Privacy
Privacy Policy
This policy explains what information Zahya Verifications processes, why we use it, who receives it, how long we keep it, and how you can exercise your choices.
1. Scope and operator
This Privacy Policy describes how Zahya Dev (“Zahya,” “we,” “us,” or “our”) processes information through Zahya Verifications, including its Discord application and bot, dashboard, hosted verification websites, APIs, and support channels (collectively, the “Service”).
This policy applies to Discord users completing verification, licensed server operators, dashboard users, and visitors to our websites. Discord and participating server operators may process information under their own privacy policies; this policy does not control their independent practices.
2. Information we collect
We collect only information reasonably needed to provide, secure, administer, and support the Service. Depending on how you use it, this may include:
- Discord account data: your Discord user ID, username or display name, and avatar information obtained through Discord OAuth.
- Discord server data: server (guild) IDs, configured role IDs, membership and role status, server invite links, and the outcome of bot permission or membership checks.
- Verification data: verification status and stage, timestamps, configured Discord-account-age result, verification attempts, and role-assignment results.
- Phone and OTP data: the phone number you submit, an encrypted copy and one-way hash used for verification and duplicate prevention, a masked display value, OTP delivery and verification status, expiration times, attempt counts, and messaging-provider references. We do not store OTP codes in plaintext.
- License and dashboard data: licensed Discord account ID, display name, plan, access status and expiration, site configuration, uploaded branding, and administrative actions.
- Technical and security data: essential cookies, hashed session and handoff tokens, IP address, user agent, request metadata, rate-limit identifiers, timestamps, security events, and diagnostic logs.
- Support information: information you choose to provide when requesting help, reporting abuse, or requesting privacy assistance.
3. Information we do not request
- We do not ask for or store your Discord password.
- The short-lived Discord OAuth access token is used to obtain your Discord identity and is then discarded; it is not stored as part of your verification record.
- We do not use message content for the verification workflow described in this policy.
- We do not sell personal information or Discord API data, and we do not use it for targeted advertising or data brokerage.
4. Sources of information
- Directly from you, such as a phone number, site configuration, branding upload, or support request.
- From Discord through OAuth and bot API requests that you or a participating server authorize.
- From participating Discord server operators who configure verification sites, guilds, roles, and access rules.
- Automatically from your browser, device, network, our hosting and security infrastructure, and essential cookies when you use the Service.
- From OTP and messaging providers when they report delivery or verification events.
5. How we use information
- Authenticate users and maintain secure sessions.
- Check Discord account age, server membership, configured roles, and verification eligibility.
- Send and validate requested OTP messages and prevent duplicate or abusive verification attempts.
- Assign, restore, or check configured Discord roles after successful verification.
- Operate tenant verification websites, dashboards, licensing, site customization, and customer support.
- Protect users and the Service, enforce rate limits, investigate abuse, troubleshoot errors, and maintain audit records.
- Comply with applicable law, enforce our Terms, and meet Discord platform requirements.
- Analyze reliability and improve the Service using aggregated or de-identified information where practical.
6. Legal bases where applicable
Where privacy law requires a legal basis, we process information as necessary to provide the Service you request or perform our agreement; based on legitimate interests in operating, securing, preventing abuse of, and improving the Service; with your consent where required, including when you submit a phone number to receive an OTP; and to comply with legal obligations. You may withdraw consent where consent is the applicable basis, without affecting processing already completed.
8. Retention and deletion
We retain personal information only for as long as reasonably necessary to provide the Service’s stated functionality, maintain security and auditability, resolve disputes, and meet legal obligations. Verification and server records may remain while the participating server uses the Service or needs the record to administer verified access. Browser verification sessions expire after a limited period, and OTP challenges expire after a short verification window, although limited security or audit records may be retained longer where necessary.
We delete or de-identify Discord API data when it is no longer needed for the Service, when the relevant user validly requests deletion, when Discord requests deletion, or when we stop operating the relevant functionality, unless retention is required by law or necessary for a permitted security or legal purpose.
9. Your choices and privacy rights
Depending on your location, you may have rights to request access, correction, deletion, restriction, portability, or objection, and to withdraw consent. You may also stop using the Service or revoke the application through your Discord settings. Revoking Discord access prevents future OAuth access but may not automatically delete records already required to operate or secure the Service.
To make a privacy or deletion request, visit https://zahya.dev or open a private support ticket at https://discord.gg/zahya. Include your Discord user ID and identify the relevant verification server or site. We may verify your identity and authority before acting. We will respond within the period required by applicable law and notify relevant service providers or server operators when appropriate.
11. Security
We use administrative, technical, and organizational safeguards designed to protect information, including access controls, encrypted transport, encryption or one-way hashing for sensitive verification fields, hashed session tokens, limited administrative access, tenant isolation, rate limits, and logging. No system is completely secure, and we cannot guarantee absolute security. Please report suspected unauthorized access promptly through our support channels and never send passwords, bot tokens, OTP codes, or session tokens to support.
12. International processing
Our users and service providers may be located in different countries. Information may therefore be processed outside your country, where privacy laws may differ. Where required, we use recognized safeguards for international transfers and require providers to protect information consistently with applicable law.
13. Children
The Service is not directed to children under 13 or anyone below the minimum digital-consent age required in their country. We do not knowingly collect information from such users. If you believe an underage person has used the Service, contact us so we can investigate and delete information where appropriate.
14. Changes to this policy
We may update this policy when our data practices, the Service, law, or Discord requirements change. We will revise the date above and provide additional notice when required. Materially different uses of Discord API data will be reflected here and, where required, submitted for Discord review before implementation.
15. Contact us
For privacy questions, data-access or deletion requests, security reports, or complaints, visit https://zahya.dev or open a private support request in the Zahya Discord community at https://discord.gg/zahya. If applicable law gives you that right, you may also lodge a complaint with your local data-protection authority.