Privacy Policy

How Sortr handles personal data, in plain English.

Effective 4 November 2026 · Version 35

1. Who is responsible

Sortr is operated by Unlock Services LLC, a limited liability company registered in Wyoming, United States, and managed from the Czech Republic ("Sortr", "we"). Its address is in section 11. Because Sortr is run from the European Union, the GDPR applies to all of it. You can reach us at team@sortr.xyz.

Responsibility is split, because Sortr does two different jobs:

• The dashboard and sign-in. When you sign in at sortr.xyz, we decide what is collected and why. For that data we are the controller under the GDPR.
• Tickets inside a Discord server. The server's admins decide to install Sortr, what the ticket form asks, whether and when transcripts are kept, for how long, where copies go, and which staff can read them. Sortr does that work on their behalf and on their instructions, so for ticket records, form answers, transcripts, the event log and anything the server sends to a Google Sheet or another app, the server (its owner or admins) is the controller and Sortr is their processor, under our Data Processing Terms.

What this means in practice: if you opened a ticket and want to know what was kept or want it deleted, you can ask the server's admins or us. If you ask us, we may pass the request to that server's admins, because it is their record, but we will still make sure it is dealt with (see Your rights).

Discord itself is a separate company with its own privacy policy. Everything you type in Discord is on Discord's servers whether or not Sortr is installed.

2. What Sortr collects

2.1 When you sign in to the dashboard

The dashboard uses "Sign in with Discord" (OAuth2) with two scopes: identify and guilds. Discord then tells us:

• your Discord user id, display name (or username if you have no display name) and avatar;
• the servers you are in, with each server's id, name, icon, whether you own it, and your permissions there. We use this only to work out which servers you may manage (owner or Administrator). We keep the servers you can manage and drop the rest straight away;
• an access token and a refresh token so we can re-ask Discord for that list while you use the dashboard (about once a minute at most, or when you press Sync from Discord);
• whether your Discord account has two-factor authentication switched on. We use it only to honour a server's rule that moderators need it: in such a server, only its owner and Administrators with two-factor authentication can manage Sortr. We keep it with your session, check it again whenever we re-ask Discord for your servers, and delete it when the session ends. For the people who run Sortr only, it is also noted with each API key they make, for as long as the key exists (2.9).

The tokens stay on our server, stored encrypted; your browser only ever holds a session id in a signed cookie. Our database does not keep that id itself, only a one-way hash of it, and your display name, avatar and the list of servers you can manage are stored encrypted with the tokens. All of it is deleted when your session ends.

Signing in does not give us your email address and cannot read your Discord messages. The dashboard does not ask for your email address.

2.2 When a ticket is opened, handled, closed and deleted

This is data Sortr processes for the server that installed it.

