Privacy
Last updated: 23 October 2026
In short. SherLog keeps alt accounts out of the Discord servers that use it. To do that it compares how you connect with the server's other members -- only as keyed one-way fingerprints, never your address in clear -- for 90 days at most. It shows no ads and sells nothing. You can see and delete what it keeps about you at any time.
What is kept, and why
| Your Discord account | Your Discord ID, name and picture, from the login (scopes identify and guilds: the servers you're in, to show their admin the ones they manage). The login's token is used once and dropped. |
|---|---|
| Your verification | On a server that uses SherLog: keyed fingerprints (HMAC-SHA256) of your IP address -- and, behind a proxy, of the real one your browser's WebRTC shows -- of its network, of a random ID kept in your browser, and of your device (worked out in your browser). Never the address itself. With the kind of connection (home, phone network or hosting company, from a table of networks kept on our server), the result and the score behind it, and when. |
| The server's log | What happened on that server: member IDs, the result, the signs that counted, the moderators' decisions, and -- if you ask for a second look -- the words you wrote. |
| Your addresses, shown | Never to anyone, unless that server's SherLog admin turns addresses on in its alerts: then a hold or a refusal shows its moderators, in a Discord message, the IP addresses the page and your browser saw. The verification page says so before you verify. |
| The SherLog network | Only between servers that opt in: the fingerprints of accounts banned as alts on one count on the others -- never who, never which server. |
Why: keeping communities safe from alt accounts, ban evasion and raids -- the legitimate interest of the servers that use SherLog, and ours in running it (GDPR article 6(1)(f)).
Who else sees anything
- Discord: your login, the role given, the messages SherLog sends.
- Cloudflare's or Google's STUN server: your browser asks it which address it connects from (a standard WebRTC request), on the verification page.
- proxycheck.io: only where a server refuses VPNs and we have an account with them, your IP address, to know whether it's a VPN.
- Nobody else. Hosted by OVHcloud, in France (Gravelines).
How long
- A verification: 90 days. A server's log: 90 days. A login: 7 days, or until you log out.
- A hold, a kick or a ban stays until it expires: it protects the server that decided it.
Your rights
See and delete your verifications on My data, at once. For anything else -- a copy, a correction, an objection -- write to the server's admins, who can reach us. In the EU you can also complain to your data protection authority (in France, the CNIL).
Cookies
Two, both strictly necessary: your login, and -- once you open a verification page -- a random ID for this browser, kept two years, so the same browser behind two accounts can be spotted. No advertising or tracking cookie, so no banner.
How all of it is protected: Security.