Privacy Policy
Last updated: 25 October 2026.
This covers getexernality.cc and the Exernality desktop app. It says what is stored, why it is stored, who can see it and how to have it removed. If something here does not match what the site does, the site is wrong and we will fix it.
Signing in with Discord
There is no password to create: the only way in is Discord, and we ask Discord for the identify scope alone. From that we keep your Discord user id, username, display name and avatar, so the site can show you who you are signed in as. We never receive your email address, your password, your messages or the list of servers you are in.
When you claim free access we ask Discord whether your account is a member of the Exernality server. We keep the answer, not a copy of your membership.
What an account holds
- Your Discord id, username, display name and avatar.
- When your access runs out, and whether the account is banned.
- When the account was created and when it last signed in.
Sessions
Signing in creates a session. We store a SHA-256 hash of the session token rather than the token itself, so a copy of the database does not hand anyone a working login. Beside it we keep whether the session belongs to the website or the desktop app, when it started, when it expires, when it was last used, the IP address it was last seen from and the browser or app that created it. Website sessions last seven days and app sessions thirty, and signing out ends them immediately.
Cookies
One cookie, __Host-exe_sid. It is the session and nothing else: HttpOnly, so no script can read it, and SameSite=Lax, so it is not sent from other people's sites. There are no analytics cookies, no advertising cookies and no third-party cookies, and these pages carry no analytics or advertising scripts.
Keys and free access
A paid key records which account redeemed it, how many days it was worth and when that happened. Free access runs through Work.ink: the Get Key button sends you to their site, which has its own privacy policy and is not ours to control. When you come back we store a one-way hash of the token they return, the id of the link, whether the time was granted or refused and why, the IP the request came from, and the times. The hash is what stops the same completion being spent twice. Invite rewards keep the Discord id they were credited to, the reward id and the hours.
The activity log
Signing in, redeeming a key, a ban, an access change: each writes one row holding the event, a short detail, the IP address and the time. It exists so that abuse, replayed key links and stolen sessions can be looked into, and so a support question has an answer.
Why any of it is kept
To run accounts and keep access honest, to stop one free key being claimed many times over, to rate-limit sign-ins and key claims, and to answer support. Nothing is collected to build a profile of you, and nothing is used for advertising.
Who can see it
The owner of the site, through the owner dashboard, and nobody else. It is never sold, rented or handed to advertisers. The companies that necessarily handle it in passing are Vercel (hosting), Turso (the database), Discord (sign-in) and Work.ink (free keys only). We would hand something over to the authorities only if the law actually required it.
The desktop app
Your scripts, your editor tabs and your settings live on your own machine and are never uploaded. The app talks to this site to sign in, to check that your access is still valid and to record that an injection happened; it does not send us the scripts you run, your files or anything about the games you play.
How long it is kept
Sessions disappear when they expire or are revoked. Sign-in states and pending key claims are short-lived by design, minutes rather than days. Account rows and the activity log stay while the account exists, because that is what the account is.
Having it deleted
Ask on the Discord server and the account row and everything keyed to it, including sessions, key history and log entries, will be deleted. Deleting the account also ends any access time left on it, so it cannot be reversed afterwards. You can also just sign out everywhere from your account page, which ends every session without removing the account.
Age
Exernality is not meant for children under 13, and accounts are not knowingly created for them. If you believe one has been, say so on Discord and it will be removed.
Changes
If what is collected changes, this page changes with it and the date at the top moves.
Contact
Anything about this page, or a request to delete an account, goes through the Discord server: discord.gg/YPxVnjZYC3.