Privacy Policy

Last updated: October 21, 2026

This translation is provided for convenience only. In the event of any discrepancy, the French version prevails.

This policy describes how GONOTECH ("TickServ", "we") processes your personal data in connection with the https://tickserv.com service, in accordance with the General Data Protection Regulation (GDPR) and the French "Informatique et Libertés" law.

1. Data Controller

The data controller is GONOTECH, EURL, 54 rue Paul Lafargue, 69100 Villeurbanne, France (see Legal Notice).

Contact for any question about your data: support@tickserv.com. (We are not required to appoint a data protection officer; this contact handles your requests.)

2. Data We Process

We apply the principle of data minimization: we only collect what is necessary.

Account: e-mail address and its verification status, account identifier at Clerk, sign-in provider (Google or Discord) if you use one, preferred language, referral code, dates of account creation and first top-up. Source: you, your sign-in provider.
E-mail preferences: the "your server is ready" e-mail (on by default; it is a service e-mail) and tips and reminder e-mails (off by default, see §3); history of your unsubscribes and resubscribes, and of the bounces or "spam" reports passed on to us by our e-mail provider.
Payment: wallet movements (top-ups, hourly charges, free credits, refunds), billed game sessions (dates, duration, amount, region), payment identifiers at Stripe (customer, payment method saved for auto top-up), auto top-up settings, promo codes used, referrals and contributions to shared pools; time-stamped proof of your request for immediate performance (waiver of the right of withdrawal, art. L. 221-28 of the French Consumer Code) and, where applicable, of your waiver of the refund of your balance when deleting your account (amount and date). We never see or store your card number: it is entered at Stripe.
Servers: game, name, size, country, IP address of the machine, settings (including the usernames you add as operators or to the whitelist), mods, schedules, Discord webhook URL if you enable notifications; members of your servers (their internal identifier and role, never their e-mail address) and invitation links (kept as a hash, with their role, number of uses and expiry date).
Worlds and files: current world, backups, worlds you import, world map (Valheim), files you upload or download from the console, commands you type in the console and their output.
Players on your servers: usernames of connected players, read by your server while it runs, to show them to you, to the server's members (and to our support), and to count the distinct players of a session; game logs — the last lines the game writes, shown live in the console and, when a start fails, the end of that log kept to diagnose the failure. These logs may contain players' usernames and anything the game writes there; we only mask the server's administration passwords.
Operations log: actions performed on your account and servers (start, stop, settings change, backup, restore, payment, e-mail sent), with their date, outcome and context; visit date (one per day and per device, with country and device type, no IP address); the country of the request when you start a server (a country code, no IP address); your optional answer about why you stopped, if you give it with one click from our follow-up e-mail, kept with your account; number of distinct players in a game session — the usernames themselves are not in it, except in the end of the log of a failed start (above).
Support: messages in your support thread (the help widget in the console and our replies) and e-mails you send to support@tickserv.com from your account address (subject and text, without attachments or quoted history); for each request, the console page you wrote from.
End-of-session survey: your ratings (1 to 5) and your free-text suggestion if you write one — optional answer, one per account.
AI crash explanation: when you click "Explain with AI" after a failed start, the explanation produced (see §4) and the number of requests that day.
Technical: connection logs, IP address, anti-bot security data (Turnstile, when creating a server).
Visit origin: arrival channel (direct access, search, AI assistant, social network, referring site, campaign), utm_* parameters present in the link (source, medium, campaign), domain name of the referring site, path of the landing page, date of first contact. We never record the advertising click identifier (gclid, fbclid, msclkid…): its mere presence in the link files the visit under the "campaign" channel. Source: automatic (ts_ft cookie, see §8).
Audience measurement: page viewed, event triggered (e.g. creating a server, topping up), country, device type, browser, language, site or search engine you came from — without any account identifier and without cookies. Source: automatic (Umami, see §4).
How you heard about us: your answer to the question asked in the console (Discord, Reddit, a search, a friend, a video — and the free text if you write one) — optional answer, you may decline it.
Ideas and votes: requests you post on the "Ideas & requests" board (category, title, details) and your votes — visible to other signed-in members, without your name or e-mail address.
Content reports: if you report illegal content through the "Report content" form (open to everyone, no account needed): reason, server concerned, description, your name and e-mail address (optional for a report of child sexual abuse).

No sensitive data is collected. The service is not intended for minors.

