Privacy Policy
Last updated 18 August 2026
VRCVerify links a Discord account to a VRChat account so that a server can act on VRChat's age verification. That link is the most sensitive thing here, and this page says exactly what is stored, for how long, and who else sees it.
The short version. We store your Discord user ID, your VRChat user ID, and whether VRChat says you are age verified. We do not store your VRChat display name, your profile bio, your email address, or any payment card details. Nothing is sold, and nothing is shared for advertising.
Who we are
VRCVerify is operated by Esatto Technologies, United States. For anything in this policy, including a request to see or delete your data, write to contact@esattotech.com.
What we collect
When you verify
| Data | Why |
|---|---|
| Your Discord user ID | To know which account has verified, and to assign the role. |
Your VRChat user ID (usr_...) | To ask VRChat whether that account is age verified. |
| Whether VRChat reports you as age verified | The result the whole service exists to act on. |
| The time of your most recent verification attempt | Rate limiting, so the shared VRChat account is not overwhelmed. |
| A short verification code, the server it was issued for, and its expiry | To confirm you control the VRChat account you named. Deleted automatically when it expires, within minutes. |
Once you have verified, the link between your Discord and VRChat accounts lets any other server running VRCVerify recognise you without repeating the process. That is the point of it, and it is why the record persists.
When a server uses the bot
For each Discord server: the server ID, its owner's Discord ID, the role and channel IDs it has configured, its chosen language, its feature settings, any custom post-verification message it has written, and a count of completed verifications. Where an administrator changes a setting on the dashboard, we record who changed what and when.
When a server subscribes by card
Stripe processes the payment. We receive and store the Stripe customer ID, subscription ID, price ID, subscription status and renewal date, so the bot knows the server has paid.
We never receive or store card numbers, and we deliberately do not store the billing email address Stripe collects. Card details are entered on Stripe's own pages, not ours.
What we deliberately do not collect
- Your VRChat display name or profile bio. Your bio is read at the moment of verification to find your code, and is not retained.
- Your Discord email address, even though Discord could provide it.
- The contents of any message, anywhere.
- Card or bank details of any kind.
- Identity documents or photographs. VRChat performs age verification; VRCVerify only reads the yes-or-no result.
Who else sees it
We do not sell personal data and we do not share it for advertising. Data is processed by:
- Discord — the platform the bot runs on.
- VRChat — asked whether an account is age verified.
- Stripe — payment processing, for card subscriptions only.
- Cloudflare — serves this site and the dashboard.
We may also disclose data where the law requires it.
Your verification status is visible to a server through the role the bot assigns, which is how the server acts on it. Your VRChat user ID is not shown to server administrators anywhere in the bot or the dashboard.
Where it is stored
Data is stored on servers in the United States. If you are in the United Kingdom or the European Economic Area, using VRCVerify involves transferring your data to the United States.
How long we keep it
| Data | Kept |
|---|---|
| Verification codes in progress | Minutes. Deleted automatically on expiry. |
| Your Discord ID, VRChat ID and verification status | Until you ask us to delete it. |
| Server settings | Kept after the bot is removed from a server, so an administrator does not have to reconfigure everything if it is re-invited. |
| Subscription records | Kept after a subscription ends, as a business record and to know that a server has previously subscribed. |
Your rights
You can ask us to show you the data we hold about you, correct it, or delete it. If you are in the UK or EEA you also have the right to object to processing, to request that we restrict it, to receive your data in a portable form, and to complain to your local data protection authority.
To exercise any of these, email contact@esattotech.com from an address we can tie to your Discord account, or include your Discord user ID. We will respond within 30 days.
Deleting your verification record means you will need to verify again the next time a server asks.
Our legal basis, if you are in the UK or EEA
- Consent for the verification itself. You start it, and you can withdraw by asking us to delete the record.
- Performance of a contract for subscription and billing records.
- Legitimate interests for server settings, rate limiting, and keeping the service working and secure.
Children
Discord requires its users to be at least 13, and older in some countries. VRCVerify is not directed at children and we do not knowingly collect data from anyone below Discord's minimum age. If you believe a child's data is held here, email us and we will delete it.
Security
Access to the database is limited to the operator. The dashboard holds no database credentials and reaches the bot only over a mutually authenticated private network link, so a compromise of the public website does not by itself expose the verification data.
Changes
If this policy changes materially we will update the date at the top and, for significant changes, announce it in the support channel. Continuing to use VRCVerify after a change means accepting the updated policy.