no automatic expiry for verification security and future account-abuse checks. Only the bot owner can view these records.
Your host may keep connection logs. You can remove the app in Discord under User Settings → Authorized Apps.
