Privacy notice — member verification
1. Who is responsible
The controller is PSAF, operator of the Discord server PSAF. Contact: ticket.
2. Why we process data
Only to verify people joining PSAF: detecting ban evasion, duplicate ("alt") accounts and automated or coordinated account abuse. The data is not used for any other purpose, not sold, and not used for advertising or profiling outside this verification.
3. Legal basis
- Legitimate interest (GDPR Art. 6(1)(f)): protecting the community and its members from banned users returning, harassment through alt accounts and raids. We limited the data to what this requires, store identifiers only as keyed hashes, and never store your IP address or email address in readable form.
- Consent for reading device information from your browser (ePrivacy rules): the check only runs after you tick the box on the verification page.
4. What we collect and how it is stored
| Category | What | Stored as |
|---|---|---|
| Network | IP address (looked up, never stored), network operator (ASN), country, connection type, VPN/proxy/hosting/Tor indicators, connection latency | Keyed hash of the IP range (/24 or /64), ASN, country, connection class, latency figures |
| Device | Browser and device characteristics: user agent, screen, graphics chip, canvas/audio rendering, installed fonts, timezone, languages, CPU/memory class, automation indicators | Keyed hashes and results of consistency checks; raw values are discarded |
| Security cookie | A random identifier in a cookie (bt) and in local storage (vt) | Keyed hash |
| Discord account | Account ID and creation date, username pattern, avatar, banner, Nitro status, 2FA status, email verification status, email address, connected accounts, number of servers, language | Email and connected-account IDs as keyed hashes; avatar as an encrypted image fingerprint; the rest as flags and counts |
| Join details | Join time, invite code used | As is |
| Decision record | Score, outcome, list of contributing factors, accounts linked to yours | As is, for audit |
We never read your messages, never keep your Discord access token (it is revoked right after use), and never monitor your activity after you join.
5. Automated decision (GDPR Art. 22)
The access decision is taken solely by automated processing, without a person reviewing it in real time. A scoring model weighs evidence such as: whether your connection comes from an anonymizing service, whether your device characteristics are internally consistent, the age and completeness of your Discord account, and whether your device, network, email or connected accounts match accounts previously refused or banned. The outcome is either access granted, or access withheld (you stay on the server without the member role).
To keep the system effective we do not publish the exact factors or thresholds. You have the right to obtain human intervention, express your point of view and contest the decision: open a support ticket on the server. A staff member reviews your case and can grant access.
6. Recipients
- MaxMind, Inc. (United States) receives your IP address for the network lookup. Transfers rely on the international-transfer safeguards MaxMind provides; ask us for details.
- Discord, through the login you authorize.
- Server staff see verification alerts and decision records inside a private staff channel.
7. Retention
Data is deleted 24 months after the last time your account was verified or observed. Unfinished verification sessions are deleted after 7 days. The security cookie expires after 24 months.
If your account was refused or banned, and you ask for deletion, we keep a minimal record (hashed identifiers, avatar fingerprint, status) for the same retention period, based on our legitimate interest in preventing ban evasion. You can object through a support ticket.
8. Your rights
You can request access, correction, deletion, restriction or object to processing. Delete your data yourself at any time with the /forget-me command in the server (if you are verified, you will need to verify again to regain access). For anything else, open a support ticket. You can also complain to your data protection authority (in France: the CNIL).
9. Security
Identifiers are hashed with HMAC-SHA256 using a secret key stored outside the database; image fingerprints are encrypted with AES-256-GCM; all traffic uses HTTPS.