1. Information We Collect
We collect only the technical and operational information required to provision, operate, and secure game hosting instances:
- Account Credentials: Username, email address, cryptographic password hashes, and optional two-factor authentication (2FA) tokens.
- Subscription Records: PayPal subscription identifiers, payment timestamps, and receipt statuses.
- System Telemetry & Logs: IP addresses, browser user-agents, connection logs, and real-time container resource metrics (CPU, memory, disk, network bandwidth).
2. Payment & Financial Privacy
We do not collect, process, or store credit card numbers, debit cards, or bank account numbers on our servers. All financial transactions are processed externally through PayPal’s PCI-compliant infrastructure.
3. How We Use Collected Data
Your information is used strictly for the following operational needs:
- Provisioning, maintaining, and managing your game server instance.
- Authenticating access to the Pterodactyl control panel.
- Sending critical account notices, renewal receipts, and security alerts.
- Detecting and mitigating brute-force attacks, DDoS floods, and unauthorized node access.
- Providing technical support and delivering requested world backups.
4. Third-Party Services
We do not sell, rent, or trade your personal data. Limited information is processed by essential infrastructure providers:
- PayPal: Processes recurring subscription payments and refunds under PayPal’s privacy terms.
- Google reCAPTCHA: Guards authentication forms against automated bot scripts and credential stuffing.
- Datacenter Infrastructure: Host routing providers utilized to transport network packets to your server instances.
5. Data Retention & Deletion
We retain data only as long as needed to provide active service:
- Active Instances: Data is retained continuously during active paid subscription periods.
- Cancelled Instances (7-Day Grace Period): After a subscription concludes, your server instance data is preserved for 7 calendar days to allow clients to request a data export. After this 7-day period, data is permanently purged from disk.
- Web Logs: Connection and access logs are rotated and purged on a regular rolling schedule.
6. Security Practices
All traffic between your browser and our servers is encrypted using modern TLS (HTTPS). Each customer instance runs in an isolated container environment (Wings Docker daemon) with restricted privileges, preventing cross-tenant access.
7. Your Rights
You may request an export of your personal data or permanent deletion of your account and server files at any time by contacting support.