Privacy Policy

When you sign in with Discord, we receive your Discord user ID, username, and avatar. We store these to identify your account on the platform.

We also store which servers (guilds) you have configured through the dashboard, along with the settings you have saved for those servers.

When the Tickey bot is present in a Discord server, it collects the following data automatically as part of its operation:

• Discord user IDs and usernames of any member who opens a ticket, has a ticket opened about them, or is added to a ticket by staff
• Ticket metadata — ticket number, subject, open time, close time, status (open / claimed / closed), close reason, and which staff member claimed or closed it
• Ticket messages — all messages sent inside a ticket channel (text content, attachment URLs, and embed data) are stored to enable transcript generation. This includes messages from both the user and any staff who reply
• Server configuration — category IDs, log channel IDs, staff role IDs, and other settings saved via /setup
• Audit log events — if log events are enabled (e.g. member join/leave, message deletes), basic event data (user ID, timestamp, action type) is stored

The bot does not read or store messages from channels that are not active ticket channels, unless an explicit log event (e.g. message-delete logging) is enabled by the server administrator.

We do not collect or store your Discord email address, phone number, or any message content from your servers outside of active ticket channels.

We do not sell or share your data with third parties for marketing or advertising purposes.

Every message a user sends inside a ticket channel is stored in our database. This data is used solely to:

• Generate HTML transcripts when a ticket is closed
• Allow staff to review ticket history through the dashboard

Ticket message data is linked to the Discord user ID of the author. Users who are not registered on the Tickey dashboard (i.e. have never signed in) can still have messages stored if they participate in a ticket in a server that uses Tickey.

If you are a server member (not an admin) and want your ticket message data removed, please contact the server's administrator or reach out to us directly. We will process deletion requests within a reasonable timeframe.

When a staff member uses moderation commands (/mod ban, /mod kick, /mod warn, /mod mute), the following is recorded in the server's configured mod-log channel:

• The Discord ID and username of the moderated user
• The action taken and the reason provided
• The Discord ID of the moderator who issued the command

This data is posted as a Discord embed in the server's mod-log channel and is not stored separately in Tickey's database beyond what Discord retains in that channel.

When banning or kicking a user, the bot will attempt to send them a direct message (DM) notifying them of the action and reason. If DMs are closed, no message is sent and no error is recorded.

• ts_session — an HTTP-only JWT cookie used to keep you signed in. It expires after 7 days.
• ts_last_guild — a convenience cookie that remembers the last server you opened in the dashboard. It contains only a Discord server ID.

No tracking or analytics cookies are used.

Authentication is handled through Discord OAuth2. We request the identify and guilds scopes. The identify scope gives us your basic profile. The guilds scope lets us show you which servers you are in so you can pick one to configure.

We store your OAuth access token in an encrypted form so the dashboard can fetch your current guild list. We do not use this token for any other purpose.

If you are a Discord user who has sent messages in a ticket channel on a server that uses Tickey, your Discord user ID and message content from that ticket may be stored even if you have never visited the Tickey dashboard or created an account.

This data is collected solely because a server administrator invited the Tickey bot to their server and enabled the ticket feature. You can request deletion of your data by contacting us directly (see section 10).

Data is retained as follows:

• Account data (user ID, username, avatar) — kept until you request deletion
• Server configuration — kept until the bot is removed from the server and a deletion is requested, or until the server is deleted from Discord
• Ticket records and messages — kept indefinitely to preserve audit history. Server admins can request bulk deletion for their server
• Transcripts — kept alongside ticket records; deleted when the associated ticket record is deleted
• Sessions — automatically expire after 7 days

If you want your data removed, you can contact us through the support channel on Discord and we will delete your account and all associated configuration data.

OAuth tokens are encrypted at rest using AES-256-GCM. Sessions are signed JWTs stored in HTTP-only cookies. All API routes enforce permission checks so you can only access data for servers you are a member of.

Bot protection (Cap). Signing in with Discord, the web verification page, ban appeals and the bug report form are protected by Cap, an open-source CAPTCHA that we host ourselves on our own server (cap.uplance.cloud); no CAPTCHA company is involved. When you use one of these, your browser solves a small proof-of-work task and runs a short browser check, and our Cap server processes your IP address to do this. These requests pass through Cloudflare, Inc. (network delivery and protection against attacks), which therefore also sees your IP address. Cap sets no cookies.

Depending on your location, you may have the right to access, correct, or delete personal data we hold about you. To exercise any of these rights, contact us via the support channel in our Discord server. We will respond within 30 days.

If we make significant changes to this policy, we will update the date above. Continued use of the service after changes means you accept the updated terms.