Security
Rook keeps no IP addresses.
A verification bot sees the address of everyone who verifies. In October 2026 Double Counter reported that millions of them may have been exposed. Rook stores a keyed fingerprint instead. Turning one back into an address needs a secret key, which is kept apart from the database.
How Rook matches accounts
IP addressWhat Rook stores
- A member verifies on rook.botTheir address reaches Rook's server through Cloudflare.
- Rook makes a keyed fingerprintRook makes a separate key for each server from a secret kept apart from the data, so the same address gives a different fingerprint in every server. IP and device-settings fingerprints then go through Argon2id, which needs about 100 ms and 64 MB of memory per guess. Even someone with the key would need months on one machine to work back to a server's addresses.
- Rook drops the addressThe address is never written to the database. Two accounts with the same fingerprint used the same connection or device. Rook allows for addresses that many homes share.
- Rook checks the device and the accountSome of the device's settings become another keyed fingerprint, kept only when it can tell devices apart. Rook also tells staff when a newcomer resembles a recently banned account. Neither keeps anyone out on its own.
What Rook keeps, and for how long
| Data | Kept for |
|---|---|
| Verification fingerprints | While the member is in the server or banned from it, then 90 days |
| Moderators' decisions | 1 year |
| Bans, with the banned account's simplified name and avatar ID | Until the member is unbanned |
| Dashboard sign-ins | 7 days |
| Privacy requests, including emails | 2 years |
| Scam protection fingerprints | 48 hours |
| IP addresses and message text | Never stored |
Members can see and delete their data
Any member can download or delete their records with /rook privacy. Records from a server they're still in, or banned from, stay until that ends, so deleting them can't hide an alt.
Rook runs in the Netherlands and is run by Sirius, in the UK. The privacy policy has the detail.