• The ticket record. The server id, the ticket channel id, the ticket number, which panel it came from, its status (open, closed, deleted), the Discord id of the member who opened it, once it closes the ids of anyone who was added to it, who closed it and the reason they typed, and timestamps (opened, closed, last activity, inactivity warning, transcript saved, deleted, and earlier closes if it was reopened). If a ticket is reopened, the earlier close reason is cleared from the record.
• Form answers and subject. If the panel has a form, your answers are stored, and the first 200 characters of your first answer are kept as the ticket's subject. Both are encrypted at rest. The text of each question is stored alongside your answer, encrypted too. Unless the server switches it off, your answers are also posted in the ticket channel when it opens, so staff can read them there.
• Files attached to a form. A form can have a question that takes files, up to 10, such as screenshots, videos or documents. Once the ticket opens, Sortr copies the files from Discord into the ticket channel, posted under the opening message, and holds it in memory only while posting it: Sortr never stores the files themselves, not even in its backups. The copy in the channel is then under the server's control, like anything else posted there, and goes when the channel is deleted; a transcript links to it, as to any attachment. A file Sortr does not copy, for example one larger than the server lets it post, or not a picture on a question that takes only images, is named in the channel instead. As the answer to that question, Sortr stores the files' names, encrypted, with your other answers and for as long. The names also go wherever the server sends its answers: its Google Sheet, its connected apps (which also get each file's size and type, but no link) and the ticket's messages.
• The transcript. Depending on the server's settings, Sortr saves a transcript when the ticket closes or when it is deleted, and also whenever staff press Transcript, use /transcript or save one from the dashboard. A ticket that would otherwise be deleted with no copy (for example one deleted while still open) is saved right before it goes, so a ticket can end up with more than one copy. Sortr reads the messages in that ticket channel (up to 5,000) and renders them into one HTML file; a very long one is cut at 12 MB, keeping the start. For each message it contains the author's display name and avatar link, the time, the text (with mentions shown as names), embeds, stickers, polls and links to attachments with their names and sizes. Attachments themselves are not copied; the links point at Discord, and Discord expires them after a while. The file also names the server, the member who opened the ticket (name, username, id) and who saved it.
• Which copy holds what. After a ticket closes, the member who opened it can no longer see the channel, and what staff write there afterwards is for staff. So the copy kept on sortr.xyz and the copy sent to the member stop at the close; the copy posted in the server's staff channel, and the file staff get when they press Transcript, have everything.
• The copy on sortr.xyz. Kept unless the server switches it off. The transcript is encrypted at rest. Next to it we store the opener's name and username, also encrypted (staff can still find a transcript by member: Sortr decrypts them to search), and, unencrypted, the opener's Discord id, the id of whoever saved it, the number of messages and a link to the Discord copy. For everyone who wrote in it, and whoever saved it, we also keep a one-way fingerprint of their Discord id, made with a key kept outside the database, and the id itself, encrypted, so that a deletion request can find their words (section 7). These go when the copy goes, and a person's own go once their words are removed at their request.
• Copies on Discord. Unless the server switches it off, the transcript file is posted to a staff channel with a list of everyone who wrote in the ticket (their names and how many messages each). If the server switches it on, a copy is also sent by direct message to the member who opened the ticket. For a ticket in a channel marked 18+ (age-restricted) in Discord, the staff copy is posted only in a channel marked 18+ too, the member gets the link without the file, and the copy on sortr.xyz shows an 18+ notice before the conversation. Those copies live on Discord, under the server's and Discord's control; Sortr never deletes them.
• In Discord itself. Following the server's settings, Sortr creates the ticket channel (its name and topic can include the opener's Discord name), gives the opener and anyone added access to it and takes that access away at the close, and can give or take roles when a ticket opens or closes. To apply the server's rules it reads the roles you hold in that server, for example to decide whether you may open a ticket, press a button or use a command.
• Message content. Sortr has Discord's Message Content access, so Discord delivers to the bot the messages of every channel it can see. The invite does not ask for the Administrator permission, so that is the channels Sortr's role can see: usually the server's open channels, and private ones only where it is let in, such as the ticket channels it creates. A server's admins can still give Sortr Administrator by hand, for example while moving private tickets from Ticket Tool; it then sees every channel in the server until they take it away. Outside ticket channels Sortr ignores everything and stores none of it, except when a server's admins start a move from Ticket Tool, which reads Ticket Tool's posts in other channels (2.8); like any Discord bot, it holds recent messages in memory for about half an hour before they are dropped. In ticket channels, message text is used to build transcripts, for the "message edited" and "message deleted" log posts if the server switches those on (2.3), and to count staff messages before a reopen. Otherwise, when someone writes in a ticket, Sortr only notes the time, to run the server's inactivity rules.
• Members leaving. Sortr receives Discord's member-leave events so it can note when a ticket's opener leaves the server. It does not keep member lists.

2.3 The event log

For each kind of event a server has switched on, Sortr writes one entry when it happens: a ticket opened, closed, reopened, deleted, renamed or moved; a member or role added to a ticket or to another channel, or a member removed from a ticket; roles changed by a trigger; the opener leaving; a transcript saved, opened or deleted; an open refused by a rule or limit; settings changed; and problems such as a missing permission. Each entry holds the server id, the ticket id where there is one, the kind of event, the Discord id of whoever did it, and a few lines of text, which can include the people involved and the close reason. Those lines are stored encrypted. The entry is stored even if the server has not picked a log channel; when it has, the same entry is posted there. The /add command also works in a channel that is not a Sortr ticket, such as a Ticket Tool ticket Sortr has not taken over: there Sortr changes the channel's permissions only for someone who could do that in Discord themselves. Its entry names that channel instead of a ticket, and is posted only in a log channel whose readers, bots aside, can all see that channel. Three kinds of entry are always written, whatever the server's settings say: a change made through an API key (2.9), which is also posted in every log channel the server's panels use; a change to a panel's Google Sheet or connected apps; and a warning that the server is close to Discord's channel limit.

Two events work differently. If a server switches on "message edited" or "message deleted" (both off by default), the post in its log channel includes the first line of the message, up to 120 characters (for an edit, the first line before and after), or the names of deleted files; that text goes to Discord only and is never stored by Sortr. And if a server switches on "transcript opened" (off by default), an entry records who opened a transcript on sortr.xyz, at most once every 30 minutes per person and transcript.

