Your access, explained.
Secure HttpOnly cookies keep your sign-in private. Sessions last 30 days and renew during regular use. For members, testers and admins, this browser can also remember access for 365 days and restore an expired session automatically. Signing out clears this browser’s remembered sign-in. Your invitation, access status, and optional note are stored on the server. Only the owner can read notes and manage approvals.
If you connect Discord, your Discord identity is stored and membership, roles, bans and timeouts are checked to manage download access.
Network addresses are hashed to help limit repeated guesses. They do not prove identity. There is no device fingerprinting or advertising tracking.
Everyone who joins with an invitation receives a personal key once. Save or copy it privately to restore the same account after clearing cookies or on another browser or device. A key keeps the account’s current role and status; it does not bypass owner approval, revocation or Discord restrictions. The owner can reset an individual key, ending that account’s existing sign-ins and remembered browsers while preserving the account. Admin referral invitations are separate: their first use grants admin access, and later uses create member requests. A linked Discord account can also restore its website session using a fresh /verify link. The owner can recover with the private owner key.
