Security

Keys and tokens

• Encrypted. Your key is encrypted before we save it, and the encryption key is kept somewhere else. A stolen copy of our database can't unlock it.
• Tested first. /setup checks the key works before saving it.
• Never shown. It never appears in Discord, on the website or in any log. /playfab status only shows the last few characters.
• Easy to remove. Run /playfab disconnect, or delete the key in PlayFab.

Permissions

EzAdmin never asks for Admin permission. Risky things like unbanning or giving items are off for staff until you, the owner, turn them on. Discord's Admin permission does not unlock them.

See the full list on the commands page.

A staff role can never be set up to give in game items, and nobody can approve their own request.

The dashboard

• Sign in with Discord. We can see your name and your servers. We can't read your messages or act as you.
• Only people you add. Only you and the staff you add can open your server's dashboard. Having Admin in Discord isn't enough.
• Two step sign in. Turn it on from your Account page.
• See every sign in. Your Account page shows every device signed in as you, and you can sign any of them out. Sign ins end after 7 days.
• Protected forms. Other websites can't make changes for you.

Support access

Our team can't open your dashboard unless you let us in. You choose how long, up to 72 hours, and you can end it early. Everything we do is in your audit log.

Players

• IDs are hidden. Staff only see part of a player's ID unless you allow more.
• No location or email. We never ask PlayFab for those.
• Linking is their choice. Players link their own accounts and can unlink with /unlink.
• Public ban lists have no names. Only reasons and dates.
• Their DMs, their choice. Players can turn off our messages with /notifications.
• Their data on request. Anyone can ask to see or delete what we have. See the Privacy Policy.

Reports and anti tamper

• People decide. Reports go to your staff. Nothing is banned automatically unless you turn that on.
• No fake reports. Nobody can send a report pretending to be someone else.
• Ban notices are checked. We check with PlayFab that a ban is real before posting it.
• Only your game is checked. Anti tamper never looks at players' other files or takes screenshots.

Payments

• We never see your card. The payment company handles it.
• Payments are checked. Fake payment messages are ignored.

What this doesn't cover

Encryption protects your key if our database is stolen. Like any bot you give a key to, you're still trusting whoever runs it. Make a PlayFab key just for EzAdmin so you can delete it any time.

Playtime in PlayFab games comes from the player's device, so a hacked copy could fake it.

Report a problem

• Security problem. Open a Bug report ticket on the support page. Please keep it private until it's fixed.
• Someone misusing EzAdmin. Open a ticket and pick Report a server or player. We won't say who reported them.
• Your data. Open a ticket and pick Privacy or my data.

Policies: Terms of Service, Privacy Policy, Acceptable Use and Refunds.