Privacy
Members are never asked for anything
No member has to sign in, authorise an app, or answer anything to see a page. The owner signs in to set the page up: to prove they hold Manage Server, or to own a community they made on servr. The one other person who signs in is somebody applying through an Applications widget: they sign in with Discord so the server knows who is applying, and the application is kept with their Discord id and name.
What is never stored
Nobody’s personal IP address. No email addresses. No Discord access tokens. Not for owners, and not for members.
Signing in by email does not change that. The account is found by a keyed fingerprint of the address, which cannot be turned back into it; the address itself is used once, to send the link through Resend , and sealed inside the link so the page it opens can say whose it is.
Two things are kept that are close to those, and said here plainly: a game server’s own address, because the page shows it and servr asks it how it is; and a TeamSpeak read-only key, the one credential servr keeps, encrypted.
Signing in
Owners sign in with Discord, asking for identify and guilds and nothing else. That cannot read your messages, see your DMs, or act in any server.
With no Discord account, an owner can sign in with a link sent to their email instead. The link works once, for fifteen minutes, and opens a page with a button rather than signing in by itself, so a mail scanner checking it cannot use it up.
Signing in writes nothing to the database. It produces an encrypted cookie in your own browser holding your Discord id, your display name, the ids of servers where you hold Manage Server, and the ids of communities you started on servr — encrypted rather than merely signed, so it is unreadable even to the browser it sits in. Setting a page up, starting a community, choosing an address or paying stores your Discord id as the page’s owner. The access token Discord issues is used once, during sign-in, to ask who you are, and is discarded in the same request.
Signing out deletes the cookie, and that is the whole of it.
What is stored
Display names the member already shows publicly in the server — who is in a voice channel, who posted an announcement, which staff are around.
Where an account id appears
Avatars. A Discord avatar is served from an address built out of the account id, so there is no way to show somebody’s picture without that id appearing in the page’s HTML. Four widgets do it:
- Staff, who are the public face of a server by definition.
- Announcements, where the author has posted to a channel the whole server reads and is already named on the page.
- Who’s playing, where a Minecraft player’s face is fetched by their account id from mc-heads.net while they are on the server.
- Voice channels, which show who is in a room right now.
The third is the widest and we would rather say so plainly than let you find it out: somebody who joins a voice call has not volunteered to appear on a public web page, and their picture is there because the room they joined is on it. They leave the page the moment they leave the channel, and nothing about them is stored — the page reads the current state of the server and keeps none of it.
Everything else carries display names alone.
If you would rather not, every one of those widgets is optional. The voice widget can list rooms without faces, the staff widget can be turned off or kept without pictures, and no widget publishes a channel you have not chosen. The choices are in the editor, not buried here.
Game and voice servers
When an owner connects a Minecraft, TeamSpeak, FiveM or other server, servr stores its address and asks it how it is, the same way the game’s own server list does. What it answers is shown on the page and kept only until the next answer replaces it: the player count, and where the server shares them, the names of who is on. Nothing is kept about a player once they have left.
servr.jar, the Minecraft plugin, sends the same things from inside the
server: the count, and the names and Minecraft UUIDs of players who are on, with
the world each is in. Any player can leave their name out with /servr hide,
and an owner can send the count alone with show-players: false. Nothing about
chat, commands, inventories or players’ IP addresses is sent. Minecraft faces
are drawn by mc-heads.net , which the visitor’s browser
asks for them.
TeamSpeak keys are encrypted before they are stored and never sent to a browser. servr only reads with them.
Plugin tokens are never stored. The owner sees one once; servr keeps a fingerprint that can check it but cannot be turned back into it.
FiveM and RedM player names are not shown, because Cfx.re no longer publishes them.
How retention works without ids
Analytics answers “did the people this post brought in stay?”, which needs to recognise the same person a week later. It does that with a salted hash of the account id rather than the id itself: the roster is hashed and the stored value looked up in it.
The salt is generated per installation, so hashes from one deployment mean nothing in another, and it is scoped per server, so the same person in two servers does not produce the same value.
That is enough to answer “still here?” and not enough to identify anybody.