Privacy Policy

1. Who we are

This policy explains how BlockHosting (ABN to be confirmed) handles personal information when you use the website and control panel. We aim to follow the Australian Privacy Principles.

2. What we collect

Account details

Your name, email address and password. The password is stored only as a one-way hash, never as readable text. We record when you confirmed your email address.

Google sign-in

If you choose “Continue with Google”, Google tells us your name, email address, whether Google has verified that address, and an account identifier. We don’t receive your Google password, contacts or anything else.

Two-factor sign-in

If you turn it on, the secret your authenticator app uses, stored encrypted, and your backup codes, stored only as one-way hashes.

Profile picture

Only if you upload one in Account settings.

Workspace and roles

Which workspaces you belong to and your role in each.

Team invitations

When someone invites you, the email address they entered, the role offered, who sent it and when it was used or cancelled. We store only a scrambled form of the invitation link.

Performance history and alerts

Once a minute we record each server’s CPU, memory, storage and network use and whether it was online, and any alerts that opened. If you add a Discord webhook for alerts, we store it encrypted.

Server content

The files, worlds, settings, backups and console output of your servers, and the commands you send to them. Server logs can include your players’ usernames, chat and IP addresses.

Activity records

A record of actions in the control panel, such as starting a server, editing a file or restoring a backup, with the time and the account that did it.

Support tickets

The messages you send us and our replies.

Billing

Your plan, orders, subscriptions and invoices. Card details are entered on Stripe’s checkout and held by Stripe; we only receive a customer reference and payment status.

Technical information

Your IP address and email are used to limit repeated sign-in attempts, and are held for that purpose for about 15 minutes. Requests may be recorded in error logs to keep the service running. When a security check appears on sign-up, sign-in or password reset, Cloudflare receives your IP address and information about your browser to tell people from bots.

3. How we use it

• To create your account, sign you in and keep it secure.
• To run, back up and restore your servers.
• To bill you and keep records the law requires.
• To answer support requests and investigate problems.
• To enforce our Terms and protect our systems and other customers.

4. What we don’t do

• We don’t sell personal information.
• We don’t use advertising or analytics trackers.
• We don’t look through your server files except to provide support you ask for, keep the service secure, or respond to a valid complaint or legal request.

5. Who we share it with

• Stripe, to process payments.
• Providers that host our infrastructure, who store data on our behalf.
• Amazon Web Services sends our emails, such as address confirmations, password resets and team invitations. It receives the recipient’s address and the message.
• Google, only if you sign in with Google. Google sees that you signed in to BlockHosting.
• Cloudflare runs the security check that can appear on sign-up, sign-in and password reset forms.
• Modrinth receives plugin and mod searches from our servers. Your name and email are not sent.
• Discord receives alert messages only if you add a webhook. They contain the server name and what went wrong, nothing about you.
• Other members of your workspace can see its servers, activity, your name and your email address.
• Authorities, when the law requires it.

Some of these providers may store information outside Australia, including in the United States. We only use providers that protect it to a standard similar to Australian law.

6. How long we keep it

We keep your information while your account is open. When you delete your account, we erase your name, email address, password, picture, two-factor details, sign-ins, SFTP logins and support tickets straight away. Invoices, orders and the security log are kept without your name or email, because tax law and fraud prevention require it; billing records are kept for as long as tax law requires, usually five years. Stripe keeps its own payment records under its own policy. Performance history is deleted after 30 days, and closed alerts after 90 days. Server data is covered in Backups and Data Deletion.

7. Security

Passwords are hashed, sign-in sessions use a secure cookie, file access is checked against your workspace role, and actions are recorded. You can turn on two-factor sign-in, and administrators must use it. If you lose access, you can reset your password with a single-use link; we never see or ask for the password itself. To stop abuse we can sign an account out or disable it, and we record the reason. No system is perfectly secure. If a breach is likely to cause you serious harm, we will tell you and do what the law requires.

8. Your choices

• Change your name and picture, sign out other devices, change your password, turn on two-factor sign-in, or delete your account in Account settings.
• Download your server files from the Files page or over SFTP at any time.
• Ask us for a copy of your information, or to correct it, through support. We reply within 30 days.
• If you are unhappy with our answer, you can complain to the Office of the Australian Information Commissioner.

9. Children

Children under 18 may only use BlockHosting with a parent or guardian’s permission. If you believe a child has given us information without that permission, contact us and we will delete it.

10. Cookies

We set one cookie to keep you signed in, and a short-lived one during Google sign-in. See Cookies for details.

11. Changes to this policy

We will tell you about material changes by email or in the control panel before they apply.

12. Contact

Signed-in customers can open a support ticket. Anyone else can email guggsy456@gmail.com.