3. Purposes and Legal Bases

Purpose	Legal basis (GDPR)
Creating and managing your account, providing the service (servers, worlds, backups, console, members, wallet)	Performance of the contract (art. 6.1.b)
Showing connected players, checking Minecraft usernames, diagnosing a failed start from the game logs	Performance of the contract (art. 6.1.b)
Explaining a crash with AI, at your request	Performance of the contract (art. 6.1.b) — a feature you trigger yourself
Processing payments and giving you a receipt for each top-up (an invoice is issued on request to support)	Performance of the contract + legal obligation (accounting and tax, art. 6.1.c)
Keeping accounting records after the account is deleted	Legal obligation (art. 6.1.c; art. L. 123-22 of the French Commercial Code)
Sending you service e-mails (receipts, server ready, keeping your world, balance, alerts about your server, security)	Performance of the contract (art. 6.1.b)
Sending you tips and reminder e-mails (welcome, help with your first start, a reminder when your credit sits unused)	Your consent (art. 6.1.a; art. L. 34-5 of the French Postal and Electronic Communications Code) — box unticked by default
Security, prevention of fraud and abuse (Turnstile, logs)	Legitimate interest (art. 6.1.f)
Referral program, promo codes	Performance of the contract / legitimate interest
Discord notifications for your server	Your consent (optional activation)
Responding to your requests (support) and being alerted when they arrive	Legitimate interest (art. 6.1.f)
Collecting your end-of-session feedback and your game and feature ideas	Legitimate interest (service improvement)
Knowing how you found us (internal audience measurement)	Legitimate interest (art. 6.1.f) — right to object, see §7
Measuring site audience and spotting the steps where the journey gets stuck	Legitimate interest (art. 6.1.f) — right to object, see §7
Collecting your answer to "how did you hear about us?"	Your consent (optional answer, may be declined)
Handling reports of illegal content and informing their author of the decision	Legal obligation (Art. 6(1)(c); Regulation (EU) 2022/2065, Art. 16)

Tips and reminder e-mails are only sent if you ticked the box provided at sign-up or turned the option on in "My account". You withdraw your consent in one click, with the link in each of them or from "My account". Service e-mails do not depend on this choice.

Providing account and payment data is necessary to use the service; without it, we cannot provide it.

4. Recipients and Sub-Processors

Your data is accessible only to our authorized staff and to the sub-processors strictly necessary for the service to operate:

Clerk — authentication and account management;
Stripe — secure payment processing;
Cloudflare — hosting of the site, the database and worlds (R2), receiving e-mails sent to support@tickserv.com, domain names of your servers, anti-bot protection (Turnstile);
Cloudflare Workers AI — artificial intelligence model that writes the "Explain with AI" explanation from the end of the log of a failed start (which may contain players' usernames). This feature only runs at your request. The resulting text is AI-generated, presented as such, and may be wrong;
Resend — sending all our e-mails (recipient address, content, internal account identifier and the e-mail's name, used to handle bounces and unsubscribes);
Umami Cloud — site audience measurement;
Cloud infrastructure providers — running game servers. Data centers in the European Union, the United Kingdom, Switzerland and Canada; one of these providers is operated by a company established in Hong Kong (see §5). The named list of these sub-processors is provided on simple request to support@tickserv.com;
Discord — our internal alerting tool: it tells us about an event (new support request, reply in a thread, low rating, incident on a server, payment). These alerts contain neither your e-mail address nor the content of your messages: only your account's internal identifier, a link to your record in our back office and technical information (server, amount, payment country).
Google (Gmail) — the operator's support mailbox, which receives a copy of e-mails sent to support@tickserv.com (United States);

Each acts on our instructions under a GDPR-compliant data processing agreement.

The following also receive some of your data, on their own behalf:

Google / Discord — only if you choose this sign-in method; Discord also if you enable your server's notifications, which are posted to your channel (server name and address, status, session cost, number of players). If you contribute to the shared pool of a server whose owner has enabled these notifications, the part of your e-mail address before the "@" appears there as your name;
Mojang (Microsoft) — when you add usernames as operators or to the whitelist of a Minecraft server, we send them to Mojang to check that they exist. We keep nothing from its reply;
factorio.com (Wube Software) — if you link your factorio.com account to install Factorio mods in one click, we send your username and service token to the mod portal to search for and download mods on your behalf. The token is stored encrypted, is never passed to your server, and is deleted when you unlink your account or delete your TickServ account;
members of your servers see the usernames of connected players and the server's activity.

