TeaBot Privacy Policy

Last updated: 28 September 2026

TeaBot is a Discord bot operated exclusively for the official Subway Surfers Discord server, together with this website. TeaBot cannot be added to other servers. This policy explains what data TeaBot handles, why, who can see it, how long it is kept, and the rights you have over it. It applies to everyone who is a member of the server or uses this website — including people who have been banned and use the ban appeal page, who are not members but whose data is still handled here.

1. Who is responsible

The data controller is TeaBot's operator, Stitch.
Contact: blue42stitch42@gmail.com, or @iamstitch on Discord.

2. What TeaBot collects

2.1 Messages and media (the message log)

TeaBot keeps a record of messages posted in the server, including messages that are later edited or deleted. The moderation team uses it to check what actually happened around a report, a scam or a sanction, instead of relying on memory.

• What is kept: the message text, who wrote it, which channel, when, edits and deletions, and small previews of images and videos. Full-size copies of media are kept only when the message was deleted, because that is when it becomes moderation evidence.
• Recent messages (about 90 days) stay searchable. Older messages are archived in encrypted form, and media previews are encrypted too.
• Some channels are excluded from logging entirely.
• Access is limited to the moderation team, and each moderator can only look up channels they can already see on Discord.
• Direct messages are never logged. TeaBot only processes messages inside the server.

2.2 Activity, game and moderation data

• XP, levels and ranks derived from your message activity, daily activity streaks, and usage statistics for bot features.
• Your moderation history: bans, mutes, kicks, warnings and staff notes with case IDs, plus flags raised by automated moderation.
• Safety records: which accounts posted which Discord invite links (to detect waves of compromised accounts), records of members removed for an inappropriate profile (username, avatar link and reason, so repeat cases are flagged if they rejoin), modmail ticket counts, and join dates.
• Game and community data: card collections, pulls, trades and balances, giveaway entries, event progress, and earned rewards.
• Seasonal events such as the Halloween candy hunt: your candy history (what you earned, and when), your daily event progress and streak, and any prize you won. If you claim an in-game prize, you give us your in-game Profile ID and User ID in a private winner channel; they are used only to deliver that prize, and staff read them for that purpose alone. The event's rules are at teabot.fr/halloween/rules while it runs.
• Answers you give to polls the server runs at teabot.fr/poll/…, stored against your Discord account so the poll counts one answer per person and lets you come back and change yours. A poll that asks for no sign-in stores no account with the answer at all. The moderation team can read your answers together with your account. When a poll says so on its own page, its results are shared with SYBO, the studio that makes Subway Surfers, in anonymous form only: vote counts and rankings, and written answers without your name or account. Your Discord name and ID are never shared with SYBO.

2.3 Device details from the pictures you upload

When you post a picture or a video in the server, TeaBot notes two things that arrive with it and keeps a running count: the shape of the filename, which is enough to recognise it as (for example) an iPhone screenshot or a Samsung screenshot, and the dimensions of the image, which for a screenshot are the size of your screen.

It is used for one purpose: to recognise when several accounts are being run by the same person, which is the main way server rules and bans are worked around. It is a starting point for a moderator and never a conclusion. Millions of phones share a screen size, so staff are always shown how many other members share yours, precisely so a coincidence is not mistaken for a match.

• Nothing extra is downloaded. The filename and the dimensions already arrive with every upload; TeaBot only counts them, and the picture itself is not re-examined for this.
• The filename itself is not kept, only what it was recognised as, together with the image size and how many times that combination has been seen. Filename patterns TeaBot does not recognise are recorded with no account attached to them at all.
• No automated decision is made about you on the basis of it. Nothing is sanctioned, restricted or flagged automatically; it orders a list that a moderator reads.
• Some channels are excluded from this entirely.
• Access is limited to the moderation team. It does not appear on your own profile page.

2.4 Your profile picture

Your profile picture is checked automatically for content that breaks the server rules. It is checked when you join, and again whenever you change it, using the same moderation service described in section 3. Everyone is checked, whatever their rank, roles or how long they have been in the server, because a profile picture is shown to the whole server next to everything you post.