2.4 Images

Server admins can upload images (PNG, JPEG, GIF or WebP, up to 8 MB) to use in panel and ticket messages. They are stored on our server exactly as uploaded, including any hidden details the file carries, such as where and when a photo was taken, and served at a fixed address without a sign-in, so anyone who has the link can view them. When a panel is posted, Discord gets a copy too. Please do not upload pictures of people or anything private, and remove location details from photos before uploading them.

We record which Discord account uploaded each image, to apply a storage limit per account, and delete that record with the image. Copying a panel to another server copies its images into that server's own storage.

If we take an image down, for example after a copyright notice, we keep a fingerprint of its content (its SHA-256 hash and its size) so the same file cannot be uploaded or shown again. The fingerprint names no person or server, and the image cannot be rebuilt from it. We delete it if the takedown is lifted, for example after a counter-notice under our Terms of Service.

If the image is child sexual abuse material, before taking it down we seal a copy of it, with where it was used and who uploaded it, into a locked record on our server, report it as section 5 describes, and tell nobody else. The record is never shown or sent to anyone except the authorities, and it is deleted a year after the report, or later if the authorities ask.

Admins can also give the bot its own name, profile picture and banner in their server. Those go straight to Discord, which shows them as the bot's profile in that server; Sortr keeps no copy. They stay until an admin replaces them or switches back to the default.

2.5 Server settings

For each server: its id, name, icon and chosen colour, whether Discord makes moderators there use two-factor sign-in (kept so that rule still applies to the server's remaining transcripts after Sortr is removed), and each panel's configuration (names, channels, categories, staff roles and their permissions, message texts, form questions, limits, inactivity rules, transcript and logging settings, the link to a Google Sheet and the addresses and signing secrets of any connected apps, with the Discord user id of whoever connected each one). The Google Sheet link and the addresses and signing secrets are stored encrypted. When an admin mentions a member in a message, the dashboard looks up that server's members by name from Discord at that moment, up to 10 at a time; only the mention is kept. Beside the sheet link we keep a keyed fingerprint of the spreadsheet's id, from which the id cannot be read back, so Sortr can tell when two servers connect the same sheet without decrypting their links. A sheet stays with the first server that used it: its fingerprint is kept with that server even after the link is removed, so no other server can write into the sheet through Sortr unless someone who manages the first server moves it. This is mostly configuration rather than personal data, but it can include role and user ids. To keep these settings safe, Sortr also notices when a member's roles change: an app or sheet someone connected is switched off once they are no longer an Administrator, and an API key stops working once its maker can no longer manage the server. Apart from the log entry when something is switched off, nothing about those changes is kept.

2.6 Billing

Sortr is free today and takes no payments, so it asks for no billing details and holds none. The dashboard used to have an optional Billing details form; it has been switched off, and the details saved through it have been deleted. Before paid plans start, this policy will say what is collected for them and name the payment provider. Card and bank details will be handled only by that provider and will never reach Sortr.

2.7 Technical data

• Cookies. Only the strictly necessary ones listed under Cookies.
• IP addresses. To stop abuse, Sortr counts requests per IP address in memory (for example to limit sign-in attempts), and sign-ins per Discord account. Those counts are never written down and disappear after about an hour. The web server keeps no access log, so visitors' IP addresses are not recorded. Sortr stores addresses in two places only. One is an API key's settings, where the people who run Sortr enter the addresses of the servers of the site that holds the key (2.9). The other is the security log of the machine Sortr runs on. It records attempts to log in to that machine and the network traffic its firewall blocks, with the address each came from, and the addresses blocked after repeated failed logins. Almost all of it comes from automated scanners on the internet; it is not a record of who visits sortr.xyz or uses Sortr. Each login to the machine is also reported to the people who run Sortr, in their private Discord channel.
• Server logs. Our bot and web server write technical logs, mainly of errors and start-up and of a few actions, such as who blocked an account (timestamps, Discord ids, server names, error messages). They do not contain message content.
• No analytics. sortr.xyz loads no analytics, advertising or third-party scripts, and fonts are served from our own domain. Because nothing tracks you across other sites, every visit is handled the same way whether or not your browser sends a Do Not Track signal. Avatars, server icons, emoji and attachment previews in the dashboard and in transcripts are loaded from Discord's servers, as they are in Discord itself, so Discord sees your IP address when your browser fetches them. In a message preview, an image stored anywhere other than sortr.xyz or Discord is not loaded until you press Load beside it.

