Version 2026-08-18

Privacy Notice

TicketHost is an issue tracker. This notice explains exactly what it stores about you, why, and how to get it back or get rid of it.

What we collect

AccountYour name, email address and a bcrypt hash of your password.

SessionsA hashed session token, your browser's user-agent string, and your IP truncated to a /24 (IPv4) or /48 (IPv6).

ContentTickets and comments you write, and the change history of tickets you touch.

ConsentsWhich purposes you accepted or declined, the policy version, and a truncated IP as proof.

Security logSign-ins, failed sign-ins, permission denials and privacy requests, with a truncated IP.

Why we collect it

Account and session data exist to sign you in and keep you signed in — that is contractual necessity. The security log exists to detect and investigate abuse, which is our legitimate interest and is kept minimal for that reason. Content is yours; we store it because storing it is the product. Optional purposes below run only on your consent, and you can withdraw them at any time.

RequiredTerms of Service — The contract governing your use of TicketHost.
RequiredPrivacy Notice — How we collect, use and retain your personal data.
RequiredEssential cookies — A single HttpOnly session cookie that keeps you signed in. Cannot be disabled.
OptionalProduct analytics — Aggregated, pseudonymous usage metrics used to improve the product.
OptionalProduct email updates — Occasional email about new features. Never sold or shared.

What we never do

We do not sell personal data, we do not load third-party trackers or advertising scripts, and we do not store full IP addresses. The application ships with a Content-Security-Policy that forbids loading scripts from anywhere but this origin.

How long we keep it

Account and contentUntil you delete your account.

Sessions14 days from sign-in, or 3 days of inactivity, whichever comes first.

Security logRetained as our record, with the actor pseudonymised after account deletion.

Deleted accountsRecoverable for 30 days, then permanently erased.

Your rights

You can download everything we hold about you as JSON, withdraw any optional consent, and request erasure — all self-service, from Privacy & your data. Nothing needs a support ticket. You also have the right to complain to your data protection authority.

← Back to sign in