• The picture itself is not stored. What is kept is Discord's own identifier for the picture you are wearing, what the check decided about it, and which categories it flagged. The identifier is what lets TeaBot recognise a picture it has already checked, so the same one is never sent twice; it is replaced when you change your picture.
• If the check finds nothing, nothing happens and nobody is told.
• If it finds something borderline, the moderation team is shown your picture so a person can look at it. You are not told, nothing changes for you, and you carry on as normal.
• If it finds something clearly against the rules, you are muted and sent a direct message explaining why. This is the one automated action taken here, and it is covered in section 3.

2.5 Data you choose to provide

Only stored if you use the feature: custom greetings (text and media links), custom bot statuses, your birthday, your timezone, your Subway Surfers friend code, colour and frame choices, and notification opt-ins.

2.6 Ban appeals

If you are banned and file an appeal at /appeals, TeaBot stores what you write: your answers to the questions on the form, the fact that you confirmed you understand an appeal is not a guarantee, your Discord account ID, and the ban you are appealing (its reason, date and case ID, copied from the moderation record at the moment you file). It also stores when the appeal was filed, when voting closes, and the outcome.

Your appeal is posted in a staff-only channel where the moderation team reads it and votes. It is not public, and it is not shown to other members.

You do not have to be in the server for this. A banned account cannot be, which is the whole point of the page. Signing in there gives you access to the appeal page and nothing else on this website.

How the decision is made. The vote is taken by people, not by the bot. What is automatic is only the carrying out of it: when voting closes, TeaBot lifts the ban if more moderators voted to unban than to keep it, and otherwise leaves the existing ban in place. No decision about you is taken by automated means alone — a ban is placed by a moderator, and an appeal is decided by moderators. You can ask a human to look again at any time using the contact details in section 11.

2.7 Club assets

If you are a member of the club and staff share an asset, you collect your copy with a button in a club channel. The copy you receive carries an invisible mark that is unique to you. TeaBot records which copy was made for which Discord account and when you collected it. If an asset is shared where it should not be, staff can compare the shared picture against those marks to see which copy it came from. The comparison gives staff evidence; the decision about what happens next is taken by people.

The original asset is stored encrypted. Your copy is kept, encrypted, for up to 14 days so the button can answer quickly, and is then deleted; it can be made again from the original.

2.8 This website

• Signing in uses Discord OAuth with the minimal "identify" scope. TeaBot learns your Discord ID, username and avatar, and nothing else. No email address, no access to your DMs, no data from other servers.
• A session cookie keeps you signed in for up to 12 hours. It is strictly necessary, signed, HttpOnly and Secure. A second short-lived cookie protects the login flow itself. There are no analytics, advertising or tracking cookies.
• Connection data such as your IP address is processed to deliver the site over HTTPS and may appear briefly in technical logs.
• Your profile page is visible only to you and to the moderation team. The ban appeal page shows you only your own ban and your own appeal; it never shows you how the moderators voted, or who voted.

3. Automated moderation and third parties

• To keep the community safe, some content is checked automatically. Message text and images (including frames taken from gifs and videos) may be sent to OpenAI's Moderation API, which scores them for safety issues such as harassment, hate or self-harm content. The same check screens greetings, custom statuses and profile pictures before or shortly after they appear. An animated profile picture is checked at several frames across its length, not only the one it rests on.
• Only the content itself is sent. Your Discord ID, username and other account identifiers are never shared with OpenAI.
• Under OpenAI's API data policies, data sent to the Moderation API is not used to train AI models.
• Word filters and language detection run locally on our own server and involve no third party.
• Automated systems can act on their own in clear-cut cases, for example removing spam waves from compromised accounts. Every automated action is logged for staff review, and any ban can be appealed (see the Terms of Service).

When an automated check restricts you, and how to have a person look at it. Two things can happen without a human deciding first: a wave of spam from compromised accounts is removed, and a profile picture that the check scores as clearly against the rules causes the account wearing it to be muted. A mute means you cannot post in the server; it does not remove your data, your roles or your progress, and it is not a ban.

• You are told. The mute comes with a direct message saying what happened and why.
• A moderator reviews it, and only a moderator can lift it. The bot never lifts its own mute, and the review is a person looking at the actual picture rather than at the score.
• You can say so if you think it is wrong. Open a modmail ticket or ask a moderator in a public channel, and you can ask for it to be looked at straight away. This is your right to human intervention, to express your point of view and to contest the decision.
• Changing your profile picture does not lift the mute by itself, but the new one is checked and the moderation team is told immediately if it passes, which normally makes the review quick.
• The check can be wrong, and it is set deliberately so that borderline pictures are shown to moderators rather than acted on.