2.8 Moving a server from Ticket Tool

A server's owner and Administrators can use Import from Ticket Tool in the dashboard. This is data Sortr processes for the server, at its admins' request.

• The scan. If Ticket Tool is in the server and Sortr has Discord's Message Content access, Sortr reads the latest 50 messages of up to 250 channels that Ticket Tool can see and post in. Otherwise it reads none of them, and the admins can still pick a panel with the Import into Sortr command. In a channel where those 50 include Sortr's own posts but none of Ticket Tool's, for example after an earlier import, it reads up to 200 more before them. It keeps only what Ticket Tool itself posted: its panels, and how many transcript and log posts each channel holds, to suggest where Sortr's should go. Everything else it reads is dropped at once. It also reads the first 10 messages of up to 60 recent Ticket Tool tickets and keeps only those Ticket Tool posted; in a ticket Sortr has taken over, it uses Sortr's copy of Ticket Tool's first message instead. From them it sorts the tickets into kinds, usually one for each Ticket Tool panel, and rebuilds each kind's opening message and questions. The member's mention, name and picture become placeholders, and anyone else's mention is left out. Answers in Ticket Tool's answer boxes are left out, and other answers are found by comparing tickets of the same kind and left out too. Each opening comes from a real ticket, so the admins are asked to check it for anything about that member before importing it. Where only one ticket of a kind was read, there is nothing to compare it with, so what that member wrote may still be in it. To tell tickets named after their member from numbered ones, Sortr also gets the names of the members the tickets are for, asking Discord for up to 100 of them, and uses them only in memory. The result is held in memory for about an hour and never stored, except what the admins turn into Sortr panels. Images attached to Ticket Tool's panels and opening message are copied into the server's own Sortr images (2.4); nobody's profile picture is copied. An admin can also pick one Ticket Tool panel with the Import into Sortr command; it is held in memory for about 30 minutes.
• Replacing Ticket Tool's panels. If the admins choose Replace, Sortr deletes Ticket Tool's panel message once Sortr's panel is posted in its place.
• Taking over open tickets. If the admins choose to, in each open Ticket Tool ticket Sortr posts Ticket Tool's first message again as its own, with its own Close button, pins it and deletes Ticket Tool's. Any answers in that message are posted again in Discord only; Sortr does not store them. From then on it is a Sortr ticket: Sortr keeps the ticket record described in 2.2, and also which roles could see the ticket, the ids of the Ticket Tool message it replaced and of Sortr's copy, and when it was taken over. Any transcript Sortr saves of it covers the whole channel, including what was written before the take-over. Its log entries go to a log channel only if, when it was taken over, nobody outside the ticket's own roles could see that channel (the server's owner, Administrators and bots aside); either way they are kept in the event log (2.3). Its transcript goes to a channel only if that is still true when the transcript is saved; otherwise it is kept on sortr.xyz, where only the member who opened the ticket and the server's owner and Administrators can open it.
• The first use. The first time the import is used on Sortr at all, the people who run Sortr receive the server's name in a Discord message, so they can check it worked. Only that it happened and a count, such as how many tickets were taken over, is kept.

2.9 API keys for other sites

A server can work with another site, such as an agency's dashboard that manages the server, through Sortr's API. A key lets that site read and change the server's panel message, opening message and form questions, and update the panel already posted in Discord. It cannot read tickets, form answers, transcripts, the event log or anything about the server's members. Each key works for one server. Only the people who run Sortr can make one, and only for a server where they are the owner or an Administrator. A key stops working when its maker is no longer one of the people who run Sortr, or no longer the server's owner or an Administrator. In a server that requires two-factor sign-in for moderators, a key made by an Administrator (not the owner) also stops once they sign in to or use Sortr's dashboard without it. The people who run Sortr can revoke a key at any time.

For each key we store its name, a one-way hash of the key (never the key itself), the Discord id of the person who made it and whether their account had two-factor sign-in on at the time, when it was made and last used, and, if set, the internet addresses of the other site's servers that may use it. A call from any other address is refused, and the refusal is logged without the caller's address.

2.10 When you email us

If you write to team@sortr.xyz, we receive your email address, the name your email shows, what you write and anything you attach, and we keep our replies. If you ask to use your rights under section 7, we also keep a short record of the request: when it came, your Discord user id, how we checked it was you, what we did and when. Section 5 says who carries and stores this email.

