AltShield
Last updated: October 19, 2026
This describes what data AltShield ("the Service") collects when you verify through it or use its dashboard, why, and what your options are. It is not a substitute for legal advice.
Depending on what a server's rules actually require, AltShield reads and stores:
Signing in with Steam, Twitch, Roblox, Battle.net, Epic Games, Google, or Riot Games (via the official Riot Sign-On page) uses each platform's own official login page - AltShield never sees or stores your password on any platform.
How we store identifiers: your Steam, Twitch, Roblox, Riot, Battle.net, Epic Games and Google account IDs, and, if a server enables "Fingerprinting", your IP address and browser/device fingerprint (and your Discord ID after /forget-me) are never kept as-is. We keep only a "hash": a one-way code made with a secret key that only we hold. It cannot be turned back into the original value and is used only to check whether the same account or the same device/network has been seen before. Wherever this policy says "hash", it means this.
If you log into the dashboard to manage a server, AltShield stores your Discord ID, username, avatar, and the list of servers you have Manage Server permission on (read from Discord, used only to show you the right servers - not stored beyond your session).
Where the GDPR applies, the platform's own authorization screen (which you approve when you choose to connect an account) is how we obtain the information a server's verification rule needs; you can stop this at any time by disconnecting the account or using /forget-me. Alt-account detection, abuse prevention, device/network matching and the retained anti-ban-evasion hashes described in section 9a are processed on the basis of our legitimate interests under Art. 6(1)(f) GDPR, namely keeping servers safe from alt accounts and ban evasion. The controller is the operator of the Service, reachable at the contact address in section 11. The security cookie described in section 5 is processed on the same legitimate-interest basis: keeping servers safe from alt accounts and ban evasion.
AltShield does not read your Discord messages, does not access your Steam, Twitch, Roblox, Battle.net, Epic Games, Google, or Riot password, does not track your browsing outside of this site, and does not request more account data than a server's configured rules actually need. On no platform is your account ID stored as it is - only as a hash (see the note on hashes in section 1). Nothing from your Battle.net, Epic Games or Google account is stored at all besides that hash; for Steam, Twitch, Roblox and Riot, the profile details a server's rules need (such as account age or owned games) are held in memory while you verify and, at most, in a short-lived cache keyed by that hash, deleted within 24 hours (see section 6).
Verification records are kept so alt-account detection and a server's analytics keep working over time. Connected-account links used for alt detection are deleted automatically 2 years after your last verification (re-verifying restarts that period), and verification logs and past verification sessions older than 2 years are deleted as well; platform profile data such as owned games is only kept in a short-lived cache and deleted within 24 hours (anti-ban-evasion hashes follow their own, shorter 12-month rule - see section 9a). You can also request deletion at any time - see "Your choices" below. If you use /forget-me, the Discord ID in the verification logs and reviews we keep is replaced by a pseudonym (see section 9a), so those records no longer point to your Discord account. For each server where you are verified, we also keep a small marker (the server and your Discord ID) so that features such as the auto-kick of unverified members know you are verified. It is deleted when you leave or are removed from that server, or when you use /forget-me. While a server that automatically removes unverified members is waiting for you to verify, we also keep your Discord ID and the time you joined on a short waiting list for that server; it is cleared as soon as you verify, leave or are removed, or when you use /forget-me.
A server's own admins can see verification outcomes and (if enabled) a queue of accounts flagged for manual review on that server. Raw connected-account details (e.g. your full Steam profile) are not exposed to admins beyond what the "Current status" checklist and alt-detection alerts already summarize.
If a server's admin sets up a log channel, its staff see, for each requirement, only a checkmark and the threshold the admin themselves configured (e.g. "Steam account age (required >= 120 days)") - never your actual value (e.g. your exact account age or game count). That exact value is only ever shown to you, on your own verification result.
AltShield is built on top of Discord and inherits Discord's own minimum age requirements for its users. It does not knowingly collect data from anyone below the minimum age Discord itself requires.
To see what data is stored about you, use the /my-data command in any server that uses AltShield (it sends you a private file with your data). To request deletion, use the /forget-me command (it deletes your data across every server at once and asks for confirmation first). For either, you can also contact support@alt-shield.com. Deleting your verification history may mean you need to verify again on servers that use AltShield, and may affect alt-detection accuracy on those servers. Verification logs are kept in pseudonymized form after deletion (see section 9a).
When you request deletion (via /forget-me or by contacting us) under "Your choices" above, we delete your profile data tied to verification (including the link between your Discord account and any connected Steam/Twitch/Roblox/Riot Games account). This also covers your verification sessions and any staff exemption from the unverified-member auto-kick.
However, we retain a hash of each connected account identifier (Steam/Twitch/Roblox/Riot ID, or your Battle.net, Epic Games or Google account ID) that was linked to the deleted data - and, if the server had "Fingerprinting" enabled, the same kind of pseudonymized device/network fingerprint described above. This applies whenever verification data is deleted this way - not only when a confirmed alt-detection match (an identity already blocked, kicked, or banned on that server) was involved - because the deletion itself is what would otherwise let the same external account, or the same device/network, be linked to a new Discord account with no trace of ever having verified before. This is not a penalty for exercising your right to erasure; it only prevents the same connected account or device/network from being reused across multiple Discord accounts after a deletion. These retained values are stored separately from your Discord profile and your verification history, and cannot be turned back into the original account ID, your device details, or your identity. A hash of your Discord ID is stored with each of them so that you can still verify on your own original account. They are used only as comparison values, to determine whether the same external account identifier or device/network fingerprint has previously been recorded. Each is kept for 12 months from when it was recorded, and that period is reset to a fresh 12 months if the same identifier or device/network is involved in another deletion or confirmed match during that time; otherwise it is automatically and permanently deleted after 12 months of no further activity.
This is the same hash we already store while you are verified (see "Data collected when you verify" above); it is not newly created at deletion time.
The same applies to the keyed hash of the security cookie: like the device and network hashes, it is retained without any Discord ID for up to 12 months after deletion.
The verification logs and manual-review records of the servers you verified on are also kept, because those servers use them for their own statistics and moderation history. After deletion, your Discord ID in them is replaced by a pseudonym that cannot be reversed to your Discord ID (a hash of it). Server staff see such entries only as "Anonymized". These records are deleted automatically after 2 years, like all other logs.
The legal basis for this is our legitimate interest (Art. 6(1)(f) GDPR) in protecting the integrity of the verification process and preventing the same connected account from being used to create multiple Discord identities across servers using the Service. You may object to this processing on grounds relating to your particular situation - contact support@alt-shield.com and we will review your objection individually.
Under the GDPR you have the right of access, rectification, erasure, restriction of processing and data portability, the right to object (Art. 21 GDPR) to processing based on legitimate interest, and, where processing is based on consent, the right to withdraw that consent at any time. To exercise these rights, contact support@alt-shield.com. The /forget-me command is a separate, self-service way to request deletion of your verification data.
You also have the right to lodge a complaint with a supervisory authority - in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority in the EU country where you live.
This policy may be updated from time to time; the "Last updated" date above will change when it does.
Questions about this policy: support@alt-shield.com
See also the Terms of Service.