What we collect when you host with us, why we need it, who else touches it, and how to make us delete it. Written to be read, not to be survived.
Last updated 25 September 2026
We are a game server host. To give you a server we need an account for you, a record of the server itself, and somewhere to keep the files you put on it. That is essentially all we collect. We do not run advertising, we do not track you across other websites, we do not use analytics, and we do not sell or share your data with anyone for their own purposes.
This page is the full, binding version. The list above is a summary for convenience and does not replace the sections below.
The data controller — the party that decides why and how your personal data is processed, and the party you can hold to account for it — is identified below. Write to the privacy address for anything covered by this policy, including any request to exercise the rights described further down.
We collect only what a hosting account needs to work. Each category below names the data, why we hold it, and the lawful basis under Article 6 GDPR that permits it. Where the basis is "legitimate interests" we have weighed those interests against your rights, and you can object to that processing at any time.
| What | Why we have it | Legal basis |
|---|---|---|
| Account identity — a user ID, your username, your email address, and your profile picture | To create your account, show you as the owner of your servers, let other members of a server recognise you, and contact you about the service | Performance of our contract with you — Art. 6(1)(b) |
| Authentication data — sign-in sessions, tokens and the identity provider you last used | To keep you signed in and to return you to the right sign-in method next time | Performance of our contract — Art. 6(1)(b) |
| Server records — the name, address, hostname, game, version, plan and region of each server you deploy | To provision and run the server, bill the right plan, and show it to you in the panel | Performance of our contract — Art. 6(1)(b) |
| Server content — the files, worlds, configuration and backups on your server, and the console output it produces | This is the service. We store it so your server can run and so you can manage it | Performance of our contract — Art. 6(1)(b) |
| Sub-user invitations — the email address you invite, the permissions you grant, and when the invitation was sent, accepted or expired | To deliver the invitation and to record who you gave access to. Note that this is the personal data of someone who may not have an account with us | Performance of our contract with you, and our legitimate interest in operating an access-control system that can be audited — Art. 6(1)(b) and (f) |
| Access permissions — the relationship between your account and each server you can reach | To decide what you are allowed to do on a server you did not create | Performance of our contract — Art. 6(1)(b) |
| Technical logs — IP address, request time, the page or endpoint requested, and errors | To keep the service secure and available, investigate abuse, and debug faults | Our legitimate interest in the security and integrity of the service — Art. 6(1)(f) |
We do not ask for, and have no use for, any special category of data under Article 9 — nothing about health, beliefs, politics, ethnicity or sexuality. Please do not put such data into a server name, a file or a support message.
When somebody joins a game server you run, their IP address and whatever identifier the game itself uses reach that server, and can end up in its logs, its ban lists and its world data. This is how multiplayer games work, and it happens inside your server rather than in our panel.
For that data you are the controller and we are your processor: it is your server, your configuration and your decision who may join. We access it only to run the infrastructure, to help you when you ask us to, or where we are legally required to. If you run a server that other people join — particularly a public one, or one used by children — the obligation to tell those players what is collected and to answer their requests is yours, not ours.
We set only the cookies the site needs in order to function, plus the ones that remember a preference you set yourself. There is no advertising, profiling, analytics or third-party tracking cookie anywhere on this site.
That is why there is no consent banner. Under the ePrivacy rules, consent is required for storage that is not strictly necessary for a service you asked for — and none of the entries below fall outside that. If we ever add analytics, we will ask you first, and you will be able to say no and keep using the site.
| Name | What it does | How long it lasts |
|---|---|---|
| access_token | Keeps you signed in. Not readable by JavaScript | Deleted when you close the browser |
| refresh_token | Renews your sign-in while you are still using the site, so an expired page does not throw you out mid-action. Not readable by JavaScript | Deleted when you close the browser |
| id_token | Lets us tell the sign-in provider which session to end when you log out, so logging out takes one click. Not readable by JavaScript | Deleted when you close the browser |
| auth_request_state | Security value that ties a sign-in attempt to the browser that started it. Protects against a forged sign-in | 5 minutes |
| last_idp | Remembers which sign-in button you used last, so it is offered first | Until you clear it |
| theme | Remembers whether you chose light or dark mode, so the page does not flash the wrong colours before it loads | 1 year |
| wds-theme (local storage, not a cookie) | The same theme preference, kept in your browser so the correct theme is applied before the first paint. It is never sent to us | Until you clear your browser data |
You can delete these at any time in your browser settings. Deleting the sign-in cookies simply signs you out; deleting the preference cookies returns the site to its defaults.
We keep the number of outside parties deliberately small: most of the stack is software we run on our own machines rather than a service we hand your data to. The parties below are the ones that do process personal data on our behalf. Each is bound by a data processing agreement and may use the data only to provide their service to us — never for their own purposes.
| Who | What they process | Where |
|---|---|---|
| Our own infrastructure — sign-in service, game nodes, databases, file storage | All of the categories listed above | European Union |
| deSEC e.V. — DNS for game server hostnames | The hostname of each server, and the IP address of anyone who looks it up | Germany |
| Cloudflare, Inc. — DNS and the secure tunnel for this website and the sign-in pages | The IP address of anyone who visits the site or signs in, and the addresses they request | United States, with EU data centres. Covered by Standard Contractual Clauses and their EU-U.S. Data Privacy Framework certification |
| Forward Email LLC — delivery of invitation and service email | The recipient address and the contents of that message | United States, and their own hosting sub-processors in the US and UK. Covered by the EU Standard Contractual Clauses in their data processing agreement |
Beyond that, we disclose data only where we are legally obliged to — a valid order from a competent authority — or where it is necessary to establish or defend a legal claim. We will tell you if that happens to your data unless we are forbidden from doing so.
We do not sell personal data, we do not share it for anyone else’s marketing, and we do not use it to train machine-learning models.
We keep personal data only for as long as it serves the purpose it was collected for, and then delete it. In practice:
| What | How long |
|---|---|
| Your account and profile | For as long as the account exists. Deleted when you close it |
| Your servers and their contents | For as long as the server exists. Deleted when you delete the server or the account, subject to a short grace period so an accidental deletion can be undone |
| Backups of your server | Until you delete them, or until the account is closed |
| Invitations you sent that were never accepted | Automatically deleted 30 days after the invitation expires — the invited address is not kept once the invitation can no longer be used |
| Invitations that were accepted or revoked | Automatically deleted after 12 months. The resulting access permission is kept for as long as that access exists |
| Technical and security logs | Up to 90 days, then deleted |
The GDPR gives you the following rights over your data. They are free to exercise, and we will answer within one month — if a request is genuinely complex we may extend that by two further months, and we will tell you why before the first month is out.
To exercise any of these, write to the privacy address above. We may ask you to confirm you are who you say you are — not to obstruct the request, but because handing an account export to the wrong person would itself be a breach.
If you think we have got it wrong, we would rather hear from you first and fix it. You do not have to: you can complain directly to your supervisory authority, which for us is the one named below, or to the authority where you live or work.
We take the measures Article 32 requires, proportionate to the risk. In concrete terms:
No system is perfect. If a breach occurs that is likely to put your rights at risk, we will notify the supervisory authority within 72 hours and tell you directly without undue delay.
The service is not directed at children, and an account is intended for someone aged 16 or over — or younger with the consent of a parent or guardian, where the law of your country sets a lower age. We do not knowingly hold the data of a child below that age. If you believe a child has created an account, write to us and we will delete it.
Bear in mind that a game server you run may well be joined by children, and that what happens on it is your responsibility as its operator.
We will update this page when what we do with data changes. The date at the top always reflects the last change. If a change materially affects you — a new recipient, a new purpose, a longer retention period — we will tell you by email or in the panel before it takes effect, rather than quietly editing the page.