Privacy & security
What this website gets from your Discord account, what it keeps, and how to check every point yourself — you don't have to take our word for it.
It cannot take your Discord token or password
You sign in through Discord's own login page (OAuth). Discord never gives any website your token or your password — not this one, not any other. A website on another address also cannot read what the Discord app stores on your computer; your browser keeps them apart.
Real token grabbers need you to download a program or paste code into your browser console. This site never asks for either. If anything ever does, don't.
Discord shows you what it gets — not us
The site asks Discord for exactly one permission: identify. On Discord's login screen that reads "Access your username, avatar and banner". Nothing else: no messages, no servers, no e-mail, no friends list.
Check it: after signing in, open Discord → User Settings → Authorized Apps. The app is listed there with that one permission, and Deauthorize removes it at any time.
The permission Discord hands back is used once, to read your Discord id, name and profile picture, and then thrown away. It is never stored.
Your browser stops it sending data anywhere else
Every page carries a security rule your browser enforces. It lets the page talk to tsc-sd.duckdns.org only, and load pictures from Discord's image server — nothing else. Even a page that tried could not send your data to another site.
Check it: press F12 → Network, reload, and click any request: every one goes to tsc-sd.duckdns.org (and cdn.discordapp.com for profile pictures). Under Response Headers you will find this rule, word for word:
default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' https://cdn.discordapp.com https://media.discordapp.net; connect-src 'self'; form-action 'self' https://discord.com; frame-ancestors 'none'; base-uri 'none'IP addresses
Every website you open sees your IP address — Discord, YouTube and Roblox included; that is how the internet delivers the page to you. What matters is whether it is kept. Here it is not:
- The web server keeps no access log, and its error log has the IP address removed before anything is written.
- The sign-in page limits how often one address may try per minute. For that the address is held in memory for one minute, then forgotten. It is never written to disk or a database.
What is kept
- A sign-in cookie with your Discord id, name, profile picture and when it expires (12 hours). It is signed so it cannot be forged, and scripts cannot read it.
- A note in the server log when you sign in or save something: your Discord id and name — no IP address.
- Your SD record — rank, XP, quota, logs — which the Security Department keeps anyway and which is on the SD Tracking Sheet.
- Your settings, including your time zone: its name (like
Europe/Berlin), read from your computer's clock setting so event times are right. It is not your location. - Pictures you upload as proof go onto the log's review card in the SD Discord, where HICOM check them — the same as filing in Discord.
- If you are HICOM: other HICOM on the site see that you are there and on which page, with your Discord name and picture. That is held in memory only and gone when you sign out.
Members see their own record; HICOM see the department's. Nothing is sold or shared outside SD, and there are no adverts, trackers or analytics on this site.
A second opinion
Independent tools can look at the site from outside: securityheaders.com grades the security rules, and urlscan.io lists every address a page contacts. Enter https://tsc-sd.duckdns.org — on urlscan, choose Unlisted if you do not want the scan to be public.