Privacy

Members are never asked for anything

No member ever signs in, authorises an app, or is prompted by servr in any way. The only person who authenticates is the owner setting the page up, and only to prove they hold Manage Server.

What is never stored

No IP addresses. No email addresses. No access tokens. Not for owners, and not for members.

Signing in

Owners sign in with Discord, asking for identify and guilds and nothing else. That cannot read your messages, see your DMs, or act in any server.

Nothing about the person signing in is written to the database. The sign-in produces an encrypted cookie in your own browser holding your Discord id, your display name, and the ids of servers where you hold Manage Server — encrypted rather than merely signed, so it is unreadable even to the browser it sits in. The access token Discord issues is used once, during sign-in, to ask who you are, and is discarded in the same request.

Signing out deletes the cookie, and that is the whole of it.

What is stored

Display names the member already shows publicly in the server — who is in a voice channel, who posted an announcement, which staff are around.

The one place an account id appears

Staff avatars. A Discord avatar is served from an address built out of the account id, so there is no way to show somebody’s picture without that id appearing in the page’s HTML. It applies only to staff, who are the public face of a server by definition, and to nobody else: voice channels, announcements and everything else carry display names alone.

If you would rather not, turn the staff widget off, or rename and keep it without pictures — the choice is in the editor, not buried here.

How retention works without ids

Analytics answers “did the people this post brought in stay?”, which needs to recognise the same person a week later. It does that with a salted hash of the account id rather than the id itself: the roster is hashed and the stored value looked up in it.

The salt is generated per installation, so hashes from one deployment mean nothing in another, and it is scoped per server, so the same person in two servers does not produce the same value.

That is enough to answer “still here?” and not enough to identify anybody.