Latency estimate — on the pages for creating a server and changing its country, the response time to each country is estimated by our servers from the approximate location of your connection (a city derived from your IP address) provided by Cloudflare, already listed above. Your browser contacts no third-party test point; nothing is stored.

We do not sell your data.

5. Transfers Outside the European Union

Some sub-processors and recipients (Clerk, Stripe, Cloudflare — including Workers AI —, Resend, Google, Discord, Mojang and its parent company Microsoft) are established in, or may process data in, the United States. These transfers are governed by the appropriate safeguards provided for by the GDPR: the European Commission's standard contractual clauses and/or certification under the EU–US Data Privacy Framework, depending on the provider. Our main database, meanwhile, is located in the European Union.

Our audience measurement provider (Umami Cloud, a company established in the United States) operates servers in the European Union and in the United States; its data processing agreement incorporates the European Commission's standard contractual clauses (Decision 2021/914) for any transfer outside the Union.

Game servers are located in the country you choose when creating them: Germany, Finland, France, Italy, Poland, Romania, the United Kingdom, or Canada (Quebec). If unavailable, the server is started in another data center on the same continent — in Europe, in one of these countries, in Latvia or in Switzerland: a server requested in Canada is never moved to Europe, nor the reverse.

The United Kingdom, Switzerland and Canada are subject to an adequacy decision by the European Commission — for Canada, limited to commercial organizations subject to the Canadian federal law on the protection of personal information (PIPEDA) — which authorizes this transfer without additional safeguards.

Some of our cloud infrastructure providers process data, or are established, outside the European Union: in the United Kingdom, Switzerland and Canada (countries covered by an adequacy decision, see above) and in Hong Kong. One of these providers is operated by a company established in Hong Kong, including when your server runs in a data center in the Union: its access to the infrastructure hosting it constitutes a transfer outside the Union, to a country not covered by an adequacy decision. This transfer is governed by the European Commission's standard contractual clauses. We do not link a provider to a country here; the named list of sub-processors is provided on simple request to support@tickserv.com.

6. Retention Periods

Account and associated data (e-mail, preferences, servers, worlds and backups, members and invitations, support thread, survey, promo codes and referrals, operations log): for the whole life of the account. When the account is deleted, everything is erased immediately, except the accounting records below, and at the same time we ask Clerk to delete your identity.
Accounting records — wallet movements, billed sessions, proof of your request for immediate performance (art. L. 221-28) and of your waiver of the balance refund: 10 years from the deletion of the account (art. L. 123-22 of the French Commercial Code and tax obligations), under a pseudonym: they are attached to a new random identifier, without your e-mail address or your Clerk identifier, then erased automatically. Stripe keeps its own payment records on its side, in line with its obligations.
Contributions to the shared pool of a server you do not own: they remain in that pool's history, which belongs to its owner, attached to an identifier that no longer matches any account.
Departure statistic: on deletion, we keep one anonymous line (account lifetime, number of servers, games, reason for leaving if one was given, arrival channel, end-of-session rating), with no identifier or e-mail address.
Operations log (actions, visits, e-mails sent, game sessions, end of the log of a failed start) and AI crash explanations: 12 months, then deleted automatically — including after a server is deleted — and immediately when your account is deleted. The daily counter of explanation requests is kept for 90 days.
Usernames of connected players: erased each time the server stops. Game logs shown live: only the last lines are kept; they are replaced as they come and erased at every start and when the server is deleted.
Console commands and file operations (including files uploaded or downloaded): 24 hours after they finish.
Deleted server: it stays 24 hours in the trash, then its world, backups, map, members and invitations are permanently erased.
Worlds of an inactive server: kept as long as the server is used; after 180 days without a start, the world and its backups are deleted, after two e-mail reminders (at 150 and 165 days). For an account that has never topped up by card: deletion after 30 days, reminders at 15 and 25 days, and backups kept 7 days at most. The number of backups kept depends on the server's plan (see Terms of Sale).
Invitation links: valid 24 hours, 7 days or 30 days as you choose; deleted with the server.
E-mails sent to support@tickserv.com: one copy is filed in your support thread (deleted with the account) and another is forwarded to our support mailbox.
Ideas and votes: deleted with the account — your requests disappear from the board and your votes no longer count. You can also withdraw a request at any time from the board.
Visit origin: kept for the whole life of the account, then deleted with it. The cookie that carries it expires after 6 months.
Your answer to "how did you hear about us?": kept for the whole life of the account, then deleted with it. We ask the question only once, and declining to answer is final.
Technical and security logs: 12 months maximum.
Audience measurement: 6 months at Umami (Umami Cloud free plan), then deleted.
Content reports: kept while under review, then for 12 months after the decision, and deleted automatically afterwards.

