Privacy policy

What we collect and why

We collect only what the bot and dashboard need to work. Here is what that means in practice.

• Your Discord account. When you sign in to the dashboard with Discord, Discord shares your user ID, username, avatar, email address and the list of servers you are in. We store your name, email address, avatar and the Discord sign-in tokens so the dashboard can show the servers you manage.
• Dashboard sessions. When you sign in we store a session record with your IP address and browser type, and set a cookie to keep you signed in. We do not use advertising or tracking cookies.
• Server members. The bot receives member join, leave and update events from Discord. We keep a temporary copy of member IDs, usernames, avatars, role IDs and permissions in our cache so commands, the dashboard and auto-mod respond quickly.
• Invite tracking. When someone joins a server, we record the server ID, the new member's user ID, the user ID of whoever invited them, the invite code used, the age of the new member's account, and whether they later leave. We also keep a list of the server's invites (code, creator and number of uses) so we can tell which invite was used.
• Messages. The bot reads message content to run auto-mod checks and custom flows. Message content is held in a short-lived cache and is not saved to our database. The one exception is a report: if someone reports a message the bot sent, we save a copy of that bot message with the report.
• Member activity. We record when each member was last active in a server (sending or editing a message, reacting, joining voice or joining the server) so server staff can find inactive members and ask them to verify again.
• Moderation. We store moderation and auto-mod actions: the action taken, the user it was taken against, the moderator, the reason, the channel and which auto-mod check triggered it.
• Verification. We store which members have verified in which server and how. If you complete a captcha, your IP address is sent to hCaptcha to check the captcha. If the server blocks VPNs or limits locations, our own IP service checks your IP address against public VPN and country lists. We do not store your IP address as part of verification.
• Giveaways. We store who entered each giveaway, how many entries they have and who won.
• Dashboard audit log. When someone changes a server’s settings on the dashboard, we record who made the change, what changed, and the old and new values. Server staff can see this history.
• Payments. Payments are handled by Stripe. Card details go straight to Stripe and never reach our servers. We store your Stripe customer ID and the details of your subscription, such as the plan, status and billing dates.
• Votes and credits. When you vote for the bot on Top.gg, Top.gg sends us your Discord user ID. We store the vote and a history of the credits you earn, send and spend.
• Custom bots. If a premium server sets up a custom bot, we store the bot token, bot ID, name, avatar and status it is given. Bot tokens saved from November 2026 onwards are encrypted. Tokens saved before then are stored as they were entered until they are replaced. Avatars uploaded on the dashboard are stored with UploadThing.

When we share your information

We never sell your data and we do not use it for advertising. We share it only in these cases:

• Server staff. Records about members of a server, such as invites, moderation actions, verification, activity and giveaway entries, can be seen by that server's staff through the bot and the dashboard.
• Services that help us run the bot. Discord (the platform the bot runs on), Stripe (payments), Top.gg (votes; we also send them our total server count), hCaptcha (captcha checks), UploadThing (image uploads) and our hosting providers. Each only receives what it needs to do its job.
• When the law requires it. We will disclose information if we are legally required to, and only the minimum needed.
• Totals. We may publish totals, such as how many servers and members use the bot. These do not identify anyone.

If Verification Bot is ever acquired by or merged with another company, we will tell you before your information becomes subject to a different privacy policy.

How long we keep data

• Auto-mod log entries. Deleted after 14 days, or after 1 year for premium servers.
• Custom flow run logs. Deleted after 30 days.
• Member activity records. Deleted after a member has been inactive in a server for 1 year.
• Cached Discord data. Message content is cached for about a minute. Member details are cached for up to a day after they were last updated.
• Verification attempts. Expire when the server's verification time limit runs out.
• Message reports. Kept until we remove them.
• Everything else. Invite history, moderation logs, verification records, giveaways, the dashboard audit log, server settings and your dashboard account are kept until you ask us to delete them.

When the bot is removed from a server

When Verification Bot is removed from a server, we immediately delete that server's cached details (its name, owner and member count), channels, roles and members, and its list of invites. We keep the server's settings and records (invite history, moderation logs, verification records, giveaways and the audit log) so they are still there if the bot is added back. The time limits above keep applying.

A server owner or administrator can ask us to delete all of a server's data at any time by contacting us as described below.

Your rights

Wherever you live, you can ask us to:

• Access. Tell you what data we hold about you and give you a copy.
• Correct. Fix data about you that is wrong.
• Delete. Erase data about you. Some features may stop working for you afterwards, and we may need to keep billing records the law requires us to keep.
• Object or restrict. Stop or limit how we use data about you.

We may ask you to confirm you own the Discord account involved before we act on a request. You can also complain to your local data protection authority.

How we protect your data

The website is served over HTTPS, only the people who run the bot can access our databases, and our internal services require a key to use. No system is perfectly secure, but we work to keep your data safe.

Children

Discord requires users to meet a minimum age, which is 13 in most countries. We do not knowingly collect data from anyone younger than Discord allows. If you believe we have, contact us and we will delete it.

Changes to this policy

If we change this policy we will update this page and the date at the top. We will announce significant changes in our support server at https://discord.gg/jYW9XKMK2N.

This policy is governed by the laws of England and Wales.

Contact us

For questions about this policy or to make a request about your data, join our support server and open a ticket, or email [email protected].