Privacy Policy

What TiCkTOM collects while you play, why, who receives it, and how long it is kept.

Last updated: 18 September 2026

This Privacy Policy explains how TiCkTOM Universe (“TiCkTOM”, the “Operator”, “we” or “us”) handles personal data when you use the TiCkTOM game and related services available through the Telegram bot @Ticktom_bot, the Telegram Mini App, the web application at game.ticktom.com, the website ticktom.com and our official channels (the “Services”). The Operator is responsible for the personal data described here.

This Policy does not cover Telegram's own processing of your data, which is governed by Telegram's Privacy Policy, or the processing carried out by other third parties named below under their own policies.

1. What We Collect

From Telegram: your Telegram user ID, first and last name, username, language code, whether you hold Telegram Premium, and a signed launch payload used to authenticate you. If you arrive through an invitation or campaign link, the link's parameter (such as a referral code) is recorded with your Account.
Account data you provide: an email address if you register or sign in on the web or verify your email; if you sign in with Google, the email address and verification status Google provides; a profile image if you upload one; your phone-verification status; wallet addresses you enter for deposits or withdrawals; your settings.
Gameplay data: your progress, balances, items, cards, tiles and position on the in-game map (a fictional coordinate — we do not collect GPS or device location), raids, mini-game sessions and their inputs (used to verify scores), Events, market activity, clan, friend and invitation relationships, moods and status phrases.
Transaction data: records of Telegram Stars purchases (item, price, status and Telegram's payment identifiers — never your card or bank details, which Telegram does not share with us), and records of Token deposits, rewards, swaps and withdrawals, including amounts, wallet addresses and blockchain transaction identifiers.
Technical data: for requests to our servers, your account identifier, the endpoint, request details, response status, IP address and browser or device information. Authentication secrets such as the Telegram launch payload, sign-in codes, tokens and passwords are not stored in logs. For web-access sessions we keep a hashed session token, browser information and the IP address at creation.
Support and verification data: messages and screenshots you send to Support, including through the Support Center, and the support context described under Support, automated assistance and AI; where an Event or the law requires it, proof that you control a wallet address and the result of checks against our official Telegram channel or group.
Advertising data: if you choose to watch a rewarded advertisement, a record of the reward granted together with your IP address, to prevent fraud.
Identity verification data (optional). If you choose to verify your identity to raise your withdrawal limit, the check is carried out by our verification provider, Didit, on its own hosted pages. You submit your document to Didit, not to us. We receive and store only the outcome: the decision, the provider's session reference, the workflow used, the dates, and — where a check is held for review because the same face or document was already approved on another account — the provider's risk codes and which TiCkTOM account they point at. We do not receive or store your identity document images, your selfie, biometric data, or the personal details extracted from your document.

We record in-app usage events (opens, screens, support requests) and a daily count of your actions for as long as your account exists, to improve the game and detect abuse.

We do not knowingly collect sensitive categories of data such as health, biometric or political information, and we ask you not to submit them.

2. How We Use It

to run the game: create and authenticate your Account, save your progress, operate the shared world, mini-games, markets and Events, and deliver purchases and rewards;
to operate the Referral Programme and Revenue Share and to process Token deposits, rewards, swaps and withdrawals;
to keep the game fair and secure: detect and prevent cheating, automation, duplicate accounts, fraud and abuse, verify Event qualification and enforce our Terms;
to support you, including with automated and AI-assisted answers (see Support, automated assistance and AI), and to communicate with you about the Services, including in-game notifications and messages from the bot;
to understand and improve the Services through aggregate statistics computed on our own systems — we do not use third-party analytics services for this;
to show optional rewarded advertisements you choose to watch;
to verify your identity, if you choose to, and to apply the higher withdrawal limit that follows from a successful verification;
to comply with legal obligations and to establish, exercise or defend legal claims.

Where the law requires a legal basis, we rely on the performance of our agreement with you, our legitimate interests in operating, securing and improving the Services, your consent where you choose an optional feature such as rewarded advertisements or identity verification, and compliance with legal obligations. You may withdraw consent at any time.

4. Support, automated assistance and AI

Support may be automated and AI-assisted. Answers in the app, on our website and on Telegram may come from “TiCkTOM AI”, an automated assistant that answers from TiCkTOM's published guides. Automated answers can be incomplete or wrong. Human Support is available: ask for a person in the chat, use “Talk to Human Support” where it is offered, or send /human to @Ticktom_bot.

