havoc records your discord user id and username when you verify. it also receives your ip address and builds an approximate browser/device fingerprint, plus a handful of independent device signals (things like your screen, graphics hardware, audio stack and installed fonts) used to notice when two accounts are probably the same device even after one setting changes. no other part of your discord profile is stored.

the ip address is hashed before storage and is never stored in plain text. the fingerprint and each device signal are also stored only as a hash -- what your browser reports is never kept in a readable form. discord oauth access and refresh tokens are encrypted at rest.

the record lets havoc grant the server's verified role and helps the server recognise when a banned person returns on a different account.

fingerprinting is approximate. browsers can hide or change its signals, so it raises the bar for casual ban evasion rather than making ban evasion impossible. the extra device signals only ever produce a "similar device" hint for staff to weigh -- they never trigger a ban or removal on their own.

havoc uses the stored authorization only to re-add you to the same server it was granted for, at that server's request, after the server has been recreated or has lost members.

it is never used to add you to a different server. every use is logged in the server that requested it.

verification records remain until the server operator removes them. blacklist entries are also kept until the server removes them.

you can revoke havoc's access at any time in discord's authorized apps settings. revoked records can be removed by server staff with the verify prune command. removing access does not automatically delete the record.