4. Where data lives, and transfers outside the EU

• TeaBot runs on a server hosted by Hetzner in Germany (EU).
• Discord Inc. (USA) is the platform itself: everything you post on Discord is also processed by Discord under Discord's own privacy policy. In addition, TeaBot stores its encrypted message archives, encrypted media previews and nightly backups in restricted, staff-only Discord channels, so that data resides on Discord's infrastructure.
• OpenAI LLC (USA) processes content transiently for the moderation scoring described above.
• SYBO Games ApS (Denmark, EU) receives the results of polls that say they are shared with SYBO, in the anonymous form described in section 2.2. Nothing that identifies you is included, and SYBO is in the EU, so no data leaves the EU for this.
• Transfers to providers in the USA rely on recognised safeguards such as the EU-US Data Privacy Framework and standard contractual clauses.
• TeaBot never sells your data and never shares it for advertising, marketing or profiling.

5. Why we process data (legal bases under the GDPR)

• Legitimate interest: moderation, safety, spam and abuse prevention, keeping evidence around reports and sanctions, and understanding how the bot is used through aggregated statistics.
• Legitimate interest (keeping the server safe to look at): profile pictures are screened because they are shown to every member, including younger ones, next to every message their owner posts, and there is no way for a member to avoid seeing one. We keep an identifier and a verdict rather than the picture, act automatically only at the top of the scale, tell you when we do, and have a person review it. You can object, and you can ask for the record to be deleted along with the rest of your data.
• Legitimate interest (preventing ban evasion and multiple accounts): the device details in section 2.3 are kept to detect one person running several accounts, which undermines bans, giveaways, events and the card game for everyone else. We use only what already arrives with an upload, keep it as counts rather than as your files, take no automated action on it, and delete it on the schedule in section 6. You can object at any time, and ask for it to be deleted along with the rest of your data.
• Legitimate interest (running a fair appeal process): if you appeal a ban, we process what you write in order to review it, decide it, and keep a record of the decision. Handling appeals is also how we meet our own obligation to reconsider a moderation decision when you ask us to. Your appeal is read only by the moderation team, we ask only what is needed to decide it, and you choose what to put in it. If you would rather it were not kept, you can ask for it to be deleted along with the rest of your data — but note the exception in section 8 for records we must keep to establish or defend legal claims.
• Legitimate interest (protecting unreleased material): if you receive club assets, we record which copy went to which account so that a leak can be traced to the copy it came from. This protects material shared with the club in confidence. We keep only that record, not your copy, and no action is taken on a comparison without a person reviewing it.
• Legitimate interest (community polls): your answers are stored against your account so each person counts once and can change their answer, and they are used to report what the community thinks, including to SYBO when a poll says so on its page. Only anonymous results leave the moderation team. You can ask for your answers to be deleted at any time; results already shared in anonymous form cannot be recalled, but they contain nothing that identifies you.
• Legitimate interest (providing features you ask for): the optional features where you provide data yourself (greetings, statuses, birthday, timezone, friend code, notification opt-ins) are stored only when you actively use the feature, kept to the minimum that feature needs, and used only to provide it back to you. You can remove this data or object at any time by deleting it or asking us to delete it. We weigh this against your rights and take particular care with the data of younger members.