To answer a request, we may temporarily send relevant parts of it to a third-party AI service provider that processes them on our behalf:

your question;
recent messages from the same support conversation;
a screenshot, if you attach one;
a short, sanitized note from the support context described below, such as an open issue or what was already tried;
excerpts from TiCkTOM's published guides.

This processing is configured to be stateless and, where the provider supports it, zero-data-retention. We do not add your Telegram ID, username, name, email address or wallet addresses to what we send. What you type is sent as you wrote it, and a screenshot contains whatever is on your screen, so leave personal information out of your messages and crop it out of screenshots.

To help you, we keep relevant support context:

a short, sanitized summary of your support history;
open issues, what was already tried and how earlier issues were resolved;
your language and support preferences;
the status of related support tickets.

Messages that look like recovery phrases, private keys, passwords or one-time codes are not stored in this support memory.

Short-term conversation context is kept for 30 minutes after the latest message. Longer-term support memory is kept for 90 days after your last support activity, or up to 365 days where an extended tier applies. You can ask us to delete your support memory at any time through the Support Center. Support tickets remain support records for as long as your Account exists. Aggregated insights that do not identify you may be kept longer.

We may analyse support interactions internally, in aggregated and de-identified form where practical, to improve Support, the game's user experience, our documentation, safety, and our products and services.

Never send your recovery phrase, private keys, passwords or one-time codes to anyone, including TiCkTOM Support. TiCkTOM will never ask for them.

5. What Other Players Can See

TiCkTOM is a shared world. Your first name, username, avatar, level, mood and status phrase, in-game map position and tiles, standings on leaderboards and in Events, clan membership, public activity and public card pages are visible to other players and, in some cases, to anyone with a link. Whether other players are offered a button to message you on Telegram is controlled in Settings. Do not put information in names, statuses or messages that you would not want others to see.

6. Local Storage

The Services use browser local and session storage to keep you signed in, remember preferences and cache game data. We do not set advertising or tracking cookies of our own; advertising networks may use their own identifiers when you choose to watch an advertisement.

7. How Long We Keep It

We keep personal data for as long as it is needed for the purposes above: account and gameplay data for as long as your Account exists and for a short period afterwards to complete pending matters; request logs for a limited period appropriate to security and troubleshooting, after which only aggregate activity statistics remain; identity-verification outcomes for as long as your Account exists, so that your withdrawal limit can be applied and explained; support tickets, which remain support records for as long as your Account exists; short-term support conversation context for 30 minutes after the latest message, and longer-term support memory for 90 days after your last support activity, or up to 365 days where an extended tier applies, unless you ask us to delete it sooner (see Support, automated assistance and AI); and purchase, deposit, reward and withdrawal records for as long as accounting, tax and anti-fraud laws require, which may extend beyond the closure of your Account. Data is then deleted or anonymised. Aggregated insights that do not identify you may be kept longer. Records on public blockchains are permanent.

8. Your Rights and Choices

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to certain processing, to receive it in a portable format, to withdraw consent, and to complain to a data-protection authority. We honour these rights wherever they apply and extend the same courtesies to all players.

To exercise a right, or to ask us to delete your Account, open a ticket in the in-app Support Center or send a direct message to @Ticktom_bot from the Telegram account linked to your Account, so that we can verify the request privately. Deleting the bot's chat in Telegram does not delete your Account. Some data cannot be erased on request: records we must keep by law, records on public blockchains, and data needed to prevent fraud or to establish or defend legal claims.

9. Children

The Services are not directed to children below Telegram's minimum age, and features involving real value are restricted to persons aged eighteen (18) and over. We do not knowingly collect personal data from children below the applicable age; if you believe a child has provided us data, contact us and we will delete it.

10. Security and International Transfers

We apply technical and organisational measures appropriate to the risk to protect personal data, and we review them on an ongoing basis. No system is entirely secure; if we become aware of a personal-data breach that is likely to affect you, we will notify you and, where required, the competent authority. Our servers and providers may be located in countries other than yours; where the law requires safeguards for such transfers, we rely on those available under applicable law.

11. Changes to this Policy

We may update this Policy. The date at the top shows the latest change; material changes will be announced in the Services or on our official channel before they take effect.

12. Contact

Questions, requests and complaints about this Policy: in the app, Settings → Support Center; on Telegram, a direct message to @Ticktom_bot. Announcements: @TiCkTOM_Official. Web: ticktom.com.