7. Your Rights

Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection (for processing based on legitimate interest), portability, and the right to withdraw your consent at any time (for processing that depends on it, including tips and reminder e-mails).

From "My account", you can download a full export of your data (account, preferences, servers, wallet, log of your actions, support thread, survey, referrals, visit origin, ideas) in JSON format, and delete your account and servers yourself. If your balance includes a refundable amount, deletion offers to request its refund.

You may also exercise these rights by writing to support@tickserv.com. We may ask for proof of identity in case of reasonable doubt. We reply within one month.

If you believe your rights are not being respected, you may lodge a complaint with the CNIL (French data protection authority): 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

8. Cookies and Local Storage

The cookies and local storage our pages write are first-party: set by our site and read by us alone. In addition, two providers set their own strictly necessary cookies: Clerk (your sign-in session) and Cloudflare Turnstile (anti-bot check when creating a server). YouTube videos are only loaded, from youtube-nocookie.com, if you click them.

Strictly necessary cookies, exempt from consent: Clerk session cookies to keep you signed in (including __session), security cookies for anti-bot protection, a language preference cookie (ts_locale, kept for 12 months, containing only a language code: fr, en, de or es) and, only if you tick the tips and reminder e-mails box on the sign-up page, a cookie that passes this choice on when your account is created (ts_mkt, kept for 1 day).
An internal audience measurement cookie (ts_ft, kept for 6 months): on your first visit only, it records how you arrived on the site — arrival channel, utm_* parameters present in the link, domain name of the site that sent you and path of the landing page. It contains neither your name, nor your e-mail address, nor the full URL of the pages you view, nor an advertising network's click identifier, and it is never rewritten afterwards (except to remove such an identifier from a cookie set before October 21, 2026).

We use no advertising cookies and do not track you from one site to another. The ts_ft cookie only serves to know which channels make us known; its data is neither shared nor resold.

The site also writes a few markers with no identifying data in your browser's local storage, for browsing convenience:

Key	What it is for	Duration
`tickserv_ref`, `tickserv_promo`, `tickserv_game`	Referral code, promo code or game chosen before signing up	Until used
`ts_topup_pending`	Top-up in progress at Stripe, to show its arrival when you come back	Until you return to the site
`ts_locale_suggest_off`, `ts_guest_offer_dismissed`	Language banner or guest offer dismissed	Until you clear it
`tickserv-map-nudge:…`, `tickserv-map-og:…`, `tickserv-map-groups`	Sharing a Valheim server's map and the layers shown	Until you clear it
`umami.disabled`	Your refusal of audience measurement (`?sans-mesure`)	Until you clear it
`ts_signup_tracked`; `ts_signed_state` (session storage)	Counting a sign-up only once; reporting a sign-in only once	Lasting; until the tab closes
`tickserv_admin`	Operator back office only	Until cleared

Our audience measurement (Umami, see §4) sets no cookies: your browser sends the page viewed and the event triggered to our own site, which forwards them to the provider together with your IP address and browser — the only two elements it needs to infer the country and device type, and which we do not keep on our side. No account identifier is included, and nothing is written to your device to recognize you from one visit to the next. It only keeps the two technical markers from the table above, with no personal data: the one that remembers your refusal to be measured (umami.disabled) and the one that avoids counting the same sign-up twice (ts_signup_tracked).

These two measurements fall under internal audience measurement (legitimate interest, art. 6.1.f) and not advertising tracking. You may object at any time: by refusing cookies in your browser for ts_ft, by opening https://tickserv.com/?sans-mesure for audience measurement (the setting applies to that browser), or by writing to us (see §7).

9. Security

We implement appropriate technical and organizational measures: encryption of exchanges (HTTPS), hosting on secure infrastructure, restricted access to data, and reliance on payment and authentication providers that comply with industry standards.

10. Automated Decision-Making

We do not carry out any fully automated decision-making producing legal effects concerning you, nor any profiling. The automatic shutdown of a server (insufficient balance, inactivity) is simply a technical means of performing the contract. An AI crash explanation is only a diagnostic aid: it decides nothing.

11. Changes

We may update this policy. In the event of a material change, we will inform you. The date of the last update appears at the top of this document.