2.11 Early access (ended 30 October 2026)

Until 30 October 2026, only the accounts we let in could use the dashboard, and others could join a waitlist. When early access ended, we deleted the waitlist, its messages in our Discord channel, and the list of accounts we had let in.

2.12 Blocking abuse

If an account or a server breaks our Terms of Service, or uses Sortr to harm others, we can block it. We keep its Discord id, when it was blocked and which of the people who run Sortr blocked it; the reason is not stored. A blocked account can no longer use the dashboard or Sortr in Discord: its sessions end, it cannot open tickets or use Sortr's buttons, menus and commands, and Sortr leaves any server it adds Sortr to. It can still read its own transcripts. When Sortr joins a server, it reads from that server's audit log who added it: to leave if that account is blocked, and to send them Sortr's welcome message by direct message if it cannot post it in the server. It keeps nothing about it apart from a technical log line with the server's id. Sortr leaves a blocked server, and that server's data is then deleted 30 days later, as section 4 describes. We tell the person or the server's owner what we did and how to challenge it (Terms of Service, sections 6 and 11), except after a report of child sexual abuse material, where telling them could harm an investigation.

2.13 Our support server

If you join Sortr's own Discord server for help and news, which the people who run Sortr run, we are the controller for what happens there. Discord shows us what it shows the admins of any server: your username, display name and avatar, when you joined, the roles you hold, and the messages you post there. Messages in its open channels can be read by every member, and stay until you or we delete them. A support request there is a Sortr ticket, so section 2.2 applies with us as the server, including the files you attach to a bug report. We use all of it only to help you, to improve Sortr and to keep the server safe, and we may remove messages or members that break its rules or our Terms of Service.

3. Why, and on what legal basis

You do not have to give us any data, and no law requires you to. But you need to sign in with Discord to use the dashboard, and a server's form may require answers before a ticket opens; without them, that part of Sortr does not work for you.

Sortr applies the rules a server's admins set, such as ticket limits, blocked roles and closing inactive tickets, but it makes no automated decisions that have legal or similarly significant effects on you, and it does not profile you. It does not sell or rent data, does not pass data to advertisers or data brokers, and does not use message content to train AI or machine-learning models. Discord's developer rules forbid all of that as well.

4. How long it is kept

When a server removes Sortr, everything we hold for that server on sortr.xyz is deleted 30 days later: its ticket records, form answers, transcripts, event log, images, settings, API keys and anything still waiting for its Google Sheet or connected apps. What was still waiting is not sent once Sortr has been removed, or once we block the server. If the server adds Sortr back before then, nothing is deleted and it picks up where it left off, apart from what was not sent. Copies already posted into Discord stay there, under the server's control; Sortr cannot delete them. The table below gives the periods while Sortr is in a server.

5. Who receives it

We do not share personal data with anyone except the parties below, all of whom are needed to run Sortr.

Discord Inc.

United States. Every ticket happens on Discord, and Sortr posts transcripts, notices and log entries into Discord and, where a server chooses, into the opener's direct messages. Discord also serves the avatars and images the dashboard shows. We also tell Discord about abuse of Sortr and about security incidents, as its developer terms require, with the ids and links it needs. Discord processes that data under its own privacy policy. Where personal data is transferred from the EEA to Discord in the United States, the basis is the EU-US Data Privacy Framework, under which Discord Inc. is certified, or, failing that, the European Commission's Standard Contractual Clauses.

Hosting

Hostinger International Ltd. (Cyprus), data centre in Germany (EU). One virtual server runs the bot, the database, the uploads and the backups. The provider's weekly copies of that server are kept in Lithuania (EU). The provider can access the machine as any host can, under its own terms and data-processing addendum.

Cloudflare, Inc.

United States. Answers DNS lookups for sortr.xyz and is the domain's registrar. For the website, Cloudflare only resolves the name; it does not see or carry your web traffic. If Cloudflare's proxy is switched on in future, it would carry traffic to sortr.xyz as our processor, and this section will be updated. Transfers to Cloudflare rely on the EU-US Data Privacy Framework, under which it is certified.

Zoho (our mailbox)

Since 13 October 2026, email to team@sortr.xyz is delivered to a Zoho Mail mailbox, and our replies are written and sent there. Our account is on Zoho's EU service (zoho.eu), whose EU data centres are run by Zoho Corporation B.V. (the Netherlands). Zoho handles the mail on our instructions. Zoho companies outside the EU, for example in India and the United States, may also handle it to run and support the service, under an agreement between Zoho companies based on the EU standard contractual clauses.