6. How long data is kept

• Messages: about 90 days in searchable form, then in encrypted monthly archives. The message archive is kept for up to 3 years and then permanently deleted, one month at a time by an automatic monthly sweep. The moderation record itself (sanctions, appeals and staff notes, with their case IDs) is kept for the life of the server, separately from the message archive, so a member's history stays assessable after the surrounding messages are gone. Media: previews only, except full copies of deleted messages kept as moderation evidence.
• Moderation history: kept for the life of the server, so appeals and repeat behaviour can be assessed fairly. Ban appeals are part of that record — the answers you wrote, the ban you appealed and the outcome are kept with it, and are among the records described in section 8 that we keep even after an erasure request.
• Usage statistics: raw data up to 14 days, daily summaries up to about 6 months, weekly and aggregated summaries up to 2 years.
• Data you provided yourself: until you remove it or ask us to remove it.
• Poll answers: kept with the poll's results, and deleted along with the rest of your data if you ask for an erasure.
• Seasonal event data: kept after the event, so the next one can be planned on real numbers, and deleted along with the rest of your data if you ask for an erasure. The in-game IDs you give to claim a prize are part of it.
• Device details (section 2.3): up to 3 years after the last upload they were drawn from, then deleted automatically. Posting again refreshes them; if you stop, they age out on their own.
• Profile picture checks (section 2.4): the identifier and the verdict are kept for as long as you are in the server, and each one is replaced when you change your picture. They are deleted with the rest of your data if you ask for an erasure. The moderation record of any mute that resulted is kept with the rest of the moderation history, as described above.
• Club asset records (section 2.7): kept for as long as the asset may need checking. They are part of the records described in section 8 that we keep to establish or defend legal claims, including after an erasure request.
• Website sessions: 12 hours.
• Nightly backups are encrypted and kept for 30 days in a restricted staff-only channel to protect against data loss. An erasure removes your data from the live systems; copies inside backups made before it age out with that 30-day window, and a backup is never restored into the live systems without the erasure being applied again.

7. Security

• Message archives and media previews are encrypted (XSalsa20-Poly1305) before they leave our server, and the encryption key is stored separately and never included in any backup.
• The website is HTTPS only. Staff access requires both a recorded permission level and the matching staff role on Discord, re-checked on every request.
• Media links posted by members are fetched and proxied by our own server, so the external hosts behind them never see the IP address of the person viewing a log or a profile.
• Writes to live data are protected against corruption, and access to the server itself is restricted to the developer.

8. Your rights and your choices

Under the GDPR you can ask for access (a copy of what is stored about you), correction, erasure, restriction of processing, objection, and portability. Contact us directly or ask a staff member. Both the copy and the erasure are supported, built-in operations; in what we hand over, identifiers belonging to other people are redacted to protect their rights.

How long it takes. We answer any of these requests without undue delay and in any case within one month of receiving it, as Art. 12(3) requires. An erasure is scheduled rather than performed on the spot: it is held for 10 days and then runs automatically, with no further action by anyone. The wait is a safeguard against the wrong account being deleted by mistake, and it is the only reason a scheduled erasure is ever cancelled — if we were refusing your request instead, which we may do only on the narrow grounds the law allows, we would tell you so, with our reasons and your right to complain to a supervisory authority. If you would like it done sooner than 10 days, say so and we will bring it forward.

What an erasure keeps, and why. Art. 17(3) lets us keep some records even after an erasure request, and we do. Erasing your data removes your messages, your activity and game data, the things you provided yourself and the device details — but it keeps the moderation record: sanctions with their case IDs, the counters derived from them, automated moderation flags, ban appeals and their outcomes, records of removals for an inappropriate profile, compromised-account safety records, the staff audit trail, any giveaway blacklist, and the record of which club asset copy was sent to you. Those are kept to establish and defend legal claims and to prevent abuse. Nothing in that list is used to build a profile of you or shown outside the moderation team, and the erasure report we hand back counts exactly what was kept and says why, so you are never told something was deleted when it was not.

Automated decisions. If an automated check has restricted your account (see section 3), you can ask for a person to review it, put your side of it, and contest the outcome. Ask a moderator or use modmail; you do not have to wait for the review to happen on its own.

Choices built into the bot: set your friend code to private, delete or edit your own greetings, and use the incognito role to opt out of pings and daily event marks.

If you believe your rights are not respected, you can complain to your local data protection authority. In France that is the CNIL (cnil.fr).

9. Children

Discord requires users to be at least 13 years old, or older where local law sets a higher bar (15 in France). TeaBot relies on that age requirement and does not knowingly collect data from children below it. The optional features above are provided on a legitimate-interest basis rather than consent, and the data collected is minimised, so a younger member's data is handled with particular care and is never more than the feature needs.

10. Changes to this policy

This policy is updated when the bot's behaviour changes, and significant changes are announced in the server. The date at the top always tells you which version you are reading.

11. Contact

Email: blue42stitch42@gmail.com
Discord: @iamstitch