Privacy Policy

We collect what we need to run your server, take your payment and stop abuse. We do not sell your information. We do not show ads on the service. You can have your data deleted by closing your account.

This policy covers our website, your dashboard, and the game servers we run for you. It does not cover other people's websites we link to, or the mods and plugins you choose to install.

We are DEK COMMERCE LLC (a Wyoming limited liability company), 30 N Gould St Ste N, Sheridan, WY, 82801, United States. Privacy questions go to [email protected] and a person answers them.

Your account

• Your email address.
• Your password, stored only as a one-way hash. We cannot read it.
• Whether you have verified your email, and when.
• The IP address you signed up from.
• The date you created the account, and its status.
• The username and password of the hidden control panel user we create for you so that file access and the console work. That password is stored encrypted, because the system has to be able to use it on your behalf.

Billing

• The billing name and address you enter at checkout.
• Your invoices and their amounts, dates, status, and any refunds.
• Your subscription: what you bought, the price, the billing period, whether the boost is on, and whether it is scheduled to cancel.
• An identifier that links you to your customer record at our payment processor.
• The date, time and IP address at the moment you agreed to the Terms and paid.

We never see or store your card number. Card details go straight from your browser to Stripe, our payment processor.

Your server and how you use it

• The server name you choose, which becomes a public hostname, the game, the location you picked, and the machine it runs on.
• The files, worlds, configuration and mods you upload or install. We store them so your server works, and we do not go looking through them.
• Server state and lifecycle events: when it was created, started, stopped, suspended or deleted.
• Live console output and resource graphs while you have the dashboard open. The console streams from the machine to your browser.
• Technical logs from the machine your server runs on, including network connection records.

Support and enquiries

• Support tickets and every message in them, including anything you paste in.
• Enquiries you send through the contact form on our website: your email address and what you wrote.
• If you tell us which region you would like us to add: the location you asked for, your ping to your nearest region, and your email if you gave one.

Website and dashboard usage

• Standard request information handled by our network provider, including your IP address, browser type and the pages requested.
• Advertising conversion measurement on our website and dashboard, described in the sharing section below and in the Cookie Policy.

We do not ask for, and do not want, your date of birth, your government ID, your phone number or your physical location beyond the billing address needed for payment.

To run your server

Create it, name it, place it in the region you chose, give it a hostname, keep it running, and let you manage it.

To take payment

Charge your card each month, send invoices and receipts, and process refunds.

To manage your account

Sign you in, verify your email, reset your password, and let you cancel or close the account.

To support you

Answer your tickets and emails, and look at your server when you ask us to.

To keep the service safe

Rate limit sign-ups and logins, spot and stop abuse, investigate attacks, and keep an audit trail of administrative actions.

To handle disputes

Answer chargebacks and payment disputes with a record of who bought what, and when.

To meet our legal duties

Keep financial records, and respond to lawful requests.

To measure our advertising

Understand which adverts lead to sign-ups, using the Google tag described below.

IP addresses matter enough to describe on their own, because we record them in a few specific places and keep some of them as evidence.

When you sign up

We store the IP address the account was created from, on your account record. It stays until you close your account.

When you pay

We store the date, time and IP address of the moment you agreed to the Terms and paid. We keep this as evidence if a payment is later disputed or charged back.

While you browse

Our network provider processes your IP to route requests, block attacks and filter bots.

Rate limiting

We use your IP as a temporary key to limit repeated sign-ups, logins, password resets and contact form posts. These records live in memory for minutes and are not part of your account.

Abuse investigations

If a server is suspected of attacking someone, the evidence bundle we collect includes network connection records and the owner's account details. We keep those bundles for 90 days.

Administrative actions

Our audit log records the IP of any of our staff who take an action on an account.

We do not use your IP address to build a profile of you, and we do not sell it.

We share only what each company needs to do its job for us. None of them are allowed to use your information for their own purposes.

Companies we have chosen, by name

Stripe (payments)

Your name, email, billing address, and the payment details you type into their form. They process the payment, hold your card, and handle disputes. We never receive your card number. See stripe.com/privacy.