Resend (replies sent until 13 October 2026)

Resend, Inc. (United States). Until 13 October 2026, our replies went out through Resend, set to send our email from its EU region (Ireland). We no longer use it. Resend keeps a copy of each email it sent, with the recipient, subject and content, for 30 days, so the last copies are gone by mid-November 2026. Transfers to Resend rely on the EU-US Data Privacy Framework, under which it is certified.

Google (only for servers that turn it on)

United States. A server's admins can choose to copy the answers to its ticket form into a Google Sheet they own: each submitted form adds one row with the answers to the questions they chose and, if they choose, the time and the opener's Discord username. Sortr writes to that sheet through a Google service account, on that server's instructions, and reads what is already in those columns to find the next empty row. The sheet, and who can see it, is controlled by that server's admins under their own Google account, and they are responsible for it. When a ticket's answers go there, the ticket's opening message tells the member so. While a row waits to be written, Sortr keeps a reference to the stored answers and the opener's username (see How long it is kept).

Apps a server connects (only for servers that turn it on)

Wherever that server's admins choose. A server's admins can have Sortr send ticket events (a ticket opening, closing, reopening or being deleted) to a web address they choose, usually an automation service such as Zapier or Make, or their own software. Each event carries the server's and panel's names, the ticket's number and times, the Discord ids, usernames and display names of the people involved, the close reason, the transcript link and, when a ticket opens, the questions and answers of the ticket form. When a ticket's answers go there, the ticket's opening message tells the member so. Sortr sends it on that server's instructions. Where it goes from there, and who can see it, is controlled by that server's admins, and they are responsible for it. If the address cannot be reached, Sortr retries for up to a day.

A site holding an API key (only for servers that have one)

Wherever that site runs. A site a server works with, such as an agency's dashboard, can hold a key for that server (2.9). Through it the site receives the server's id, name and icon, the names of its panels and the channel each is posted in, and each panel's panel message, opening message and form questions. It can change those, which changes what the server's members see. It receives no tickets, form answers, transcripts, event log or anything about members. Sortr does this on that server's instructions; the site decides what it does with what it receives, and it and the server are responsible for that.

Payment provider (not yet)

No payment provider receives anything today. Before paid plans launch, we will name the provider here, with what it receives and where.

Server admins and staff

A server's owner and Administrators can read that server's transcripts on sortr.xyz and its closed-ticket list in the dashboard. Staff can read the copies posted into Discord channels they can see. The member who opened a ticket can read their own copy on sortr.xyz, even after leaving the server. Nobody else can open a transcript link.

The people who run Sortr

As with any service, the people who run Sortr can reach its database and hold the encryption key. We look at personal data only when we need to: to keep Sortr working, fix a fault, handle abuse, or answer a request or a legal duty. Our own overview page shows totals (numbers of servers, tickets, users and revenue), every server Sortr is in with its member, panel and ticket counts, every API key in every server (the server's name, the key's name, who made it and the addresses it may be used from), the blocklist (2.12), and the first uses of new features. It shows no messages, and no member names other than those on the blocklist and the uploaders of an image being taken down.

Authorities

Only if the law requires it, for example a valid court order. US law also requires us to report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC). We keep what we report locked away for the one year that law requires, or longer if the authorities ask us to, then delete it.

If Sortr is ever handed over to someone else, the data would go with the service under this policy and with Discord's approval, and you would be told beforehand.

