Privacy

Updated 29 October 2026.

The controller for this service is Tickets Please at ticketsplease.dev. This page explains what we keep, why we need it and who can see it. For questions or data requests, write to contact@ticketsplease.dev.

Your account and boards

We keep your name, email, sign-in methods, sessions, settings and connected tools. Name and a proved email are needed to create an account. We keep the date and versions of the Terms and Privacy Policy you agree to. Your theme, preferences and layout are on your account and follow you between devices, with separate phone and computer layouts. Your last board and the last repo you chose on each board are kept on your account too, so signing in on another device opens the same place. Tabs, open tickets and scroll stay in the tab and link.

We store board membership and seats, invites, tickets, questions, answers, attached files, agent details, instructions and records of changes, including who wrote each of those fields and the agent id for agent writes. Boards can be shared. Other members and their tools can read board content as their access allows; another account has no access merely because it knows a link. Your private waiting versions of text are yours alone. Files have the ticket’s access rules, with no public file URL. We keep a copy; you keep the original.

Your own instructions stay with your account; the board’s instructions and each repo’s stay with the board. An agent’s suggestion waits for your Add. It expires after 7 days and is removed at the next write, or when its tool disconnects.

Sign-in and connected tools

We email sign-in codes. Changing email proves the old inbox before the new one; deleting an account asks for a fresh code. Sessions and agent keys are stored as hashes. A key’s first 8 characters help you tell it apart. OAuth connections use access and refresh tokens; access lasts an hour and refresh tokens rotate. A key or connection unused for 365 days ends. In Settings you can see each connected tool and the boards it reaches, block it on a board or remove its connection. Each call still checks your current seat.

Sign in with GitHub reads your GitHub id, name, username and verified email; it does not ask for repo access. Import uses a separate GitHub App with read-only access to issues and repo metadata on the repos you allow. We keep the imported issues and repo details, your GitHub link and encrypted import tokens. Disconnect GitHub ends that link and import access here. Deletion also tries to revoke GitHub authorization; if GitHub cannot finish it, we tell you how to revoke it there. It never removes a shared installation for other accounts.

Your coding tools read and write the boards you allow. Their services handle what you give them under their own terms. Copy actions put text on your clipboard. They do not send it to an agent service.

Cookies and this device

Cookies are only for sign-in. There are no advertising or analytics cookies and no cookie banner. The session cookie, __Host-tp_session, lasts 30 days from your last visit, renewed at most once a day. It uses Secure; HttpOnly; SameSite=Lax. Its only job is to remember that you signed in.

• tp_github_oauth carries the GitHub sign-in or connect step for 10 minutes.
• tp_github_pending carries the proved email and account-creation step for 15 minutes.
• tp_github_flash carries a GitHub result message for 5 minutes.

The browser keeps only the sign-in step, where you were, text waiting to save and the technical notes below. It keeps no board as an offline source of truth and no saved layout. The tab’s records end when its storage is cleared; the browser may also clear local data earlier. These are the app’s named stores:

• tp-board-restore.<personId>: that account’s place in the tab and typing waiting to save.
• tp-board-view.<personId>: the last repo ID on each board for cold phone reopening, scoped to that account. It holds no tab, layout or private text and clears at Sign out or device reset.
• tp.login-otp: the sign-in email, step and return address.
• tp-signed-out: which account was signed out, so its return can be explained.
• tp.site-reload:<build>: a guard against repeated reloads, with no board content.
• tp-drafts: text not yet saved, protected by account and board, including edited share reviews.
• tp-push-person: which account turned on notifications in this browser.
• tp-share: the receiving context and protected review scope of an incoming share.
• tp-incoming-share-v1: the temporary incoming title, text, URL and file bytes described below.

Sharing from another app keeps an incoming copy on this device for 30 minutes from receipt. Reload, preparation or retry does not renew that deadline. It is isolated to the receiving context, then bound to the verified account at review. Cleanup runs on receipt, resume and worker activation; if the browser stops, expired bytes are physically removed when it next runs. This storage is best effort and may be cleared sooner.

Cancel, full completion, account change and successful sign-out clear incoming content. A failed sign-out keeps the existing session contract. Your edited review text is separate: it does not expire with the incoming copy and still waits for explicit Add before an unsubmitted review becomes a ticket change. No file bytes go into the draft store. Once saved, share text and files follow the board’s normal access, export and deletion rules. Incoming content, filenames, URLs, ids and correlation handles never enter diagnostics or analytics.

Choosing Sign out, closing your account or Delete now clears every account’s saved typing and sign-in step on this device after the server succeeds. A sign-out you did not choose keeps your own waiting typing for your return. The service worker caches the offline page and app shell files, not board or API answers; ordinary browser caching may also keep unchanged app assets, including the editor. You can clear these in your browser.

Phone notifications

Only if you turn notifications on, we keep the browser’s push endpoint and encryption keys with your session. We send an encrypted notice through your browser maker’s push service. A notice may show a ticket heading, an agent’s name, a short summary and a link, including on your lock screen. Your device settings control that display. Turning notifications off or signing out removes the subscription here; expired sessions and closed accounts cannot receive notices. Your browser maker handles delivery under its own privacy terms.

Feedback and contact

Feedback keeps the report, any screenshot, sender name and email, and whether contact was allowed. We email about a report only when you gave contact permission. Connected apps can send reports to a board’s Feedback inbox; its permitted members can read them. Repeated reports keep the text of the first 20 and latest 20; intermediate text and its screenshot can go even while a problem is New or Kept. Sampled text and screenshots go 30 days after dismissal. Deleting a sender’s account removes their name and structured sender email and turns off contact permission; the owner’s report text stays. Avoid putting secrets or other people’s details in reports. Email you send to our contact address is handled to answer your request.

