TSOURCE WEBAPP — Privacy Policy

2.1Your account

• Your email address, and your name if you give one
• Your password, kept only as a one-way scrypt hash. We cannot read your password back from it and never store it in plain text
• When your email address was verified, and when you last signed in
• The number of wrong passwords since your last sign-in. Five in a row lock the account for fifteen minutes
• The id of your Stripe customer record, once you first check out

2.2Members who sign in with Discord

Members from before October 2026 sign in with Discord. With your permission, Discord gives us your Discord id, username and avatar, the email address on your Discord account, and the roles you hold in the T-Source Discord server (the Discord permissions are “identify”, “email” and “guilds.members.read”). The id, username and avatar are stored with your account; the email only if Discord reports it as verified. The roles decide your plan and are kept in your session cookie for the length of the session, not in our database. We never see your Discord password.

Any member can also link a Discord account from My Membership, so that their plan's role in the T-Source Discord server is theirs. With your permission (the Discord permissions are “identify”, “email” and “guilds.join”), Discord gives us your Discord id, username and avatar, which are stored with your account, and lets our bot add you to the server if you are not in it. We then grant the role your plan calls for, take it back when the plan ends, and keep the ids of the roles we granted so that we only ever remove our own. Linking is optional; nothing else about your membership depends on it.

2.3Orders

• What you bought, the quantity, the price, and the plan you held at the time
• The email address you asked delivery at and the one you signed in with, and your Discord username if you signed in with Discord
• The time you accepted the Terms & Conditions
• Stripe's identifiers for the checkout and the payment, never a card number
• For products that ask for a file (a CSV), the file itself, stored privately with the order and sent to our support inbox with it

2.4Memberships

The plan you hold, its status, the dates of the current billing period, Stripe's subscription id, the monthly price, and a log of everything that happens to it: a payment, a failed renewal, a cancellation, a change made by our staff.

2.5Support chat

Tess, the support chat, is an AI assistant. We keep every message you send her and every reply, with the documents each reply drew on. To limit messages per hour and to let you pick a conversation back up, we store a keyed hash of your email address (signed in) or of your IP address (not signed in); it is a hash, so the IP address itself is never stored. When you are signed in we also store your email address in plain text, so our team can follow up with you.

2.6T-Source HQ

The drops, presales and plans you save in the Drop Manager (title, times, time zone, link, notes), tied to your sign-in email, and your orders as described above.

2.7Error reports

When something breaks, a report goes to Sentry with the error, the page it happened on and a stack trace. Sentry's collection of user details, cookies, request headers, request bodies and query strings is turned off, and a scrub pass removes tokens and secrets before anything is sent.

2.8Hosting logs

Vercel, which hosts the site, keeps short-lived request logs (IP address, URL, time and status) that we use to diagnose problems, and applies rate limits by IP address to the sign-in and create-account forms.

2.9What we do not collect

• No analytics, no advertising trackers, no third-party tracking cookies
• StockCheck runs are recorded by event and venue only, never by who asked
• We do not send marketing email

Stripe (payments and memberships)

Card details are entered on Stripe's own pages and go to Stripe, never to us; we receive only Stripe's identifiers and the amounts. Stripe receives your email and name for its customer record and receipts, and hosts the billing portal where you manage your card and invoices.

Postmark (email)

Delivers every email we send, so it handles the address and the message, including delivered codes and attached files.

Anthropic (support chat)

Tess runs on Anthropic's Claude models. Each message you send, with the conversation so far and our support documents, goes to Anthropic's API to produce the reply. Your email address is not sent with it. Anthropic's commercial terms do not allow it to use these conversations to train its models.

Sentry (error monitoring)

Receives the error reports described in 2.7.

Discord

Signs in members from before October 2026, and, for members who link a Discord account, adds them to our server and grants their plan's role (2.2). When an order is placed, a notice with the order and the buyer's email address is also posted to a private staff channel in our Discord server.

Vercel, Neon and Amazon Web Services (hosting, database, files)

Hold the data described in section 04.

Our partner's reports app (reports.tsource.ca)

When you open it, it asks tsource.ca whether your session may use it and receives only yes or no, your plan level, and an opaque id that cannot be turned back into your email or Discord id.

8.1A copy, a correction or deletion

Email ordersupport@tsource.ca from the address on your account and say what you want: a copy of the personal information we hold about you, a correction, or deletion. We answer within thirty days. Deleting your account removes your account record, the drops you saved, the chat transcripts tied to your email, and any files you uploaded. Order and payment records we are required to keep are kept, with everything we can remove from them removed.

8.2What you can do yourself

• Cancel or change your membership from My Membership in T-Source HQ
• Update your card and see your invoices in Stripe's billing portal, from the same page
• Reset your password from the sign-in page
• Sign out to end the session cookie. The site cannot keep you signed in without it

8.3Complaints

If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.