I just remembered this might be illegal in the EU. A digital service company is not allowed to process identifying information unless in very specific circumstances (e.g. online banking or government processes).

That’s straight up incompatible with GDPR in my opinion.

Obligatory IANAL.