6. How it is protected

• All traffic to sortr.xyz uses HTTPS (TLS) with HSTS.
• Encrypted at rest with AES-256-GCM: transcripts and the names saved with them, the Discord ids of the people in each transcript copy, form answers and questions, ticket subjects and close reasons, the lines of each event log entry, the Discord sign-in tokens and what a session shows of you (display name, avatar and the servers you can manage), the Google Sheet link and the addresses and signing secrets of connected apps, ticket events waiting for a connected app, and the reasons a sheet row or an event is still waiting. The encryption key is kept outside the database and outside our backups, so a copy of the database on its own does not reveal them. The hosting provider's weekly copies of the whole server (section 4) hold the key as well as the database, so those copies are protected only by the provider's own security. What stays readable in the database is what Sortr needs to find, count and run things: Discord ids, times and dates, statuses and numbers, the names of servers and panels, each panel's settings (its messages, questions and rules), links to transcript copies posted in Discord, whether a signed-in account has two-factor sign-in, and an API key's details other than the key itself (2.9).
• A session id is stored only as a one-way hash, so the database cannot be used to sign in as anyone. API keys are stored the same way, can be limited to the addresses of the site that holds them, and every change made with one is logged in the server's log channels. The people in a transcript copy are found by a keyed one-way fingerprint of their id (2.2), not by the id itself.
• Backup files are encrypted as a whole with a separate key, whose private half is not kept on the server.
• The database and the bot are not reachable from the internet; only the web server on the same machine can talk to them.
• Your browser holds only signed, HttpOnly, Secure cookies. Discord tokens never leave the server.
• A transcript page opens only for the member who opened that ticket, or for that server's owner and Administrators as Discord confirmed within the last minute. A server can choose to log every opening (2.3).
• Signing in asks Discord only for the two scopes described above. Adding the bot to a server asks only for the permissions it needs: to create ticket channels and give staff and members the access that server's admins set, to read who added it (2.12) and to set its own name there. It does not ask for Administrator, so it sees only the channels its role can see; section 2.2 explains what it does and does not do with them. A server that gave it Administrator earlier keeps that until its admins take it away, and it works with only the permissions it was given.

Honest limits: the copies posted into Discord are protected by Discord, not by us; and no system is perfectly secure. If a breach ever puts your rights at risk, we will tell you and the supervisory authority as the law requires.

7. Your rights

Under Articles 15 to 21 GDPR you can ask us to:

• tell you what personal data we hold about you and give you a copy (access);
• correct it (your name and avatar come from Discord, so change them there, and Sortr uses the new ones from then on; a transcript already saved keeps the name from when it was saved, and rows or events already sent to a server's own tools are that server's to change);
• delete it (erasure);
• restrict how it is used;
• hand it over in a portable format (transcripts are already plain HTML files);
• stop processing based on our legitimate interests (objection).

Write to team@sortr.xyz and include your Discord user id (Discord shows it under User Settings → Advanced → Developer Mode → Copy User ID). To make sure the request comes from you, we may ask you to confirm it from your Discord account, for example by sending us a message from that Discord account. We answer within one month, free of charge, unless a request is unusually complex, in which case we will tell you why we need longer.

If your request concerns tickets in a particular server, we may forward it to that server's admins, because they are the controller of that data and may need to act on their side too, for instance by deleting the copy posted in their Discord channel. We will still see that the request is handled, and Discord's developer terms oblige us to delete your data when you ask unless the law requires us to keep it.

What deletion reaches: the tickets you opened, with their answers and transcripts, your sessions, a block on your account, and your Discord id in the other records we keep, such as who closed or saved a ticket, or in an event log entry. A server's settings that name you, such as who connected an app, are the server's to change, so we ask its admins to. What you wrote in other people's tickets is removed from the copies kept on sortr.xyz, once we have told those servers' owners (Data Processing Terms, section 7): each of your messages, with its files, becomes a note that it was removed at the author's request, and so do mentions of you; the rest of the ticket stays. In copies saved before this version took effect, we can find you only if you had your own Discord avatar when the copy was saved; where we cannot, we ask the admins of the servers concerned, who can find those transcripts in the dashboard and delete them. Copies posted into Discord are deleted in Discord, by the server's admins, or by you for a copy in your own messages. We keep only what the law requires us to keep, such as material we reported (section 5).

You can do some of this yourself: "Sign out everywhere" in the dashboard ends all your sessions, and a server's owner and Administrators can delete any transcript kept on sortr.xyz from the dashboard.

You also have the right to complain to a data-protection supervisory authority, in particular the one in the country where you live or where you think something went wrong. Because Sortr is run from the Czech Republic, ours is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz). We would rather hear from you first, but you do not have to.

8. Children

Sortr is used through Discord, and Discord requires users to be at least 13, or older where local law sets a higher minimum age. Sortr is not aimed at anyone younger than Discord allows, and we do not knowingly keep data about them. If you believe a child below Discord's minimum age has used Sortr, tell us at team@sortr.xyz and we will delete what we can and suggest the server report it to Discord.

9. Cookies

sortr.xyz sets only cookies that are strictly necessary to sign you in and keep you signed in. That is why there is no cookie banner: nothing here needs your consent. The dashboard does not use your browser's local storage.

10. Changes to this policy

If we change how Sortr handles personal data, we update this page, its version and the date at the top, and say below what changed. A change that matters to you, such as a new kind of data or a new recipient, is listed there when it takes effect. Earlier versions are available on request.

