EPOCH SECURITY

Epoch Security

Privacy Policy

Note: This is a template for operators. Add your controller details here and have the text reviewed legally before you run Epoch Security publicly.

What data is processed?

  • Discord user ID, username and avatar hash (sign-in).
  • The list of servers you can manage (name, icon, permission bitfield) – only servers with management rights.
  • Your servers' configuration and security events: time, event type, involved Discord IDs, reason and result of the action.
  • Change logs (who changed which setting and when).

Member verification (alt and VPN check)

Servers can require members to verify on this website. During verification your IP address is sent to a VPN/proxy detection service and compared with the other verified members of that server to detect alternate accounts. Your IP address itself is not stored: only a keyed one-way hash is kept together with your Discord ID and the result (verified, VPN blocked, alt blocked). These records are deleted automatically after 90 days.

Server restore (optional, with your consent)

If a server enables restore, you are asked on the verification page to allow the server owners to add you to a replacement server if the original server is lost (Discord permission "join servers for you"). Only then, your Discord authorization (access and refresh token) is stored encrypted and used solely to re-add you to such a replacement server. You can withdraw your consent at any time on the verification page, which deletes the stored authorization, or by removing the app in Discord under Settings → Authorized Apps.

What is not stored?

  • No message content – for blocked links only the domain and the reason.
  • No passwords or bot tokens in the database.
  • No OAuth tokens for the dashboard sign-in. Authorization tokens are only stored for members who explicitly agreed to server restore (see above).
  • No raw IP addresses.

Cookies

One technically necessary, HTTP-only session cookie is set. There is no tracking and there are no advertising cookies.

Retention and deletion

Server administrators set the log retention period (1–365 days, default 30). When the bot is removed, server data is deleted according to the operator's policy. Send access and deletion requests to the operator.