Privacy Policy

This Privacy Policy (the “Policy”) describes the processing of personal data when using the website discord-tickets.com, the dashboard and the Discord Tickets bot (together, the “Service”) provided by the RootCore team (the “Administration”).

The Policy forms an integral part of the Terms of Service. By using the Service, the User confirms having read the Policy and agrees to the processing described in it.

The Administration is not Discord. The Service is not affiliated with or connected to Discord Inc. Your Discord account and all messages on the Discord platform are processed by Discord Inc. under its own privacy policy, over which the Administration has no control.

The Administration also runs discord-webhook.com. The projects share a team but keep separate data and separate policies.

The Policy may be updated as the Service evolves, including when new bot features launch. The current version is always published on this page; its date is shown at the top of the document.

When you sign in with Discord (OAuth2, scopes identify and guilds): your Discord user ID, username, display name and avatar hash; the list of servers you belong to — their IDs, names, icons and your permission bits; OAuth access and refresh tokens. We do not request your e-mail, direct messages, friends list, connections or the ability to act on your behalf.

When a Server Administrator configures the Service: server ID and name; IDs and names of the selected channels, categories and roles; panel and topic settings — titles, texts, button labels, intake-form questions, welcome messages, close rules, auto-close windows, limits, log channel, language; who changed what and when.

When tickets run (bot): ticket metadata — number, topic, opening and closing times, who opened, claimed and closed it, the close reason; intake-form answers; messages inside ticket channels and threads — author ID and username, text, timestamps, links to attachments hosted by Discord. The data is stored to build Transcripts and statistics.

The bot reads messages only in the channels and threads it created for tickets. It does not read, store or analyse messages anywhere else on the server.

Automatically: web-server logs (IP address, user agent, requested URL, referrer, timestamp) and technical error reports (stack trace, request ID) — without message content.

We do not use advertising trackers, analytics pixels or fingerprinting, and we do not combine data with external advertising networks.

Signing you in and keeping the session between page loads.

Showing the servers the User can manage and letting the User configure them.

Running tickets: creating private channels and threads, pinging staff, applying close rules, archiving Transcripts.

Producing statistics for the server’s staff (response times, ticket counts and similar).

Keeping the Service secure, preventing abuse, diagnosing problems, protecting the rights of the Administration and third parties.

Complying with applicable law and lawful requests from competent authorities.

Where the GDPR or UK GDPR applies, the legal bases are: performance of the service requested by the User (Art. 6(1)(b)); the Administration’s legitimate interest in a secure and working service (Art. 6(1)(f)); the User’s consent where it is requested separately.

For the User’s account data and technical logs, the Administration acts as an independent controller.

For Members’ data submitted in tickets of a specific server, the purposes and means of processing are determined by that server’s Administrator; the Administration processes such data on the Administrator’s instructions solely to operate the Service. The duty to inform Members and to ensure lawful processing rests with the Server Administrator.

Members’ claims regarding the content, use and distribution of Transcripts are addressed to the Administrator of the relevant server. The Administration assists with deletion as described in section 9.

The site uses strictly necessary cookies only. No consent banner is required because nothing is tracked.

dt_session — the encrypted sign-in session; valid for 7 days or until you sign out.

dt_oauth — a one-time anti-forgery token used during the Discord sign-in; valid for 10 minutes.

Dashboard settings in preview mode may be kept in the browser’s local storage (localStorage) on the User’s device; they are not sent to the Administration and are removed by clearing the site data in the browser.

The server’s staff: administrators and the roles assigned to a topic can see that topic’s tickets and Transcripts.

Anyone with the link — only for Transcripts that a server administrator or staff member has explicitly made public. Sharing can be switched off at any time; the link stops working immediately.

Discord Inc. — as the platform every message passes through.

Hosting providers that store and process data on the Administration’s behalf under a data-processing agreement.

Competent authorities — where disclosure is required by law or court order, or to protect the rights and safety of the Administration, Users and third parties.

The Administration does not sell personal data and does not share it for advertising.

Sign-in session — 7 days or until sign-out. On sign-out the Administration asks Discord to revoke the tokens.

Server configuration — while the bot is installed on the server, then up to 30 days after its removal.

Tickets and Transcripts — until the Server Administrator deletes them, or up to 90 days after the bot is removed from the server.

Server logs and error reports — up to 30 days.

Backups may contain data for a limited time after deletion from the primary system and are overwritten in the normal course.

The Administration may keep data longer than the stated periods where necessary to comply with the law, resolve disputes and protect its rights.

All traffic is encrypted in transit (TLS). The session cookie is sealed with authenticated encryption and cannot be read or altered without the server key.

Everything Users write — transcript messages, intake-form answers and close reasons — is encrypted at rest in our database with AES-256-GCM. Reading the database files alone does not reveal the content of the conversations.

The bot requests the minimum Discord permissions its features need; access to production systems is limited to the people who operate them; backups are stored encrypted.

No system is perfectly secure. The Administration does not guarantee that unauthorised access is impossible and is not liable for incidents caused by third parties, vulnerabilities of platforms and providers, or the User’s negligence (including compromise of their Discord account).

If a breach affecting the User is discovered, the Administration will notify them within a reasonable time through the channels available to it.

Depending on jurisdiction, the User may have the right to access, rectify, delete, restrict or export their data and to object to certain processing.

Signing out deletes the session cookie and revokes the tokens. The application’s access can also be revoked in Discord under User Settings → Authorized Apps.

Server Administrators can delete panels, individual tickets and Transcripts in the dashboard, or remove the bot — after which the periods in section 7 apply.

Members who want a ticket they took part in removed contact the Server Administrator or the Administration with the server ID and ticket number.

Requests concerning these rights are submitted on the Administration’s official Discord server (section 14). The Administration may ask for proof of identity and responds within 30 days.

Users in the EEA, the UK and Switzerland may also lodge a complaint with their local data-protection authority.

The Service is intended for people who meet Discord’s minimum age (13, higher in some countries). The Administration does not knowingly collect data from anyone below that age.

If you learn that a child has provided us with data, let us know and it will be deleted.

Data is processed on servers located in the European Union.

If processing moves to another region, the Administration will put recognised safeguards in place (such as standard contractual clauses) and update the Policy.

Discord Inc. processes platform data under its own rules and in its own regions, which the Administration does not control.

The Administration is not responsible for the content of tickets, Transcripts or other Content submitted by Users, nor for the distribution of Transcripts through links enabled by server administrators and staff.

The Administration is not responsible for processing carried out by Discord Inc., hosting providers or other third parties, nor for the consequences of a compromise of the User’s Discord account.

To the fullest extent permitted by law, the Administration’s liability connected with data processing is limited as set out in section 11 of the Terms of Service.

The Administration may change the Policy unilaterally. A new version takes effect upon publication on this page; material changes are announced on the official Discord server.

Continued use of the Service after changes are published constitutes acceptance of the new version. If the User does not agree, the User must stop using the Service.

For questions about data processing, contact the official Discord Tickets Discord server. Please include the server ID and, for ticket matters, the ticket number.

Requests received through other channels may be left unanswered.