Cloudflare (network and hosting)

Your IP address and request details when you visit our sites, because our sites and APIs sit behind their network. They also host our website, run our DNS, and hold our own encrypted database backups. Your game server files and its backups are not stored with them. See cloudflare.com/privacypolicy.

Supabase (database hosting)

They host the database that holds your account, billing and server records. The database is in London, United Kingdom. See supabase.com/privacy.

Upstash (session and rate limit store)

They host the fast temporary store that holds your login session and the short-lived counters we use to rate limit sign-ups and logins. It holds no name, email or payment information. See upstash.com/trust/privacy.txt.

Resend (email)

Your email address and the contents of the service emails we send you (verification, receipts, payment problems, suspension notices). See resend.com/legal/privacy-policy.

Zoho Desk (support desk)

When our support desk integration is switched on, your name, email and the contents of your support conversation are copied into it so our team can answer you. Our own database stays the master record. See zoho.com/privacy.html.

Google (advertising measurement and fonts)

When advertising measurement is enabled, Google's tag on our website and dashboard receives your IP address, device and browser information, and the fact that a purchase happened along with its value and a reference number. Our pages also load fonts from Google, which means Google sees your IP address when a page loads. See policies.google.com/privacy.

Companies described by category, because we have not fixed the choice yet

• Data center and server providers. They house and operate the physical machines your server and our systems run on, in the United States and in the other regions we offer. They can technically access the hardware, and they hold their own connection and network records.
• Upstream network and attack mitigation providers. They carry and filter the traffic to your server, which means they process the IP addresses of everyone who connects to it, including your players.

We will name these once the choice is settled. If you need to know who they are today for a specific server, ask us and we will tell you.

Others

• Mod and modpack repositories. When you install a mod or modpack, your server downloads it directly from the repository (for example Modrinth or Feed the Beast), so those services see the server's IP address. We do not send them your account details.
• Law enforcement and legal requests, where we are legally required to respond, or where we believe there is a risk to someone's safety.
• A buyer, if the business is ever sold. We would tell you first.

• We do not sell your personal information, and we never have.
• We do not share your information with data brokers.
• We do not show adverts inside the service or the dashboard.
• We do not read your server files or your worlds, except when you ask us to look at something, or when we are investigating a specific abuse report.
• We do not record your screen or your session.

Account details

While your account is open. Erased when you close it, as described below.

Invoices and refund records

Kept after your account closes, because financial records have to be kept. We keep them for at least seven years.

Support tickets in our system

Deleted when you close your account. Copies inside our support desk software are deleted separately, on request or on our own schedule.

Sign-up IP address

With your account, and erased when you close it.

Payment consent record (time and IP)

Kept with the subscription and financial records.

Abuse evidence bundles

90 days.

System and server logs on our machines

30 days.

Performance metrics

30 days.

Login sessions

Seven days, or until you sign out. Kept on our servers, not in your browser cookies.

Your game server backups

They sit on the same machine as your server, and they last until you delete them or the server is deleted, whichever comes first. We do not keep a copy anywhere else, so download anything you want to keep.

Database backups

Our database is backed up daily and copied off-platform in encrypted form. A closed account can survive in those copies for a short period until they roll over.

Administrative audit log

Kept indefinitely. It is a permanent, unchangeable record of actions our staff took on accounts, and it is the reason we can tell you exactly what happened to your data.

See what we hold

Most of it is already in your dashboard: your account, your servers, your invoices and your tickets. If you want a full copy of everything else we hold, email [email protected] from the address on your account and we will put it together and send it, normally within 45 days.

Correct something

Change your email and billing details in the dashboard, or ask us and we will fix it.

Delete your account and data

In the dashboard, cancel your plans and remove your servers first, then use Close account. That is not a soft delete. It permanently erases your email address, password, verification record, sign-up IP, control panel credentials, billing name and address, and every support ticket you ever opened.

Two things deliberately survive, and you should know about both. We keep your invoices and refund records, because we have to keep financial records, along with a stripped account record that holds nothing but an internal identifier and the date you joined, so those invoices still make sense. We also keep the audit entry showing the account existed and was closed at your request.

