Privacy

Calendar & the Events bot

What we collect

If you create an account, we store the username and display name you choose, a securely hashed version of your password (we never store or see your plaintext password), your selected theme, and the date your account was created. We do not ask for or store an email address, real name, phone number, or location. Browsing the public calendar requires no account at all.

Cookies

We don't use tracking or advertising cookies, so there's no consent banner. The only cookies are the few needed to run the site:

• auth-session — keeps you logged in. It holds only your account id, in an encrypted, signed cookie that JavaScript cannot read. Lasts about 7 days. Only set if you log in.
• theme — remembers your chosen colour theme. Stores a theme name (e.g. teal). Lasts about a year.
• tz — remembers your timezone (e.g. Europe/Copenhagen), detected from your browser so event times display correctly. Lasts about a year.

IP addresses

To protect against abuse (for example, repeated failed logins), your IP address is checked temporarily in memory for rate limiting and may appear in short-lived server logs. IP addresses are not stored in our database.

Discord data

When a community links its Discord server, we store the event details that come from Discord — things like event titles, descriptions, times, the server id, and any VRChat world or group links included in the event. This information already comes from Discord, which remains the source of truth.

Cached images

To load quickly and reliably, we save local copies of images used for events and clubs — such as Discord server icons and event images, as well as images linked from other websites. These copies are stored on our own server, and any that are no longer linked to anything are automatically deleted by a routine cleanup.

What we don't do

No analytics or behavioural tracking, and no advertising. We don't sell your data or share it with advertisers. The only places data moves beyond the calendar are the Discord sync described above, and the two clearly-marked cases in the verification section below.

The Verification bot

This section covers the VRC Radar - Verification bot only. It keeps its own database, entirely separate from the calendar.

What we store

• Your Discord user id, and a snapshot of your Discord display name as it was when the link was made.
• Your VRChat user id, and your VRChat display name (refreshed from time to time so it stays current).
• VRChat's own age-verification status for that account, plus the highest status we've ever seen for it. It is that remembered value — not the current one — that decides the 18+ role.
• When the account was last checked against VRChat, whether the link was made by you in Discord or imported from VRify, and when the record was created and last updated.
• Per server: the server id, the role ids an admin chose, whether cross-server linking is on, and a note of which servers you linked from.

What we never store or see

Your VRChat password or 2FA code. The bot signs in to VRChat with its own account and never asks for yours — there is no point in the flow where you hand us VRChat credentials.

We also don't store your avatar or profile images (they're fetched live when a card is shown and held in memory for about 15 minutes), your VRChat trust rank, your email address, real name, birth date, or any identity documents. The bot doesn't have Discord's Message Content permission, so it cannot read your messages.

Age verification

We only read VRChat's own 18+ flag for your account. We never see a birth date, an ID document, or anything you submitted to VRChat — just whether VRChat reports the account as age-verified.

One thing worth knowing: once an account has been seen as 18+, that is remembered, so hiding the badge on VRChat later does not take the role away. Linking a different VRChat account resets it, and unlinking deletes it along with everything else.

Sharing with our other bots

The stored link may be used for simplified linking with other internal bots on a server — things like VIP or staff access — so members get a more seamless experience at events and across communities without having to link again. Access to that data is restricted to bots we operate; it is never sold or handed to advertisers.

Looking up an existing link (VRify)

This is the one place your data leaves our servers, so here is exactly what happens. When you join a server that has roles configured, and when an admin runs /import-vrify, the bot asks VRify — a third-party VRChat verification directory hosted at buddelbubi.xyz — whether that Discord account already has a known VRChat account, so members who verified elsewhere don't have to link again.

• What is sent: your Discord user id, and nothing else.
• What comes back: a VRChat user id, if VRify knows one. We don't trust it blindly — the account is re-checked against the VRChat API before anything is stored, and age status always comes from VRChat, never from VRify.
• Links created this way are marked as imported, and /unlink-vrchat removes them like any other.

Logs

The server keeps operational logs of which command was used, the Discord and VRChat ids involved, and role changes made. These are short-lived server logs used for debugging and abuse handling — they are not database records.

Deleting your data

Run /unlink-vrchat at any time. It deletes your record and removes the roles the bot granted you in every server it manages.

To be upfront about one gap: a server's own settings — which roles its admin picked — are kept even if the bot is later removed from that server. Email us and we'll delete them.

Contact

Questions about your data, or want something removed? Email vrcradar@mchauge.com or message us on the community Discord.