Public browsing and demos
The site does not add advertising trackers or analytics. Interactive demos use fictional data and browser memory; they do not send messages, scan real users or change Discord settings. A demo transcript is downloaded only when you request it. Hosting infrastructure may keep request logs according to the operator’s configuration.
Discord sign-in
OAuth requests only your identity and guild list. The server stores your Discord ID, display name, username and avatar reference, encrypted access and refresh tokens, and session expiry in a separate web session database. Your guild permissions are fetched from Discord when needed; provider tokens are not sent to browser JavaScript.
Necessary cookies and retention
The HTTP-only session cookie lasts up to seven days. OAuth state expires after ten minutes and can be used once. Expired rows are removed during later sign-in/session activity; stale expired rows may remain at rest until that cleanup occurs. Signing out deletes the current session record and clears its cookie. It does not revoke other sessions or delete bot activity records.
Disconnecting and deletion
Remove STARVIS from Discord’s Authorized Apps to revoke provider authorization. Contact the installation’s server administrator or configured support contact for deletion of bot records or all web sessions. No public self-service account deletion endpoint is provided in this foundation.
Bot data is separate
Moderation logs, verification records, activity tracking and other bot data follow the existing bot’s storage and server policies. This public site does not expose those records. Administrators must inform members about enabled features and choose appropriate retention rules.
Operator responsibilities before launch
Publish a real privacy contact, review data retention and backup handling, secure the session database, configure HTTPS and determine any applicable notices for the hosting region. This document describes the implementation; it is not a substitute for that review.