You can also just email [email protected] and ask us to close the account for you.

Email

We only send service email today: verification, receipts, payment problems, suspension and deletion notices, and replies to your tickets. We do not send marketing newsletters. You cannot opt out of service email while you have an active service, because it is how we tell you your server is about to be suspended or deleted.

Some states give residents specific privacy rights. We give the following rights to every one of our US customers, wherever you live, because sorting people by state is worse for everyone.

• The right to know what personal information we have collected about you, where it came from, why we collected it, and who we shared it with.
• The right to a copy of that information.
• The right to have it corrected.
• The right to have it deleted, subject to the records we have to keep.
• The right to opt out of the sale or sharing of your personal information.
• The right not to be treated worse for exercising any of these. We will not degrade your service or charge you more.

We do not sell your personal information for money. We do use Google's advertising tag to measure which adverts lead to sign-ups, and under California law that can count as sharing personal information for cross-context behavioural advertising.

To opt out of that, email [email protected] with the subject line "Do not share my information" and we will exclude your account. You can also block the tag in your browser, or use Google's own advertising controls. The Cookie Policy explains what the tag sets.

To use any of these rights, email [email protected] from the email address on your account so we can tell it is you. If you are asking on someone else's behalf, we will need something showing you are allowed to. We do not charge for this and we will not make it difficult.

We do not knowingly collect sensitive personal information, and we do not use or disclose it for anything beyond running the service.

You must be at least 13 to have an account with us. Our service is not directed at children under 13, and we do not knowingly collect personal information from them.

We know a lot of our players are young, and a lot of servers are run by teenagers. If you are under 18, use the service with a parent or guardian, and only they should be paying for it.

If we learn that an account holder is under 13

• We stop the subscription so no further payment is taken.
• We close the account and delete the personal information we hold about that child, promptly and permanently.
• We delete the server and its data along with it, so tell us first if there is a world worth saving.
• We keep only the minimum financial record of the payments that were already taken, because we have to.

If you are a parent or guardian

Email [email protected] and tell us the account email address. We will confirm what we hold, delete it, and stop any further charges. We will not ask you or your child for more information than we need to find the account and act on your request. If you would rather review the information first, say so and we will send it to you before we delete it.

• Passwords are stored with argon2id, a one-way hash. Nobody at Qubesquad can read your password.
• The control panel password we hold on your behalf is encrypted at rest with AES-256-GCM.
• Your login session lives on our servers, not in a cookie carrying your identity, and a password reset kills every session you have.
• Traffic to our websites and API is encrypted in transit, and our services are not directly exposed to the internet, they sit behind our network provider.
• Every request for one of your servers is checked against your ownership before anything happens, by design and in more than one place, so another customer cannot reach your server by guessing an address.
• Our secrets are stripped from logs automatically, so credentials do not end up in an error report.
• Our staff tools write an unchangeable audit record of every action taken on an account.

No system is perfectly secure. If we ever have a breach that affects you, we will tell you and the relevant authorities as the law requires.

We are a US company. Our systems are spread across a few places, and you should know where:

Account, billing and server records

In our database, hosted in London, United Kingdom.

Your game server and its files

In the region you picked when you bought it. Today that is the United States, Europe, Singapore or Australia.

Server backups

On the same machine as the server they belong to, in the region you picked. They are not copied anywhere else.

Website and dashboard delivery

Through a global network, so pages are served from a location near you.

Support conversations

In our database, and in our support desk software when that integration is on.

This means your information moves between countries. We use established providers and contractual protections for that, and it does not change any of the rights described above.

We currently sell to customers in the United States, and this policy is written for US law. If we start selling into other countries, we will add the disclosures and rights that those countries require, and tell you before they apply.

We update this page when what we do changes. The date at the top is when the current version took effect. If a change materially affects how we use your information, we will email you at least 30 days before it takes effect. Questions go to [email protected], or write to us at 30 N Gould St Ste N, Sheridan, WY, 82801, United States, and we will answer them properly. This is about Qubesquad, so we would rather explain than hide.