Privacy Policy

Effective date: 5 November 2026 · Last updated: 5 November 2026

1. Who is responsible?

The controller responsible for processing personal data through TBM is Kevin Bleck, at the postal address and contact details stated above. This policy describes processing visible in the supplied bot source code. The operator must also verify and disclose any additional processing by the actual hosting provider, backup systems, server logs, monitoring tools and other infrastructure before publication.

2. Data processed

• Discord identifiers and server data: Discord user IDs, server (guild) IDs and names, channel and role identifiers, and configuration information needed to operate the bot.
• TORN account data: TORN player ID and player name, account-link status, API-key verification timestamp and an encrypted copy of the API key.
• Virtual banking records: recorded balance, lifetime interest credited, interest-credit timestamps, transaction/request type, amount, status, timestamps, related TORN identifiers, staff/customer Discord identifiers, and notes or details associated with requests.
• Support and diagnostic data: support form content, ticket messages, user and server identifiers, channel identifiers, reported issue location, expected result, error categories and diagnostic details. If a support message contains attachments, the bot forwards the attachment URLs to the central support channel.

3. Purposes and operation

Data is processed to link and verify accounts, operate virtual bank records and requests, calculate and record virtual interest, administer server-specific roles and channels, provide support, diagnose errors, prevent misuse and maintain the service.

The bot sends API requests to the official TORN API. It uses the supplied API key to verify the player's profile and, in relevant banking workflows, retrieve money information. The API key is therefore transmitted to TORN for those requests. It is not intentionally included in support reports.

4. Support reports and disclosures within Discord

When a user submits a support report or writes in a TBM support ticket, the bot forwards the report or message to a central TBM support channel on Discord. The forwarded information can include the message text, Discord user ID, server name and ID, channel information, issue location and, where supplied, expected result and attachment URLs. Automated diagnostic/error reports may also be sent to the central support channel and, in some cases, a local error channel on the server where the issue occurred.

Do not submit API keys, passwords or other secrets in support messages. Support information is visible to authorized members who can access the relevant support channels.

5. Storage and security

The supplied source code stores application records in an SQLite database. TORN API keys are encrypted in the database using Fernet. The encryption key is supplied separately through the operator's server environment configuration. The security of the data therefore also depends on access controls, hosting security, backups and protection of that environment variable.

No online system can be guaranteed completely secure. The operator should restrict access to the database, encryption key, backups, bot hosting account and support channels.

6. Retention and unlinking

TORN API key: When a user unlinks their TORN account, the stored API key is deleted immediately as part of the unlinking process.

Bank balance and interest records: Records of a virtual bank balance and accrued interest are retained for as long as a balance or an outstanding claim remains. Once neither exists and the records are no longer otherwise required, they are deleted or anonymized, subject to applicable legal obligations.

Transaction records: Completed transaction records are retained for three months after completion. If a statutory retention obligation or another legally valid requirement applies, the relevant records are retained for the legally required period instead.

Other account data: Account data that is no longer required for the operation of TBM, security, support or another legitimate purpose is deleted or anonymized, unless a legal obligation requires further retention.

Unlinking removes the Discord-to-TORN account association and the stored API key. It does not automatically remove bank balance, interest or transaction records that are still subject to the retention rules above. Users may submit a separate privacy request using the contact details in this policy.

7. Recipients and third-party services

• Discord: provides the platform on which commands, server roles, channels and support messages operate.
• TORN: receives API requests, including the API key, to provide the requested profile and money information.
• Central TBM support personnel: can access information forwarded to the central support channels.
• Hosting and infrastructure providers: may process data as part of hosting the bot, database, backups and logs. The operator must identify the actual provider(s), their locations and any applicable data-processing arrangements before publication.

8. Legal basis and data protection rights

The operator must determine and document the applicable legal basis for each processing purpose under the laws that apply, including the GDPR where applicable. Depending on the circumstances, this may involve performance of a service arrangement, legitimate interests, consent or compliance with legal obligations. Do not rely on this generic description as a substitute for the operator's actual legal assessment.

Where the GDPR applies, users may have rights to request access, rectification, erasure, restriction of processing, data portability, or to object to certain processing. Where processing is based on consent, consent may be withdrawn. Users may also lodge a complaint with a competent data protection supervisory authority.

To exercise a right or ask a privacy question, contact xzerloxyt@gmail.com. You may also contact the operator through the Discord account Zerlox (User ID 247106624458719232), provided direct messages are enabled.

9. International transfers

Discord, TORN and the operator's hosting or infrastructure providers may process data in countries outside the user's country. The operator must verify the actual locations and applicable transfer safeguards for the services used and update this section accordingly.

10. Children's privacy

TBM is not specifically designed for children. Users must meet the age requirements and comply with the terms of Discord and TORN.

11. Accuracy of service and infrastructure information

This policy must be checked against the live deployment before publication. In particular, the operator must identify the actual hosting and backup providers, confirm their processing locations and applicable safeguards, document the legal basis for each processing purpose, and ensure that the stated retention periods are implemented in practice. If the live bot behaves differently from the supplied source code, this policy must be updated to match the live service.

12. Changes to this policy

This policy may be updated to reflect changes to the bot, its infrastructure or applicable legal requirements. The latest version will be published at this address with a revised effective date.

13. Contact

Privacy contact: Kevin, Germany, email: xzerloxyt@gmail.com.