What changed

• Version 35 (4 November 2026): the security log of the machine Sortr runs on, which records the addresses of attempts to log in to it, and how long the machine's own logs are kept.
• Version 34 (3 November 2026): section 2.2 points to the move from Ticket Tool (2.8) as the exception to Sortr ignoring messages outside ticket channels.
• Version 33 (2 November 2026): /add also works outside Sortr's tickets and can add a role, and what its event log entries hold.
• Version 32 (1 November 2026): the Ticket Tool scan reads up to 60 tickets, to tell apart the kinds of ticket each Ticket Tool panel opens, and gets the names of the members they are for; where the hosting provider keeps its weekly copies.
• Version 31 (31 October 2026): members are told when their answers also go to a server's Google Sheet or connected apps; transcripts of 18+ tickets; nothing more is sent after Sortr is removed; the Ticket Tool scan reads fewer channels; reports to Discord and to NCMEC, and what we keep of child sexual abuse material; a deletion now reaches what you wrote in other people's tickets; what a correction reaches.
• Version 30 (30 October 2026): a fingerprint of each image we take down, so it cannot come back; a Google Sheet stays with the first server that used it.
• Version 29 (30 October 2026): early access has ended; the waitlist and the list of accounts let in were deleted; the password in front of the docs, and its cookie, are gone.
• Version 28 (20 October 2026): our earlier mailbox is gone; the support server described until it opens; what a ticket record keeps once it closes; backups and server logs around failures and updates; what our overview page shows; how we check a request comes from you.
• Version 27 (17 October 2026): less repetition of our company details; the off-site backup copy described without its location; Do Not Track; that giving data is not required.
• Version 26 (17 October 2026): our support server on Discord.
• Version 25 (17 October 2026): we no longer send email through Resend.
• Version 24 (16 October 2026): blocking accounts and servers that break the Terms or harm others, and what we keep about a block; sign-ins counted per account; the storage limits for transcripts.
• Version 23 (16 October 2026): expired sessions are cleared within the hour; how long server logs and the off-site backup copy last, described more exactly.
• Version 22 (16 October 2026): our overview page, the server logs, and what deletion reaches in a server's settings, described as they are; the operator's location given as the Czech Republic.
• Version 21 (16 October 2026): the Data Processing Terms, the contract between a server and Sortr for its ticket data.
• Version 20 (16 October 2026): Sortr no longer asks for the Administrator permission when it is added, so it sees only the channels its role can see.
• Version 19 (15 October 2026): files members attach to a form, which Sortr copies into the ticket channel without keeping them; looking up members by name when an admin mentions one.
• Version 18 (14 October 2026): early access and the waitlist: what we keep when you join or are let in, and that Sortr leaves servers added by accounts not let in.
• Version 17 (14 October 2026): Sortr no longer saves a Ticket Tool ticket when Ticket Tool closes it; that feature, added in version 16, was switched off, and what it saved has been deleted.
• Version 16 (14 October 2026): in a server that has moved from Ticket Tool, Sortr also saves a Ticket Tool ticket when Ticket Tool closes it, including tickets Sortr did not take over.
• Version 15 (13 October 2026): email to team@sortr.xyz now goes to a Zoho Mail mailbox on Zoho's EU service, and Cloudflare no longer carries it.
• Version 14 (13 October 2026): Sortr no longer asks for billing details while it takes no payments, and the details saved earlier have been deleted. A Ticket Tool scan can read further back in a channel, and reads Sortr's own copy in tickets it took over.
• Version 13 (13 October 2026): closed tickets' form answers and records are now deleted after set periods while Sortr is in a server.
• Version 12 (13 October 2026): which log entries are always written; that Sortr notices members' role changes; how many transcript copies sortr.xyz keeps; how the off-site backup copy works; what stays readable in the database, and that the host's copies hold the key; what deleting your data reaches; how changes are announced.
• Version 11 (12 October 2026): what Sortr sees when a server gives it less than Administrator.
• Version 10 (12 October 2026): email to and from team@sortr.xyz, through Cloudflare, Google and Resend.
• Version 9 (12 October 2026): moving a server from Ticket Tool, and API keys for other sites.
• Version 8 (8 October 2026): a server's data is deleted 30 days after it removes Sortr.

11. Contact

Operator

Unlock Services LLC

Address

30 N Gould St, Ste R, Sheridan, WY 82801, United States

Email

team@sortr.xyz

Section 5 says who carries and stores email sent to this address.

Sortr is an independent project and is not affiliated with, endorsed by or sponsored by Discord Inc. "Discord" is a trademark of Discord Inc.