privacy policy

this draft explains how maeven handles information when you visit the website, verify in a discord server, or use the dashboard. it describes the current service and should be reviewed before public launch.

who is responsible

maeven is a discord verification service used by server administrators. the operator's name and contact details have not yet been provided. server administrators choose whether to use maeven and which protections to enable; discord and cloudflare also process information under their own policies: discord privacy policy and cloudflare privacy policy.

information used for verification

during verification, maeven collects browser, device and network signals, such as graphics and browser capabilities, device and display characteristics, an ip address and a first-party cookie. browser characteristics are hashed before being submitted. some client-reported signals, including suspected virtual-machine indicators, are unreliable and can be altered.

when a participating server enables alt detection, maeven associates your discord account with keyed hashes of these signals in a central security network. this allows observations made during verification in one participating server to help assess an account in another. maeven also retains some older server-specific observations. the raw connecting ip address and browser token are not stored in the maeven database. the first-party token is an http-only cookie on maeven.win, valid for up to 30 days; maeven cannot read cookies belonging to other sites. hashes are pseudonymous and may still be personal data.

maeven compares signals and may record a time-limited suspected relationship between discord accounts. server administrators can configure maeven to block verification based on a suspected match or to check whether a matched account is banned in their server and apply a ban. administrators do not receive the underlying hashes or a list of fingerprint records. these indicators are experimental: similar signals can be shared by unrelated people and may change over time. they are not proof that accounts belong to the same person. contact the relevant server's administrators to request a review or manual verification.

network and security checks

cloudflare receives your ip address when you connect. maeven reads it in memory to compare it against public lists of known tor exits, vpn networks and proxy addresses, and may use cloudflare-provided network metadata to identify datacenters. server administrators may enable these checks and the suspected virtual-machine check. no raw visitor ip address is sent by maeven to the list providers. these checks are incomplete and can misclassify ordinary connections; a missing or outdated feed can prevent verification. cloudflare may process network information under its own policies. to limit repeated requests, maeven uses a keyed daily digest of the ip address for rate limiting.

discord sessions and server settings

a verification session includes your discord user id, server id, timestamps, a hash of the private link and the browser hashes submitted during verification. links expire after 15 minutes and expired records are removed by scheduled cleanup. you must sign in with discord using the same account that requested the link; maeven uses discord to confirm the account id. keep the link private. the sign-in uses the identify permission, and the access token is used to check your account. verification attempts may record the server, user, time and result. on success, the bot applies the server's configured role. an administrator can also manually verify a member and provide a reason.

if you sign in to the dashboard, maeven uses discord to read your account and the servers you can manage. a short-lived, encrypted session cookie in your browser holds the discord access token for up to one hour. signing out removes it. maeven stores server configuration, including selected channels, roles and enabled protections, until changed or removed by the operator. administrators can configure a discord channel to receive moderation notifications. discord and people who can access that channel may see the information in those notifications.

retention and deletion

global browser observations and suspected account relationships are retained for up to 30 days, with at most five global observations per account. older server-specific observations are retained for up to 30 days, with at most five per account per server. verification attempts, completed manual verification records and completed notification jobs are generally retained for up to 30 days. verified-role records are kept until a deletion request so maeven can attempt to remove roles. scheduled cleanup can be delayed by an outage. discord messages, server audit logs and cloudflare's own logs are subject to their respective operators' retention practices.

you can use /privacy in discord to request a one-use download of available account information or to queue deletion. the download omits fingerprint, ip and cookie hashes because comparing repeated samples could reveal information about the signals or help bypass checks; omission does not make them anonymous. the deletion process removes account-linked ip and cookie hashes and disconnects the discord id from retained browser fingerprint hashes and removes stored suspected relationships involving that account. those retained hashes can continue to be used for detection until their 30-day retention period ends and may still be personal data. the bot attempts to remove known verified roles, notify server staff where configured and send you a direct message; older or inaccessible servers may not be covered and message delivery can fail. you can also clear the maeven.win cookie in your browser.

your choices and rights

depending on where you live, you may have rights to request access, correction, deletion, restriction or objection to processing, and to complain to a data protection authority. these rights and any exceptions depend on applicable law. the current download and deletion tools have the limitations described above; they do not determine the outcome of a legal request. the operator still needs to provide an appropriate contact method for requests and questions.

service providers and changes

maeven uses cloudflare for hosting, database and queued processing, and discord for authentication, bot actions and messages. server administrators receive the information necessary to operate their configured protections and notifications. information may be processed in locations where these providers operate; the applicable arrangements and transfer details need to be completed by the operator. this policy will be updated when the service or its data practices change.