I just remembered this might be illegal in the EU. A digital service company is not allowed to process identifying information unless in very specific circumstances (e.g. online banking or government processes).
That's straight up incompatible with GDPR in my opinion.