Privacy

Last updated November 4, 2026.

AltWarden checks people who join Discord servers. This page says exactly what it reads, what it keeps, and for how long. The source code is public, so you can check what the software does. The nightly backups named below are set up on this copy's server, outside that source.

The short version

Your IP address, email, cookie and browser fingerprint are never stored in readable form.
Your Discord sign-in is revoked seconds after it's used.
The verification page has no ads, analytics or other outside scripts.
The hashes in one server can't be connected to the hashes in another. Your Discord ID is stored as it is, so staff can see who verified.
You can see and delete your data yourself at My data. Nightly backups keep a copy of the database for up to 14 days.

What is read during verification

Data	What happens to it
Discord ID, username, profile picture	Stored, so staff can see who verified.
Whether two-factor login is on	Kept with your link while you can still retry. It goes when your attempt finishes, and otherwise when the link ends.
Your email address	Requested when the server has the throwaway email check on, and every preset turns it on. The domain is compared with a list, then the address is dropped. It's never written down.
IP address	Compared in memory with lists of VPNs, data centers and countries. A keyed hash is stored for alt matching. The address isn't stored.
Browser and device details	Compared to find spoofing, automation and virtual machines. Only the result is stored, as labels such as "private window". A browser identifier and a device value are stored as keyed hashes.
Operating system and browser family	Stored as keyed hashes, so staff can see whether two linked accounts also share a system and browser. They never count toward a match.
A random cookie	Set to recognize the same browser. Stored as a keyed hash.

Staff who sign in to the dashboard also share their Discord server list. AltWarden reads it once and keeps the ID, name and icon of the servers it's in, until that sign-in ends.

What a keyed hash means

A keyed hash is a one-way scramble made with a secret key. AltWarden can tell whether two values match, but the hash can't be turned back into the address or fingerprint without that key. Every server has its own derived key, so the same person produces unrelated hashes in two servers. The key isn't stored in the database, so a copy of the database alone can't reverse them.

That copy would still show Discord IDs, names, attempt results and appeal text. A server's webhook secrets and any proxycheck.io key are encrypted under the same master key, so a copy alone reveals none of them, and a copy with the key reveals them all.

How long things are kept

Record	Default	A server can set
Connection hash	30 days	1 to 365 days
Browser, device, system and cookie hashes	365 days	30 to 730 days
Attempt history, staff audit log, appeals whether decided or not	365 days	30 to 730 days
Links between accounts	365 days	Follows the browser and device setting
Name and picture of someone who never tried to verify	365 days	Follows the attempt history setting
That you verified, with your name and picture	Until you delete it	Needed to tell which of two matching accounts verified first, and to let you back in if the server remembers verified members
Accounts staff marked as different people	Until either person deletes their data	Not a setting
Browser, device, system and cookie hashes of banned accounts, and the record of the ban	730 days	0 to 1,825 days
Verification links	1 hour, or the server's kick time	Bypass links last up to 7 days
Backup copies of the whole database	Up to 14 days	Not a setting

A timer deletes expired records automatically. If a server removes AltWarden, everything held for that server is deleted after 30 days, and /uninstall deletes it at once. Records for a server that never finished setting up go after 30 days too. Whatever is deleted can stay in a backup for up to 14 days, and then it's gone.

Cookies

Cookie	What it does	How long it lasts
`__Host-aw_device`	A random value that recognizes the same browser. Only its keyed hash is stored.	The browser hash setting of the last server that checked you, up to 400 days, renewed at each check
`__Host-aw_vflow`	Ties a Discord sign-in on a verification link to the browser that started it.	15 minutes, and deleted when the sign-in ends
`__Host-aw_flow`	Ties a Discord sign-in for the dashboard or My data to the browser that started it.	15 minutes, and deleted when the sign-in ends
`__Host-aw_browser`	Ties a verification link to the browser that signed in, so nobody can pass a check on someone else's browser. It's hashed together with the link, so it can't connect two servers.	Until you close your browser
`__Host-aw_session`	Keeps staff signed in to the dashboard, or a member signed in to My data.	12 hours for the dashboard, 30 minutes for members. Logging out ends every sign-in that person has here, in every browser.

None of them can be read by scripts, and none is shared with anyone. The dashboard also remembers its theme and accent color in your browser, and those never leave your device.

Who can see what

A server's staff see your Discord name, your attempts, which check stopped you, and which account you were linked to and how strongly. They never see an IP address, email, cookie or fingerprint, because AltWarden doesn't have them in readable form. Staff never see your country.

Outside services

Member pages load nothing from outside this site, apart from the server's icon, which comes from Discord's image service. AltWarden shares nothing with advertisers or data brokers.

Two optional exceptions, both off unless a server chooses them. A server can turn on an outside VPN lookup. Your IP address then goes to proxycheck.io during verification when the answer could change the result, meaning the VPN or Threat check is on, the lists haven't already flagged your address, and you aren't past a limit or skipping the VPN check. A server can also register webhooks. Those send your Discord ID and the result of your attempt to an address its staff chose.

Your choices

Sign in at My data to see everything held about you and delete it, for one server or all of them, with no request to anyone. Deleting your records also removes your verified role, because there's nothing left to support it, and you can verify again whenever you like. If the server gives members a time limit to verify, your time starts again when you delete. Each server's staff get one line saying a member deleted their records, with no name in it.

Deleting also removes staff records about you, such as a note that staff verified you, replaces your name on anything you did as staff with a stand-in, and removes your ID from other people's records.

Some things stay.

If you're banned from a server, your hashes for that server stay until the ban is lifted or the server's ban retention runs out, whichever comes first. A connection hash ends sooner, on its own date. If the ban is lifted, they all go at once. Otherwise a banned account could erase the only thing that catches its next account. Your name, picture and history are still deleted.
If a server limits attempts, makes you wait between them, or gives you a time limit to verify, your Discord ID stays with that count and timer, with no name or picture, until the attempt history setting removes it, counted from your last failed attempt. If you've used up a limit that never gives attempts back, it stays until staff reset you. Otherwise deleting your data would reset the limit.
Backups keep a copy for up to 14 days.
Messages AltWarden posted in a server's channels, such as logs, appeals and help threads, stay in Discord. Ask that server's staff to delete them.

You can decline by not verifying. Each server decides whether there is another way in.

Automated decisions

Each server chooses its rules, and AltWarden applies them automatically. If you think a result is wrong, use the Appeal button if the server offers one, or ask its staff. A person on that server's staff decides.

Children

AltWarden is for people old enough to use Discord in their country.

Contact

For a decision about a server, talk to its staff. For anything about AltWarden itself, open an issue on GitHub. Don't post personal details there.