A clear explanation of the limited information used to operate Discord verification, secure launcher sessions, and the website.
GUY2 collects only the information needed to verify Discord access, protect launcher sessions, enforce device limits, operate the service, and investigate abuse. The verification backend is the authority for access; editable local fields are not trusted as proof of a role.
We do not ask for or store your Discord password, Roblox password, game password, or payment-card number.
The current backend does not persist an IP address or IP hash in launcher sessions or audit records. Network addresses may be held briefly in server memory for rate limiting and are discarded when the process restarts or the short rate-limit window expires.
The launcher stores an account-state file under your GUY2 launcher data directory. Its sensitive contents include the backend-issued refresh token and the device private key, protected with Windows Data Protection API for the current Windows user.
Local display values such as the last known role are not treated as authoritative. The launcher asks the backend to validate the session and current Discord access.
When you verify, your browser is sent to Discord's authorization page. Discord returns a short-lived authorization code to the GUY2 backend. The backend exchanges it with Discord, obtains your Discord user ID, and checks server membership and roles using server-side credentials.
The service does not store your Discord password. Discord OAuth access credentials are used only as needed to complete identity verification and are not stored as the persistent launcher credential. The launcher receives a separate GUY2 refresh token issued by the backend.
Information is not sold to advertisers. Limited information is processed by providers needed to run the service:
Information may also be disclosed when required by law or reasonably necessary to protect users, the service, or legal rights.
Security measures include server-side Discord role checks, signed device requests, short-lived nonces, replay prevention, refresh-token rotation, one-way token storage, device public-key verification, rate limiting, database constraints, and local DPAPI protection.
No system can be guaranteed perfectly secure. Keep Windows and Discord accounts protected and report suspected unauthorized access promptly.
You may stop using the launcher, delete the local account-state file, leave the Discord server, or ask support to revoke sessions, reset device registrations, or review/delete applicable server-side records.
Some data may be retained where reasonably required for security, legal compliance, dispute handling, or abuse prevention. Identity may need to be verified before fulfilling a request.
The main website may load resources from third parties such as Google Fonts and the Discord server widget. Those providers can receive standard web request information under their own privacy policies.
The GUY2 verification API does not use advertising cookies. Browser or hosting-provider logs may still be produced as part of normal HTTPS delivery and security operations.
This policy may be updated when data practices, providers, security controls, or legal requirements change. The effective date will be updated, and significant changes may be announced on the website or Discord.
Use the official GUY2 Discord server for privacy questions, session revocation, device resets, or data requests.