Privacy policy

Signing in with Discord

You do not need an account to browse. You need one to submit or manage a listing, and the only way to get one is Discord.

When you authorise us, Discord sends a short-lived access token. We use it once, immediately, to read four things about you and the servers you manage — and then we throw the token away. It is never written to disk.

• Your Discord user ID
• Your username and display name
• Your avatar image URL
• The ID, name and icon of servers where you have Manage Server — so we can check you own what you are listing
• Your email address, but only if Discord has verified it

That gets stored in a session record for seven days, then deleted automatically. The record is filed under a SHA-256 hash of your session ID rather than the ID itself, so the file alone cannot be used to impersonate anyone.

We never receive your Discord password or phone number, and we never ask for them.

Your email address

We ask Discord for your email so a decision on your listing can reach you. Discord DMs are closed by default for a lot of people, and a review that nobody can be told about is the single most common reason somebody never finds out why their listing was declined.

We keep it only if Discord has verified it. An unverified address is one somebody typed, not one they proved.

We use it for exactly one thing: telling you what happened to a listing you submitted — approved, or declined with the reviewer's reason. That is it. No newsletter, no marketing, no digest, no "we miss you". We do not sell it, share it, or hand it to any third party beyond the provider that delivers the message.

If you would rather we did not have it, remove the email permission from The Listing Space in your Discord authorised-apps settings and sign in again, or open a ticket and ask us to delete it. Everything on the site keeps working without it — you will simply be told by Discord DM and on your dashboard instead.

What a listing stores

If you submit a server or bot, we keep what you typed — name, category, description, tags and invite — together with your Discord ID and username, so we know whose listing it is and who to reply to. Approved listings are public by design. Rejections are recorded with a reason, which is shown to you.

Analytics

For each listing, on each day, we count two numbers: how many times the listing page was opened, and how many times someone clicked through to the invite. We also sample the server's member count over time.

These are plain counters. They are not tied to a person, a session, an account or a device, and there is no way to work backwards from them to who visited. There is no third-party analytics, no pixel, no fingerprinting and no ad network on this site.

Your IP address

We use it to rate-limit submissions so one person cannot flood the review queue. It is held in memory for the length of the rate-limit window and never written to disk. It is not logged, not stored, and not shared.

Cookies

Three, all strictly necessary, all HttpOnly and SameSite=Lax:

• tls_session — keeps you signed in. Seven days.
• tls_state — protects the sign-in against request forgery. Ten minutes.
• tls_return — remembers the page you were on before signing in. Ten minutes.

No advertising cookies, no analytics cookies, nothing from a third party. We do not use browser local storage.

If you apply to join the team

Applying is optional and nothing here happens unless you choose to. If you do, we keep the following on your account:

• Your timezone — so reviewers know roughly when you are around. We guess it from your browser; you can correct it.
• Your date of birth — because Discord requires 13 or over and some roles have their own floor. Only your age is shown to the people reading applications, never the date itself.
• Your answers, and which form you filled in.

Both the timezone and the date of birth are asked once and reused if you apply a second time.

How an application was written

This one deserves stating plainly, and it is stated on the form itself before you type anything.

While you fill in an application, your browser measures how you fill it in: how long you spend on each question, how many characters you type, how many corrections you make, how much text you paste, and how often you switch away from the tab. That summary is sent with your answers.

What it does not collect: the contents of your keystrokes, anything you type outside the application form, your mouse movements, or anything at all once you leave the page. It is the same information a person could work out by watching over your shoulder, and nothing more.

It is shown to whoever reads your application as context, not a verdict. Nothing is scored automatically and no application is refused because of these numbers. Writing your answers somewhere else and pasting them in is completely fine — it will simply say that you did.

If you would rather not be measured, do not submit an application. There is no way to fill one in without it, because a measurement that some people can switch off tells you nothing about anybody.

Drafts

While you are writing an application, your answers are saved in your own browser so a refresh does not lose them. They stay on your device, are never sent to us until you press Send, and are deleted the moment you do. They also expire on their own after thirty days.

Support tickets

If you open a ticket in our Discord, the messages in it are kept as a transcript so staff can review a decision later. Anything you put in a ticket is visible to staff.

Where it lives and who can see it

Everything runs on a single server we rent from DigitalOcean, in New York. Backups are taken nightly and kept for fourteen days, then destroyed.

The third parties involved are Discord, which authenticates you, DigitalOcean, which hosts the machine, and — when a decision email is sent — the provider that delivers it. We do not sell your data, we do not share it for advertising, and there is nobody to share it with.

How long we keep things

• Sessions — seven days, then deleted automatically.
• Listings — until you delete them or we remove them.
• Submission and review records — kept while the listing exists, so a decision can be explained.
• Analytics counters — kept as daily totals. They contain no personal data.
• Your email address — for as long as your session or a listing of yours exists, and it goes when they do.
• Applications — kept with their decision, so we can tell you why and so a second application has context. Ask and we will delete yours.
• Your timezone and date of birth — until you ask us to remove them, or your account is deleted.
• Backups — fourteen days.

Getting your data, or getting rid of it

Log out and your session is destroyed immediately. Delete a listing from your dashboard and it comes off the site.

To have everything removed, or to ask what we hold on you, open a ticket in the support server or use the contact page. We will action it within 30 days, and normally much sooner. You do not need to give a reason.

If you are in the UK or EU, you have the right to access, correct, export, restrict or erase your data, and to complain to your data protection authority.

Age

Discord requires users to be at least 13, and older in some countries. If you are not old enough to use Discord, you are not old enough to use this site.

Changes

If this policy changes in a way that affects what we collect, the date at the top changes and we will say so in the support server rather than quietly editing the page.

Contact

Use the contact page or open a ticket in the support server.