Triple CounterDiscord verification
Back to Triple Counter
Legal / policy

Privacy Policy

This policy explains what Triple Counter collects to verify Discord members, how that information is used, and the controls available to you.

Effective / 1 November 2026

Triple Counter ("Triple Counter", "we", "us") provides Discord server verification and moderation tooling. This policy applies to the Triple Counter website, verification pages, dashboard, Discord bot, and related APIs.

We collect only the information necessary to confirm that a Discord account belongs to a person seeking access to a particular server. We do not build cross-server profiles, sell personal data, or collect message content.

Information we collect

Discord account information

  • Discord user ID to identify your account across the authorization flow and prevent duplicate verification.
  • Username and display name where made available by Discord, so moderators can read verification records.
  • Avatar hash when you sign in to the dashboard, used only to display your account in the interface.

Server access information

  • The list of Discord servers where you have Manage Server or a moderation permission, obtained only when you sign in to the dashboard using the identify and guilds scopes.
  • Server ID, name, icon, owner ID where known, and the permissions used to determine whether you may administer that server's Triple Counter settings or view logs.

Verification records

  • Discord user ID and available display name;
  • Server ID and verification event type;
  • Verification status, processing result, and timestamps;
  • Role assignment result. We do not store your Discord access token or password.

Network identity and anti-alt records

  • Raw IP address. When you complete a verification attempt, the web service records the public IP address of that request in the relevant Discord server's network ledger. The address is used solely to enforce that server's one-verified-member-per-IP rule.
  • The first-seen and last-seen timestamps associated with that address and your Discord user ID.
  • Network records are isolated by server. They are accessible only to Triple Counter operators operating the service backend, are not shown to server owners, administrators, or moderators, and are never joined into a cross-server identity profile.
  • Server proxy infrastructure may also process standard connection metadata to route and protect requests.

Configuration and audit records

  • Server settings such as verification channel, verified role, messages, and log retention.
  • Security audit records for configuration changes and verification processing. These are retained to keep the service accountable.

Essential technical state

  • A server-side session identifier stored in an HTTP-only cookie. The raw token is not stored in our database; only a SHA-256 hash and the session metadata are saved.
  • A short-lived OAuth state and PKCE verifier so that a Discord authorization cannot be forged or replayed.
  • An anonymous, random rate-limit bucket cookie. It is not derived from your device or network address and expires within one hour.

What we do not collect

  • Your Discord password, email address, phone number, or billing details.
  • Message content, direct messages, voice data, friend lists, or presence.
  • Device fingerprints, browsing history, or analytics identifiers. Raw IP addresses are stored only for the server-scoped anti-alt purpose described above, not for advertising or behavioral profiling.
  • A hidden cross-server identity history. Verification and network records are scoped to the server that requested them and are not exposed across unrelated servers.

How we use information

  • To authorize and complete Discord verification for the intended server.
  • To confirm that you are still a member before assigning a server role.
  • To show verification events and results to authorized moderators.
  • To validate dashboard access against your Discord server permissions.
  • To detect abuse, prevent duplicate processing, and protect the service.
  • To enforce the server's one-verified-member-per-IP rule. Raw network records are retained until the member exercises deletion or the relevant server is removed from the service.
  • To respond to support requests and comply with applicable law.

Where data protection law applies, we rely on our legitimate interests in operating and securing community verification, the performance of the service requested by you or the server, and compliance with legal obligations. We do not use verification data for advertising, profiling, automated decisions with legal effect, or sale.

Sharing

Verification records are visible only to users who hold appropriate permissions in the relevant Discord server. Raw IP network records are not exposed to any server owner, administrator, or moderator. They are accessible only to Triple Counter operators, and only through the service backend for anti-botting enforcement, maintenance, and security. We may use infrastructure providers for hosting, PostgreSQL database services, and Discord API connectivity. These providers process data on our instructions and are not permitted to use it for their own marketing.

We may disclose information when required by valid legal process or when necessary to protect the rights, safety, and security of Triple Counter, our users, or Discord communities. We do not sell personal information.

Cookies

Triple Counter uses only cookies necessary to operate the service:

  • tc_session: an HTTP-only session cookie used after Discord sign-in. Default lifetime: seven days.
  • tc_oauth_state: a short-lived cookie holding the OAuth state. Lifetime: ten minutes.
  • tc_rl: an anonymous rate-limit bucket. Lifetime: one hour.

We do not use advertising cookies, third-party analytics cookies, or cross-site tracking technologies.

Retention

  • Sessions: expire after seven days by default, or sooner when you sign out.
  • OAuth attempts: usable for ten minutes and cleaned up after expiry.
  • Verification tokens: expire after 15 minutes by default. We store a hash of a completed link to prevent replay.
  • Rate-limit buckets: expire within one hour.
  • Server verification logs: retained for the server's configured window, between 7 and 365 days. The default is 90 days.
  • Raw network records: not subject to the verification-log retention window. They are retained until the member requests account deletion, unless the relevant server is removed from the service.
  • Security audit records: up to 365 days.
  • Server configuration: retained while the service is used for that server, so verification keeps working after bot restarts.

Your choices and rights

You can sign in to the dashboard and choose Settings → Delete account. Account deletion will:

  • Delete your Triple Counter login profile and revoke all sessions;
  • Remove your dashboard access and server manager relationships;
  • Delete every server-scoped membership, verification event, role job, blocked verification record, and raw network record associated with your Discord ID;
  • Remove audit entries attributable to you and delete pending role processing.

Depending on your jurisdiction, you may also have the right to access, correct, restrict, export, or object to processing of your personal data. To make a request, use the support options at triplecounter.xyz/support. We may need to verify your identity through Discord before fulfilling a request.

Server owners and administrators are responsible for using verification logs only for legitimate community moderation and security purposes, and for complying with their own privacy obligations to members.

Security

We use server-side sessions, HTTP-only cookies, CSRF protection, signed and expiring verification tokens, hashed session storage, rate limiting, role-based access checks, scoped database queries, and backend-only access to raw network records. Sensitive credentials are provided through the deployment environment and are never embedded in browser code.

No system can be guaranteed perfectly secure. If we become aware of a breach affecting personal data, we will take appropriate steps and notify affected parties and authorities where required.

Children

Triple Counter is intended for Discord users who meet Discord's minimum age requirement in their country. We do not knowingly collect personal data from children below the applicable minimum age. If you believe a child has provided data to us, contact us so we can remove it.

International processing

Triple Counter may process data in countries other than your own depending on where the service is deployed and where infrastructure providers operate. We use appropriate safeguards where required by law.

Changes to this policy

We may update this policy as the service or legal requirements change. The effective date at the top of this page reflects the most recent revision. Material changes will be communicated through the website or support channels before they take effect.

Contact

For privacy questions or deletion requests, use the support options at triplecounter.xyz/support. Please do not include passwords, Discord tokens, or other credentials in your message.