🛡️ Privacy Policy

What We Collect

When you complete verification, Ostiary collects:

IP address
Browser fingerprint (canvas, WebGL and graphics capabilities, timezone, screen resolution and color gamut, language, platform, installed fonts, CPU core count, device memory, and CPU architecture)
User agent
Country code (from Cloudflare and configured network services), Discord account and server IDs, a persistent browser device identifier, and survey answers

How We Store It

IP addresses, browser fingerprints, user agents, and persistent browser device identifiers are stored as salted hashes. These are pseudonymous identifiers: they can link visits and may be matched against candidate values if the secret salt is disclosed. Discord user and server IDs, country codes, survey questions and answers, verification results, and moderation audit records are stored without hashing. Survey answers and browser timezone/language context may be sent to configured community bots through RabbitMQ for entryway review.

Why We Collect It

Hashed data is used solely for:

Detecting alt accounts that share the same fingerprint or IP
Enforcing bans across alternative accounts
Blocking VPN/proxy abuse during verification

By default, only one Discord account per person may verify: if your sign-in matches another member’s prior verification, your request is denied. Depending on server configuration, if you are not yet verified and you fail this or a ban check, the bot may remove you from the Discord server (similar to a kick), so you can no longer access that community.

What We Don't Do

We do not sell your data. Configured service providers and community moderation bots process data as described below.
We do not use your data for advertising or tracking
Access to survey answers and moderation records is restricted to authorized administrators and integrations.

Data Retention

Verification records are retained for as long as the Discord server uses Ostiary. Contact a server moderator or owner to request deletion. Removing the bot does not automatically delete database records. Backups and records held by downstream community bots follow their operators’ retention and deletion procedures.

Third-Party Services

Cloudflare Turnstile — CAPTCHA verification (subject to Cloudflare's Privacy Policy)
Cloudflare — network proxy and CAPTCHA processing, including your IP address
Discord — login identity, server membership, roles, and moderation notifications
proxycheck.io and MaxMind — receive IP addresses for network reputation and location checks when configured

Contact

For questions or data removal requests, contact a server moderator or the server owner.