Why we use data and who handles it

We use account and board data to provide the service you ask for (GDPR Article 6(1)(b), contract). Keeping the service safe, fixing failures and counting use are our legitimate interests (Article 6(1)(f)). Where needed, we also process data to meet a legal duty. We do not sell or rent personal data, use ads or social pixels, or track you across other sites.

• No automated decisions that produce legal or similarly significant effects.

The people who run Tickets Please can technically read stored data. They look only to keep the service running, fix a problem you report, or meet a legal duty. Data uses the providers’ encryption; it is not end-to-end encrypted. A nightly backup is encrypted before it leaves Cloudflare to a key only the service operator holds.

• Cloudflare runs the app, account and board storage, attached files, DNS and incoming mail routing.
• Amazon Web Services keeps encrypted nightly backups in Ohio, USA, and runs the uptime check.
• Resend sends sign-in and account mail and tells us about bounces. Invites use a separate sending subdomain.
• Google handles mail forwarded from our contact address to Gmail.
• GitHub handles sign-in, account linking and issue import when you use them.

Service mail may come from noreply@ticketsplease.dev; that address receives nothing. Public contact is contact@ticketsplease.dev. Cloudflare chooses data locations, usually near the account or board’s maker; files request North America, with no location guarantee. Providers may process data in the United States and other countries outside the EU/EEA. Transfers use applicable contractual safeguards, including Standard Contractual Clauses where required; you can ask us about those safeguards at the contact address above.

Counts and technical records

Our own servers at Cloudflare count totals with no human, IP or board attached, never what you wrote. We keep those totals while the service runs. The private analytics page shows sign-ups and sign-in methods, account closes, returns and deletions; first-week board, ticket and agent steps; weekly activity and returns after 7 and 30 days; agent apps, calls and refusals; questions and time to answer or close; errors, slow requests, save clashes, failed codes and bounced mail; and use of files, Sharing, split boards, settings, imports, copy, search, adding and ticking todos, todo groups and agent instructions. Costs show a spread across boards, with no board named.

To count first-week steps and returns, your account also keeps the last day you used the site while signed in, and whether you made a board, filed a ticket and connected an agent in your first week. These marks are in Download my data and go when the account is deleted; earlier values can remain in the safety copies below. A sign-up week with fewer than 5 accounts shows only “Fewer than 5”. Nothing for analytics is stored in your browser and no analytics beacon runs there.

App error and load-failure logs stay at Cloudflare for 7 days. Error lines hold a tag, cleaned message, route pattern, status, duration and error code. Load reports hold failure kind, build and page kind, without the address or page text. For sign-in throttling, our app keeps a keyed hash of the IP, not the IP itself, for at most a day from the last counted event. Cloudflare separately handles request data, including IP addresses, for security: sampled requests are available for 31 days. Its daily traffic totals last about 365 days and hourly totals about 3 days. The uptime check runs every 5 minutes and holds no account data.

Deletion, restore and safety copies

Account and board data stays while needed for your account and boards, unless deleted sooner under these rules. Tickets in Deleted can be restored for 30 days, then go for good; Delete forever skips that wait. Removed files may remain for up to 30 days for recovery after a failure. Archive and Close do not delete a ticket.

In Settings → Account you can download your data, review and change your name or email, or delete your account. Deletion is refused while you own a board that others use. Closing the account ends sessions, keys and connections at once, pauses your seats elsewhere and cancels invites you sent or received. It waits 14 days before final deletion. The same email cannot create a new account during that wait. Signing in during that wait brings it back, including seats unless an owner removed them; keys and connections do not come back, so connect tools again. Delete now skips the wait with a fresh code. We send mail when the account closes, explaining how to return and its deletion date, and when it is gone. What you wrote on other people’s boards stays as “Deleted account”.

Cloudflare keeps 30 days of history of the live data. We can restore a board to a point in that window to fix a failure; there is no restore button. Amazon Web Services keeps each nightly copy for 27 days. Backed-up files stay while live and for 27 days after removal. Deleted data leaves online backups within 30 days while backups run normally. The newest complete copy can stay longer only while a backup problem is being fixed.

A monthly offline copy is kept outside AWS and Cloudflare for up to 3 months and may hold deleted data that long. A restore makes that data deleted again. To stop any restore bringing back data deleted for good, a list of ids and dates only is kept for 4 months and 2 days. Ended access and closed accounts do not come back through a restore. These safety copies are not part of Download my data.

Download my data is one .zip with a data file and attached files: boards you own without other members’ names or ids or their private notes, and what you wrote on other people’s boards. Keys and secrets are listed by names and dates only, never their values. The copy offered before deletion keeps working without sign-in after the account is gone. Keep it safe. During the move, previous hosting, database and file copies are kept until their separate deletion is approved; a deletion review is due 14 days after the move, not a promise that those copies disappear on that day.

Your rights and changes to this page

You may ask for access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. Where processing relies on consent you may withdraw it. Write to contact@ticketsplease.dev. If you are in the EU, you may complain to the data protection authority in your own country.

A browser’s Do Not Track signal does not change our handling: we do not track across sites and our necessary processing and server counts work the same way. Other parties do not collect data here for cross-site ads. This service is not directed at children. When this page changes, we publish the new words here and change the date at the top. We send no mail about this rewrite.