What a Demanus account stores, what it never stores, and how to be rid of it.
Last updated 7 September 2026A Demanus account exists so you can sign in to the sites on this network without inventing another password. To do that it needs to recognise you when you come back. That is the only thing it is built to do, and it is built to do it while knowing as little about you as possible.
We do not know your email address. We do not know your name. We could not email you if we wanted to, and we cannot sell a list we do not have.
DMN-4K7Q-91XZ, generated at randomThe second list is not a promise about our intentions. There is no column in the database for any of it. When you sign in, the service you used offers us your email, your name and your picture; the code reads one opaque identifier and discards the rest in the same operation, before anything is written down.
When you sign in with Discord, Discord tells us an account number. We never store that number. We combine it with a secret held only on this server and store the one-way hash of the result. Next time you sign in the same calculation produces the same hash, so we recognise you — but the stored value cannot be turned back into your Discord account, and it cannot be matched against a copy of the same data held anywhere else, including by us.
Sites on this network never see your account. They see a profile: a name, an optional tagline, an avatar link, a colour. You choose which profile each site sees, and you can give different sites different ones.
Alongside the profile a site receives your account handle, so it can recognise you when you return. It receives nothing else. There is no endpoint that will give a site your email address, because there is nothing to give.
Two, both strictly necessary, both essential to signing in:
demanus.sid — holds a session identifier and nothing else. Every
request checks it against the server, so ending a session ends it immediately
rather than whenever the cookie happens to expire.demanus.ext — exists for a few seconds between a sign-in service
answering and your session being created, then is deleted.There are no analytics, advertising or tracking cookies, and no third-party trackers. The account pages load a webfont from Google Fonts; nothing else leaves this server.
Open your account, go to Close this account, and confirm. This removes the account, every profile on it, every linked service and every session, immediately and for good. Sites that knew you as one of those profiles stop recognising you.
One thing survives: the security log keeps the fact that an account was created and later deleted, with its identifier and the times. It holds no personal data and exists so that a deletion cannot erase the record of itself. If that is not acceptable to you, do not create an account.
You can also unlink a single sign-in service without closing the account, as long as one way in remains.
Nobody. The data is not sold, rented, shared with advertisers, or handed to third-party analytics. It lives in one database used by the Demanus network and nothing else.
The sign-in services themselves — Discord, Google, Microsoft, Meta, X, Apple — will know that you signed in to Demanus, because you asked them to vouch for you. What they do with that is covered by their own privacy policies, not this one.
No system is perfect. If you find a problem, report it rather than testing how far it goes.
If this page changes, the date at the top changes with it. A change that would mean storing something from the "never kept" list would require adding a column to the database, which is a deliberate act, not an oversight — and it would be announced here before it happened.