Privacy policy
Last updated
This policy explains what personal data Moonshard Games handles when you visit the site, create an account or run a game server, and what you can ask us to do with it. We collect only what the service needs, we don't sell data and we don't use advertising trackers. Our usage statistics are cookieless, kept on our own servers and cannot identify you.
Who is responsible
The data controller is:
- Operator
- Not published yet
- Organisation number
- Not published yet
- Address
- Not published yet
Write to support@moonshardgames.com for anything about your data.
What we collect and why
| Purpose | Data | Legal basis |
|---|---|---|
| Run your account and servers | Name, email, password (stored only as a hash), your servers, their settings and world files | Contract |
| Bill you and keep accounts | Balance and usage history, payments, country, invoices, Stripe customer id | Contract; legal obligation (bookkeeping and tax) |
| Keep accounts secure | Sessions with IP address and browser, failed sign-in counters, password reset and email confirmation links | Legitimate interest (preventing fraud and account takeover) |
| Send service emails | Email address, name | Contract (confirmations, receipts, password resets, notices about your servers) |
| Handle support and abuse | Your messages to us, notes our staff keep about your account, a log of staff actions on it | Legitimate interest; legal obligation where the law requires it |
| Understand how the site is used | Pages viewed, referrer, country, browser, device and screen size, and whether you signed up, deployed a server or started a payment, with no cookie, no IP address and no link to your account | Legitimate interest (improving the service) |
| Find and fix errors | Error reports with the page or API route and your browser type, without IP address, email or cookies | Legitimate interest (a working service) |
Players who join your server connect to it directly. The game itself may log their names or IP addresses in its own files on your server; you decide what happens to those files, and for that data you are the controller.
Who processes data for us
These companies process personal data on our behalf, under data processing agreements, and only to provide their part of the service:
- Hetzner Online GmbH: Servers, game machines and backup storage. Location: Germany or Finland (EU).
- Stripe: Card payments, tax calculation and invoices (Stripe collects your card and billing address directly). Location: EU and USA.
- Our email provider: Delivers the emails we send you.
- Sentry (Functional Software, Inc.): Error reports, with personal data removed first. Location: USA.
When data goes to the USA, the transfer is covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We don't share your data with anyone else, except when the law requires us to (for example, a court order).
How long we keep it
- Account data is kept while your account is open. When it is deleted we remove your name, email, password, sessions and staff notes, and your servers with their files and backups.
- Payment and usage records are kept for 7 years after the end of the financial year, as Swedish bookkeeping law requires. After an account is deleted they stay only in anonymised form: linked to an id, not to your name or email. Stripe keeps its own records of payments under its privacy policy.
- Sessions end after 30 days, or when you sign out. Password reset and email confirmation links expire within a day.
- World backups keep the last 7 days and 4 weeks. When you delete a server, its backups are deleted about a week later.
- Database backups: the last 7 daily copies stay on our server, and encrypted off-site copies are kept for up to 6 months. Data you deleted can remain in them until they expire; we don't restore it into the live service except to recover from an incident.
Your rights
Under the GDPR you can ask us to:
- give you a copy of your personal data, in a machine-readable format;
- correct data that is wrong (you can change your password yourself on the Account page);
- delete your account and personal data;
- restrict or object to processing based on legitimate interest.
Email support@moonshardgames.com from the address on your account. We answer within one month. Deleting your account ends the service; paid credit you haven't used is refunded first, and records the law makes us keep stay in anonymised form.
If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or the data protection authority in your country.
Security
Passwords are stored as hashes, never in plain text. Connections to the site use HTTPS. Our machines accept administrator sign-ins by key only, off-site backups are encrypted, and staff actions on accounts are logged.
Changes to this policy
The date at the top shows the latest version. If we change how we use your data in a way that matters, we email you before the change takes effect.