This Privacy Policy describes how TibiaEye ("we", "us", "our") collects, uses, and shares information when you use our Discord bot, associated web dashboard at tibiaeye.com, and related services (collectively, the "Service").
1. Information we collect
1.1 Information from Discord
When you sign in with Discord, we receive the following from Discord's OAuth2 API based on the scopes you grant (identify, email, and guilds):
- Your Discord user ID, username, and avatar
- Your Discord email address
- The list of Discord servers ("guilds") you belong to and your role within them, used solely to determine which servers you can configure
We do not receive your Discord password. We do not request any scope beyond those listed above.
1.2 Information you provide
- Tibia server selections, character names, and tracking list configurations you create inside the dashboard
- Guild configuration choices such as notification channels and feature toggles
- Billing contact details entered through our payment processor (see section 4)
1.3 Information collected automatically
- Session cookies (HTTP-only) used to keep you signed in to the dashboard
- Basic server logs (IP address, user agent, request path, timestamps) retained up to 30 days for operational and security purposes
We do not use third-party advertising, behavioral tracking, or cross-site analytics cookies.
2. How we use information
- To operate the TibiaEye bot inside the Discord servers you authorize
- To scrape public Tibia server pages you configure and post notifications to your chosen Discord channels
- To authenticate you when you access the web dashboard
- To process subscription payments and provide customer support
- To diagnose abuse, fraud, or security incidents
3. Public scraping of Tibia server data
TibiaEye scrapes publicly available character profile, online list, and deaths pages from the Tibia servers you configure. We only access pages that any browser visitor can reach without authentication, we identify our bot with a clear User-Agent, and we respect reasonable rate limits. Data we collect about in-game characters is not personal data of you, the TibiaEye user, and is used only to produce the notifications and analytics you requested.
4. Third-party processors
We share the minimum data necessary with the following sub-processors:
- Discord — identity provider and the platform where notifications are delivered
- Stripe — payment processing for paid plans. Your credit card details are handled directly by Stripe and never stored on our servers. See Stripe's privacy policy.
- Cloudflare — DNS and DDoS protection for tibiaeye.com
- Contabo GmbH (Germany) — infrastructure hosting for our application servers and PostgreSQL database
5. Data retention
We retain account data for as long as your account remains active. When you request account deletion (see section 7), we permanently remove your Discord identity, guild configurations, billing profile, and tracking lists within 30 days, except where a longer period is required by law (for example, payment records retained for tax purposes).
6. Data location
Our primary servers and database are located in Germany (European Union). Data may be processed in other countries where our sub-processors operate (for example, Stripe and Cloudflare infrastructure is global). Where personal data is transferred outside the EEA, we rely on Standard Contractual Clauses or equivalent safeguards.
7. Your rights
Under the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act, you have the right to:
- Access a copy of the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and associated data
- Request a portable export of your data in a machine-readable format
- Object to or restrict processing
- Withdraw consent at any time (without affecting the lawfulness of processing before withdrawal)
- Lodge a complaint with your local data protection authority
To exercise any of these rights, email us at the address in section 10. We respond within 30 days.
8. Children
TibiaEye is not directed at children under the age of 13 (or 16 in jurisdictions that apply the GDPR's higher threshold). We do not knowingly collect data from children. If you believe a child has used the Service without guardian consent, contact us and we will delete the account.
9. Changes to this policy
We may update this policy from time to time. Material changes will be announced in the TibiaEye Discord and via email to account holders at least 14 days before taking effect.
10. Contact
Questions, rights requests, or complaints about this policy: privacy@tibiaeye.com.