Privacy Policy

Effective date: 31 October 2026

This policy explains what information Theia keeps about you, why, where it is kept, who else sees it, and how to have it deleted.

Theia is the only holder of your information. To ask anything about your information, or to have it deleted, email legal@theiatcg.site.

1. Who we are

Theia is a private software project, run privately for a small group of invited people. In this policy, "Theia", "we", "us" and "our" mean the Theia project and the people who run it.

2. What we collect

From Discord, when you sign in

You sign in to Theia with your Discord account. Discord shares only the basics from your Discord profile with us:

• your Discord user ID (a number that identifies your account)
• your username and display name
• your profile picture (Discord tells us which one; the picture itself stays on Discord)

We ask Discord only for permission to know who you are. We don't get your email address, password, servers, messages or friends. Discord gives us a key to read your profile that one time; we use it straight away and don't keep it.

What you save in Theia

• Cards: the card number, expiry date, security code, name on the card, and the name you give the card
• Addresses: names, postal addresses, phone numbers and email addresses for billing and delivery
• Retailer accounts: the email addresses, passwords and sign-in sessions of retailer accounts you add
• Your setup: profiles and groups, monitor rules, and similar settings

What Theia records while it works

• Tasks: the products, links, sizes and stores you run tasks for, when they ran, and what happened
• Orders: order numbers, totals, products, and the brand and last four digits of the card used
• Run logs: a step-by-step record of each checkout attempt, kept for fixing problems (card numbers are masked in them)
• Monitor events: the stock alerts Theia acted on for you, and what it decided

Verification codes

Some retailers send a one-time code when a retailer account signs in. This is how Theia handles them:

• Big W. The code comes by email. Theia reads it from one mailbox run by Theia's operator, not from yours. Big W accounts used with Theia have email addresses on the operator's own email domain, so their codes arrive in that mailbox. Theia looks only at recent emails from Big W's no-reply address sent to that account's address, takes the six-digit code and the time it arrived, and keeps nothing else from the email. It never asks for, or reads, your own mailbox. If a Big W account uses your personal email address, Theia can't read its codes.
• Card payments (3-D Secure). Your bank asks you to approve the payment in its app. Theia waits for your approval; it never sees or types a code.
• Text-message (SMS) codes. Not built. Theia doesn't receive or read text messages.
• Other retailers. Theia doesn't read verification codes for any other retailer.

To keep you signed in

• a random sign-in code stored as a cookie in your browser (we keep only a scrambled copy that can't be turned back into the code)
• when you signed in and when you were last active

A sign-in lasts up to 30 days. Signing out ends it on that browser straight away.

Your agreement to our terms

• when you agreed to our Terms of Use, Privacy Policy and Acceptable Use Policy, and which version you agreed to

Our network and hosting providers may also record technical details of visits, such as IP addresses, as part of running their services.

3. Why we use it

We use your information only to:

• run the checkouts and tasks you ask for
• show you your tasks, orders and history
• keep Theia secure, and keep the shared resources fair for everyone
• find and fix problems

We don't sell your information. We don't use it for advertising or marketing, and we don't share it with anyone except as described below.

4. Who else sees it

• Retailers. When Theia checks out for you, it gives the retailer (and the retailer's payment provider) the details a checkout needs: your name, address, phone number, email address and card details. That is the point of the tool. The retailer then handles them under its own privacy policy.
• Discord. Discord handles your sign-in, under Discord's own privacy policy.
• Cloudflare. Traffic to and from Theia passes through Cloudflare's network.
• Our server host. Theia runs on a rented server (see section 5).
• Services that help checkouts work. To get past retailers' bot checks, Theia uses outside services such as captcha solvers and proxy networks. Checkout traffic, including the details sent to a retailer, can pass through a proxy on its way. These services are not given your saved information as a list or record.
• The operator's email provider. Big W's verification emails (see section 2) are delivered to, and stored by, the email provider of the mailbox Theia's operator runs.
• Notifications. Updates about tasks (for example an order number, total, product code and the last four digits of the card used) may be posted to a private Discord channel run by Theia, and emailed to any notification address you set on a task.
• When the law requires it. We may disclose information if we are legally required to.

Some of these services (including Discord, Cloudflare, proxy networks and solving services) may store or process information outside Australia.

5. Where your information is kept

Your information is kept on a private server run by Theia, rented from a hosting provider in Sydney, Australia. Theia's own backups are kept on the same server. The hosting provider also keeps automatic copies of the whole server, in the same Sydney data centre.

6. How we look after it

• Only invited, approved Discord accounts can sign in, and each person sees only their own information. Someone taken off the list loses access at once, even if they're signed in.
• Passwords and sign-in sessions for retailer accounts are stored encrypted. The app shows a retailer account's password back only to you, in your own account.
• Card details are stored in full on the server, because a checkout needs them. They are not encrypted by Theia itself. The app shows a card in full (number, expiry and security code) only to you, when you edit your own profile; anywhere else it shows the brand, last four digits and expiry date.
• Connections to Theia are encrypted (HTTPS).

No security is perfect, and Theia has not been independently audited. If something goes wrong that affects your information, we will tell you as soon as we reasonably can.

7. We are not PCI DSS certified

Theia is not PCI DSS certified, assessed or compliant. PCI DSS is the card industry's security standard for businesses that take card payments and the companies that process them.

Theia is a tool, not a payment processor, merchant or bank. It doesn't take card payments, and it doesn't move money. It does store the card details you choose to save, so it can enter them into a retailer's checkout for you.

If you're not comfortable with that, don't save a card in Theia.

8. How long we keep it

We keep your information while you have access to Theia.

• Deleting things yourself. You can delete cards, addresses, accounts and tasks in the app. Deleted cards are removed straight away. Some other things you delete (such as addresses, tasks and accounts) are hidden from the app first rather than erased; deleting a retailer account also wipes its password and session.
• Deleting everything. Email legal@theiatcg.site and ask us to delete your information. We will confirm it's really you (for example through your Discord account), then erase it within 30 days.
• When your access ends. If your access is removed, we delete your information within 30 days, unless you ask us for a copy first or we need to keep something because the law requires it.
• Backups. Theia makes a backup every day and keeps each one for two weeks. It also makes a copy before each update, restore or file change, and keeps those for no more than 30 days. So information deleted from Theia is gone from Theia's backups within 30 days. The hosting provider's automatic copies of the whole server (section 5) are replaced on its own rolling schedule, and deleted information disappears from them as older copies are replaced.

9. Seeing and correcting your information

You can see and change most of your information in the app at any time. You can also email us to ask for a copy of everything we hold about you, or to have something corrected, and we will respond within 30 days.

10. The Australian Privacy Principles

Australia's Privacy Act 1988 and its Australian Privacy Principles (APPs) mainly apply to government agencies and to businesses with an annual turnover of more than $3 million, plus some smaller organisations.

Theia is a small, private project rather than a large business, so the Privacy Act may not apply to it. We use the APPs as our guide anyway, and this policy is written to follow them: we collect only what Theia needs, use it only for the purposes above, keep it reasonably secure, let you see and correct it, and delete it when asked.

11. Questions and complaints

Email legal@theiatcg.site. We will reply as soon as we can, and within 30 days.

If you're not happy with our answer, you can contact the Office of the Australian Information Commissioner (oaic.gov.au). Because Theia is a small, private project, the Commissioner may not be able to act on a complaint about it.

12. Changes to this policy

We may update this policy. When we do, we will change the effective date at the top, and if a change is important we will tell you in the app or on Discord before it takes effect.