We don’t request your messages, password, or account token. Temporary OAuth access is used on the server, never saved to disk, and revocation is attempted immediately after verification.
A random verification session cookie expires after 10 minutes. Its temporary display name is held in server memory and removed within a minute of expiry. This app doesn’t fingerprint devices or detect alternate accounts.
Verification also requests the email permission to collect your Discord account email and its verified status, when provided. Successful verifications store your username, display name, avatar reference, public badges, account creation date, server nickname, join date, and reported rejoin status, along with server and role IDs.
Connection logs include your IP, estimated city/region/country, city coordinates rounded to one decimal place, and network provider/ASN supplied by Cloudflare. Browser family, major version, and operating system are estimated from the request’s user-agent; the full user-agent is not stored. These estimates may reflect a VPN or shared network and are not device GPS or a device fingerprint.
Returned verification flows with a valid authorization state are logged with success, failure or cancellation, a reason and stage, start/end times, duration, connection details, and your Discord ID/display name if authentication has completed. Invalid or replayed links, owner sign-ins, and browsers closed before returning are excluded. Verification profiles, email, counts, connection logs, and attempt logs are stored permanently in Cloudflare D1 with no automatic expiry for verification security and future account-abuse checks. Only the bot owner can view these records.
Your host may keep connection logs. You can remove the app in Discord under User Settings → Authorized Apps.
