Discord authentication
RYCP uses Discord OAuth for sign-in instead of creating a separate RYCP password database. Sessions are stored in signed, HTTP-only, Secure cookies with SameSite protection. RYCP never asks for your Discord password or token.
Permissions and staff access
Public pages expose only approved profile and review information. Dashboard changes require a signed-in matching Discord identity. Server pages are restricted to the server owner recorded by the connected bot.
Staff workspaces check configured Discord roles. Sensitive moderation actions are logged, and high-impact application decisions are restricted to authorized roles.
Review protection
New reviews enter a moderation queue before they affect a public score. Reviewers are tied to Discord identities, duplicate and self-review checks are applied, and staff can request proof where a submission needs more verification.
Proof attachments are served through controlled private storage routes and are not listed on public profiles unless an approved review intentionally includes a public attachment.
Upload safety
Review uploads are restricted to supported image, PDF and text formats with a 4 MB limit. File keys are randomized, file responses prevent content-type sniffing, and evidence access does not expose the underlying storage service.
Payments
Stripe hosts the checkout and billing portal. RYCP stores subscription references and status needed to unlock Pro, but does not store full payment-card details. Stripe webhook signatures are checked before billing events change account access.
Data minimization and deletion
RYCP collects the information needed for profiles, reviews, moderation, Discord integration and subscriptions. Signed-in users can export or delete their RYCP account data from Your data & account.
What users should do
Protect your Discord account with a strong password and two-factor authentication. Never send passwords, bot tokens, recovery codes or full payment details through an RYCP review or Discord ticket. Only upload evidence you are permitted to share.