Cookie Policy

Aeon (“we”, “us”, or “our”) uses cookies, local storage, and similar technologies on our website and web dashboard to keep you signed in, remember your preferences, protect against payment fraud and verification abuse, and understand how our services are used. This policy should be read with our Privacy Policy.

1. What Are Cookies?

Cookies are small text files or browser storage elements placed on your device when you visit our website or authenticate via Discord. We also use related technologies such as HTTP-only device identifiers and, where a server enables hosted verification, hashed network and browser signals used only for abuse and alt-account detection.

2. Cookies We Use

We categorize the cookies and storage technologies we use into the following types:

Essential Cookies & Local Storage (Strictly Necessary)

These are required for the website, payment system, verification flows, and dashboard to function properly. They cannot be disabled without breaking those features.

• Authentication & Sessions, Remembers your Discord OAuth login state across requests.
• Security & CSRF Protection, Prevents cross-site request forgery attacks on forms and API actions.
• Fraud Prevention & Payments (Stripe), Our payment processor, Stripe, sets essential security cookies (for example, __stripe_mid, __stripe_sid) to identify devices, detect bad actors, and prevent fraudulent payment attempts during checkout.
• Verification device cookie, On verification, ban appeal, and login paths we may set a long-lived HTTP-only device identifier (for example, aeon_vid) so the same browser can be recognized across visits.
• Verification digital fingerprint (hosted verify & appeals), When a server uses hosted / fingerprint verification, or when you submit a ban appeal through our hosted appeal flow, we process and store keyed HMAC-SHA256 digests of your IP address (and related network prefix where used) and of client fingerprint material (including user-agent and canvas / WebGL / audio / fonts / math digests), together with client signals: timezone, languages, platform, screen characteristics, webglRenderer, colorDepth, hardwareConcurrency, deviceMemory, storageQuotaGb, automationScore, and fingerprintBlocked. Soft signals stored in plaintext (unhashed) include timezone, languages, platform, screen, and webglRenderer. We may also store server-derived ASN, ASN organization, and ipClass (ASN organization and ipClass in plaintext). These captures feed Aeon’s mandatory network-wide anti-abuse pool (no per-server opt-out) so other Aeon servers can flag likely alternate accounts. Digests and related records are retained for about 90 days, then pruned. Server staff may see matched Discord user ids and scores for moderation; they are not shown which other server contributed a signal. We do not use this fingerprint to serve ads or build marketing profiles. See our Privacy Policy for processors (including MaxMind GeoLite2-ASN and optional IPinfo) and how to request erasure.

Preference Cookies (Functional)

Stored locally in your browser to remember user interface choices (such as sidebar expanded/collapsed state, dashboard filters, or other layout preferences) so you do not have to reconfigure them every visit.

Analytics Cookies (Performance)

We may use anonymized, privacy-friendly page view measurement tools to understand traffic trends and improve our public pages.

• Under applicable UK/EU data protection laws, non-essential analytics cookies are only set if you give consent (or can be managed via our cookie banner/settings).
• Analytics data is aggregated and is not used to build individual user profiles or target advertisements.

3. Third-Party Cookies

When you make a payment, sign in, or complete hosted verification, third-party infrastructure providers, specifically Stripe (payment processing and fraud detection) and Discord (OAuth login authentication), may place essential operational cookies on your device to execute those services securely. Verification fingerprint processing is performed by us (including for ban appeals) and feeds the mandatory network-wide pool described in Section 2 and our Privacy Policy. ASN enrichment may use local MaxMind GeoLite2-ASN data and, if configured, IPinfo.

4. Managing and Disabling Cookies

You can control or delete cookies through your browser settings at any time:

• Essential note: If you block or clear strictly necessary / essential cookies (including session and verification device cookies), you will be unable to sign in to the Aeon dashboard, complete payments through checkout, or successfully complete hosted verification in some configurations.
• Public pages and documentation will continue to work even if non-essential or analytics storage is blocked.
• Blocking fingerprint-related browser APIs (for example via anti-tracking extensions) may cause verification to treat the session as higher risk or require staff review, depending on the server’s settings.

5. Contact

If you have questions about our use of cookies or browser storage, please contact us at: contact@aeonbot.org.