BOTLOBBIESIs DeviceAuth the same as my Epic password?
No. DeviceAuth is authorization material used to connect the bot; it is different from typing your Epic password into this website. The published policy says that this authorization is retained encrypted and can be revoked through Epic Games.
Distinguish the password from an authorization
The supported linking flow sends you through Epic's verification process and then confirms the linked account. The website does not ask you to post your Epic password in the bot panel or in a support chat. Once authorization exists, the service can use the resulting account authorization to connect the bot without asking you to type the password for every session. That distinction explains why a bot may reconnect after the original verification page has closed and why an authorization needs its own revocation consideration.
Treat stored authorization as sensitive
Being different from a password does not make an authorization harmless to share. It participates in account access and should stay out of screenshots, public logs, messages, and copied configuration files. The project encrypts stored secrets and filters sensitive fields from supported public bot representations. Those protections do not make every raw file or diagnostic message safe to publish. If you are asked for a report, provide the visible state and operation instead of the secret material used to authorize the account.
Use the right action to end access
Stopping the bot, logging out of the website, cancelling a subscription, and revoking an Epic authorization are different operations. The privacy page explicitly says that DeviceAuth is retained without automatic deletion, including for trials and paid access. If your aim is to remove the ability to connect through that authorization, use Epic's own revocation controls and follow any relevant account instructions there. If your aim concerns stored service records as well, make a separate data request through the contact on the privacy page.