Privacy Policy

EdenPass is a Discord bot and web dashboard that bridges Discord and VRChat. Its core features include VRChat account linking, age verification status transfer, and cross-server member verification. To provide these services, we must collect and process certain personal identifiers associated with your Discord and VRChat accounts.

We are committed to handling your data responsibly and transparently. We collect only what is necessary to deliver the Service and we do not sell your personal information.

We collect the following categories of data:

We use collected data exclusively to operate and improve the Service:

• To authenticate you to the web dashboard via Discord OAuth2
• To link your Discord and VRChat accounts and grant appropriate roles within Discord servers
• To transfer your age-verification status from VRChat to Discord, via The Eden Apis
• To enable cross-server verification, allowing partner servers to recognise your verified status without repeating the process
• To maintain activity logs for server administrators to audit verification events in their community
• To display aggregate, anonymised statistics on the EdenPass landing page (total links used, verifications processed, active servers)
• To diagnose technical issues and improve the reliability of the Service

We do not use your data for advertising, profiling, or any purpose unrelated to the direct operation of EdenPass.

We retain your data for as long as your account link or server membership exists within EdenPass, or as long as the bot remains installed in a server you are a member of.

• VRC link data (VRChat ID, display name, trust rank, age-verification status): retained until you or a server administrator unlinks your account.
• Guild member records: retained while the bot is active in the server. Servers may configure the bot to preserve data from members who have left, to facilitate re-verification upon return.
• Activity logs: retained indefinitely per server unless deletion is requested by the server owner.
• Session cookies: expire after 7 days of inactivity or upon logout.

Upon receiving a valid deletion request (see Section 9), we will remove your personal data within a reasonable timeframe.

EdenPass interacts with the following third-party services:

We do not share your data with any other third parties, advertisers, or data brokers.

EdenPass uses a minimal number of cookies strictly necessary to operate the Service:

Both cookies are set as HTTP-only and SameSite=Lax. The session cookie is additionally marked Secure in production environments. We do not use any tracking, analytics, or advertising cookies.

We do not sell, rent, or trade your personal data to any third party for commercial purposes. Data may be disclosed in the following limited circumstances:

• To The Eden Apis — for age-verification processing, as described in Section 5, operated by the same team.
• To Discord server administrators — activity logs relevant to their server are visible through the dashboard. These logs contain user IDs but not contact information.
• As required by law — if we are legally compelled to disclose information, we will do so only to the extent required and will notify affected users where permitted.

We implement reasonable technical and organisational measures to protect your data, including:

• HTTPS encryption for all data in transit
• HTTP-only and Secure session cookies to prevent client-side access
• Signed JWT tokens (HS256) to prevent session tampering
• Database access restricted to internal services only (not publicly exposed)

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Depending on your jurisdiction, you may have rights regarding your personal data, including the right to access, correct, or delete it. The appropriate action depends on the scope of the data you wish to remove:

• Opt out of cross-server verification — contact the administrator of the server where you are verified.

Please note that deletion of your data may limit or remove your access to features that require account linking or verification.

EdenPass is not directed at individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a minor has provided us with personal data, please contact us at lolmaxz@theedenapis.com and we will take steps to remove that information promptly.

We may update this Privacy Policy from time to time. When we do, we will revise the effective date and version at the top of this page. Continued use of the Service after any changes constitutes your acceptance of the updated policy.

Whenever this Privacy Policy is updated, all Discord server owners who have EdenPass installed will be notified. Notification will be delivered through one or more of the following channels:

• A blocking notice on the EdenPass dashboard requiring acceptance before continued use
• A Discord direct message sent to the server owner's Discord account by the EdenPass bot
• A message in the server's system channel (with a ping to the owner) when DMs are unavailable

Acceptance is required via the dashboard before you may continue using EdenPass. We encourage all users to review this page periodically. If you have questions about any changes, you may reach us at lolmaxz@theedenapis.com.

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us: