Privacy Policy

This Privacy Policy explains how Hostd ("we", "us", "our") collects, uses, and protects personal data when you use Hostd, our game-server hosting platform, the website at https://hostdservers.com, the customer dashboard, and any related APIs (together, the "Services"). It is written to meet our obligations under the UK GDPR, the EU GDPR, the Privacy and Electronic Communications Regulations 2003 (PECR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and similar privacy laws. If you have questions, email privacy@hostdservers.com.

1. Who We Are (Controller)

Hostd is the data controller for personal data processed through the Services. For personal data contained inside content you upload to a Game Server (world files, save data, plugins, mods, configuration, player records held by the game itself) we act as a data processor on your behalf, consistent with UK GDPR / EU GDPR Article 28.

The fastest way to reach us about privacy is privacy@hostdservers.com. We have not appointed a statutory Data Protection Officer because our processing does not meet the threshold under UK GDPR Article 37; you may still raise any privacy matter to privacy@hostdservers.com and a member of staff will respond.

2. Information We Collect

2.1 Information you provide

• Account details: email address, password (stored only as a salted hash, never in plain text), username, display name, and where enabled, two-factor authentication secrets and one-time recovery codes (also hashed).
• Billing details: billing address and card information are handled by Stripe; we receive a Stripe customer identifier, the last four digits and brand of the card, billing country, and invoice records. We never see or store the full card number.
• Discord account data, where you choose to link Discord: your Discord user ID, username, avatar URL, and the list of guilds we need to verify entitlements you have purchased through Discord.
• Support content: messages, server identifiers, and attachments you send to our support team or include in a ticket.
• Server configuration: server name, plan selection, modpack or game-version selection, scheduled tasks, allowlists, and similar settings you enter into the dashboard.

2.2 Information collected automatically

• Technical data: IP address, user-agent string, approximate location derived from IP, and referring URL. The IP address is used transiently for connection routing, security, and (for marketing-page analytics) to derive a daily salted hash and a country code, then discarded; it is not stored alongside analytics rows.
• Usage data: pages viewed, dashboard actions, timestamps, and error diagnostics.
• Marketing-page analytics (Hostd Analytics): per-pageview rows containing the URL path, referring domain (host only), UTM campaign parameters from the URL, an ISO country code, a coarse device class (mobile / tablet / desktop), browser and operating-system family, a screen-size bucket, the primary language tag, engagement time on the page, a tab-scoped session identifier (cleared when you close the tab), and a daily-rotating salted hash that lets us count one visitor per day without identifying you. Conversion events (for example signup-completed, purchase) carry only the event name, an optional value in cents, and the same hash and session identifier. No cookie, persistent identifier, raw IP, or full user-agent is stored. Raw analytics rows are retained for up to 90 days; aggregated daily totals are retained beyond that for trend analysis.
• Service data: resource utilisation (CPU, memory, disk, network), game-server console output, snapshot metadata, audit events, and connection metadata used to operate and secure the platform.
• Security data: failed-login attempts, rate-limit triggers, and abuse-detection signals tied to the originating IP and account.

2.3 Content you upload to your Game Servers

World files, save data, plugins, mods, scheduled-task scripts, and other assets you place in a Game Server remain yours. We process them to store, transmit, snapshot, and restore them on your behalf, and to perform automated safety and operational checks (for example, identifying malware, abuse, or illegal material) before content is made available to your Game Server or to other systems. We do not data-mine the contents of Game Server volumes and we do not disclose the methods or thresholds used for those checks.

3. How We Use Your Information

Providing the data described in section 2.1 is necessary to enter into the contract for the Services; if you do not provide it we cannot create or operate your account. Providing the data described in section 2.2 is automatic and a necessary consequence of using a hosted service over the public internet.

4. Automated Decision-Making

We do not carry out automated decision-making producing legal or similarly significant effects within the meaning of UK GDPR / EU GDPR Article 22. Automated systems do, however, apply rate limits, suspend Game Servers that exceed plan resources or fail health checks, and trigger fraud-prevention reviews on payment-network signals from Stripe. You can ask for human review of any such decision by emailing support@hostdservers.com.

5. Cookies, Local Storage and Analytics

We use only cookies that are strictly necessary for authentication, session continuity, and cross-site request forgery protection. We do not set advertising or tracking cookies, and we do not load any third-party tracking or advertising scripts.

We operate our own first-party, cookieless analytics (Hostd Analytics) to understand how our marketing pages are used, which content is most popular, where visitors come from, and which actions convert to a paid subscription. Hostd Analytics does not set any cookie, does not write any persistent identifier to your device, and does not fingerprint your browser. For each pageview we briefly use your IP address to derive a daily-rotating salted HMAC ("visitor hash") and to look up an approximate country code; the IP address itself is then discarded and never stored. The salt rotates each calendar day and old salts are deleted after a short grace window, after which the visitor hash for that day cannot be reversed back to an individual. The full list of fields stored, and their retention, is set out in section 2.2 and in our Cookie Policy.

Because every cookie we set is strictly necessary and our analytics does not rely on cookies or persistent identifiers, no consent banner is required under PECR or the UK / EU GDPR. The legal basis for processing analytics data is our legitimate interest in operating, securing, and improving the Services. You may object to this processing at any time by emailing privacy@hostdservers.com; you may also block requests to /api/t/* in your browser, or enable Do Not Track / Global Privacy Control, both of which we honour automatically.

6. Sharing Your Information (Sub-Processors)

We share personal data only with the service providers listed below, each engaged under a written agreement that requires them to protect your data and use it only on our instructions. We update this list when we add or change a sub-processor.

We do not sell or "share" personal information for cross-context behavioural advertising as those terms are defined under CCPA/CPRA. We may disclose information if we are legally required to (court order, subpoena, valid law-enforcement request), to enforce our Terms, or to protect the rights, property, or safety of our users, our staff, or the public.

7. International Transfers

Where personal data is transferred outside the UK or EEA we rely on adequacy decisions where available, or on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses (Module Two: controller to processor) combined with appropriate supplementary measures including encryption in transit and at rest. A copy of the relevant clauses is available on request to privacy@hostdservers.com.

8. Retention

• Account data: retained while your account is active. After you delete the account it is soft-deleted with a deletedAt timestamp, all refresh tokens are revoked, and any active Stripe subscription is cancelled. The record is permanently erased no later than 24 months after deletion, unless we are required to keep specific fields longer to meet a legal obligation.
• Billing records (invoices, refund records, tax data): retained for at least 7 years to meet HMRC and equivalent tax-law obligations.
• Game Server content (volumes and snapshots): retained during the active subscription. After termination the data is retained for 14 days and then permanently deleted.
• Snapshots: a rolling window of the seven most recent daily snapshots and four most recent weekly snapshots per Game Server, written to OVH Backup Storage or, where enabled, Cloudflare R2.
• Audit logs and security events: retained for 90 days by default. We may extend retention on a per-account basis where required for incident response or abuse investigation; in that case we will tell you on request.
• Marketing-page analytics: raw event rows are retained for up to 90 days and then deleted; aggregated daily totals are retained beyond that for trend analysis. Daily salts that protect the visitor hash are deleted after a short grace window so historic visitor hashes cannot be reversed back to a person.
• Support tickets: retained for up to 24 months after closure so we can recognise repeat issues.

9. Your Rights

If you are in the UK or the EEA you have the right to:

• Access the personal data we hold about you and obtain a copy.
• Correct inaccurate or incomplete data.
• Erase your data (right to be forgotten), subject to legal retention requirements such as tax records.
• Restrict or object to certain processing, including processing based on legitimate interests.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time without affecting prior lawful processing.
• Lodge a complaint with your local data-protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113).

California residents have additional rights under CCPA/CPRA: to know the categories and specific pieces of personal information collected, to delete personal information, to correct inaccurate information, to limit the use of sensitive personal information, and the right not to be discriminated against for exercising these rights.

9.1 How to exercise your rights

You can exercise the right of access, correction, and erasure directly from the dashboard: the account settings page lets you update your contact details, and the "Delete account" action triggers full account deletion as described in section 8. For any other right, or if you cannot use the dashboard, email privacy@hostdservers.com from the address registered to your account. We will verify your identity, respond within one calendar month (extendable by two further months for complex requests, in which case we will tell you why), and we will not charge a fee unless the request is manifestly unfounded or excessive.

10. Security

We protect your data with industry-standard practices: encryption in transit and at rest, salted password hashing, short-lived session tokens that rotate automatically, HttpOnly Secure cookies, CSRF protection on state-changing requests, and rate limits on sign-in and the dashboard. Optional TOTP two-factor authentication is available, with single-use recovery codes that are hashed at rest. Customer workloads are isolated from each other at the operating-system level. No system is perfectly secure and we encourage you to use a unique strong password and to enable 2FA.

11. Children

The Services are not directed to children under 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and you believe we have collected data from a child, email privacy@hostdservers.com and we will delete it.

12. Changes

We may update this policy from time to time. Material changes will be announced by email to the address on file at least 14 days before they take effect, and the "Effective" date at the top of this page will be updated. Continuing to use the Services after the effective date means you accept the updated policy.

13. Contact

Privacy questions and data-subject requests: privacy@hostdservers.com. Abuse reports: abuse@hostdservers.com. Legal notices: legal@hostdservers.com.