Reference
Privacy & data
Keepcord stores what a server owner needs to recover and protect a community, nothing more, and every item here can be switched off or deleted.
| Data | Source | Default | Purpose |
|---|---|---|---|
| User id, username, avatar, account age, MFA / Nitro flags | identify scope | always | Identify the member, trust score |
| OAuth access + refresh token (encrypted) | guilds.join scope | always | Re-add the member on pull |
| Roles and nickname snapshot | Discord guild | always | Restore roles and nicknames |
| Trust score, flags, status | computed | always | Moderation |
| Country, city, coordinates, ISP, ASN, VPN flag and provider | IP lookup | on (owner can disable) | Reports, VPN and country rules |
| IP address | request | full (owner can set hash or off) | Reports, alt detection, IP lists |
| Device fingerprint (hash), browser, OS, device type | verify page | always | Alt detection, reports |
| email scope | off | Require verified e-mail, e-mail lists | |
| Connected accounts (type, id, name) | connections scope | off | Trust score, alt detection, member drawer |
| Server count | guilds scope | off | Trust score |
| Setting | Stored | Shown |
|---|---|---|
full | The IP address plus the lookup result (default). | In the member drawer, /info and the verification report. |
hash | A salted SHA-256 of the address plus the lookup result. | Country and ISP only; the hash is used for alt detection and IP blacklist matches. |
off | Nothing about the address. Country can still come from the Cloudflare header when present. | Country only. |
The verify page tells members what the server collects whenever IP collection is not off.
- OAuth tokens, bot tokens and client secrets are encrypted with AES-256-GCM; the key lives only on the server, not in the database.
- API keys are stored as SHA-256 hashes; webhook secrets sign payloads with HMAC-SHA256.
- Dashboard sessions are httpOnly, Secure cookies; mutating requests are protected against CSRF by origin checks; the API only accepts JSON bodies; the site ships a strict Content Security Policy.
- Team roles limit what people see: e-mails and full IP addresses need the moderator role or above, bulk exports and raw backup downloads need admin or owner.
- Backups and uploaded images are stored on encrypted disks and served with immutable, unguessable URLs.
- Outbound requests (webhooks, Cloudflare, map images) refuse private and loopback addresses.
- Everything runs on infrastructure in the EU.
- Verification records are kept until deleted or until the retention period of the server (Security → Privacy, in days, 0 = forever) expires.
- Backups are kept per the version count of the plan; the oldest version is pruned when a new one is taken.
- Audit log events are kept for 90 days.
- Webhook deliveries (payload, response code) are kept for 7 days.
Members can revoke access for Keepcord at any time from Discord → User Settings → Authorized Apps. Keepcord detects the revocation at the next token refresh, marks the record revoked and the member can no longer be pulled. They can also ask the server owner, who uses /deluser, the member drawer or DELETE /v1/members/:userId: this deletes the record and revokes the token at Discord.
Owners can delete every record from the Members page (export first if you need a copy), delete backups one by one or all at once from the Backups page, and remove the bot from the server. Write to the address below to have everything about a server wiped at once.
You are the controller
Keepcord processes the data on your behalf. Tell your members what you collect (the verify page helps), only enable the scopes you need, and set a retention period if you do not need records forever.The legal texts are at Privacy policy and Terms of service. For a data processing agreement or a deletion request, write to [email protected].