Privacy Policy

Octic is a game server hosting service operated by Lavender Software Development, which is the data controller for the personal data described here. You can reach us about anything in this policy at support@octic.host.

This policy covers the Octic website, dashboard, admin panel and API. It does not cover the game servers you run: those are yours, and the data on them belongs to you and your players - see section 2 for what that means in practice.

We collect four categories of information. Everything below is collected because the service cannot run without it.

Account data. Authentication is handled by Clerk. When you sign up we receive and store your email address, your display name, your avatar image URL, your Clerk user identifier, and the timestamps and IP addresses associated with your sign-in sessions. We never see or store your password - Clerk handles the credential itself, and if you sign in with Google or Discord we receive only the profile fields you authorise there.

Billing records. Which plan you are on, what you were charged, when, in which currency, the status of each payment, and any credits or refunds applied. Card details are handled entirely by our payment processor - they are never transmitted to, or stored on, our servers. We retain only the transaction reference and whatever the processor returns for reconciliation, such as a card brand and last four digits.

Server configuration. What you asked us to run: the game and version, the jar or modpack you selected, the memory, CPU and disk allocation, the AWS region and node your server landed on, the port assigned, the MOTD, whitelist and operator lists you set, and any hostnames you attached. This is your configuration, not your world - see section 3.

Technical logs. IP addresses, user-agent strings, request paths and timestamps for requests to the dashboard and API; error traces when something fails; and a record of the AWS API calls we make on your behalf, so that an unexpected instance launch or termination can be traced to the account that caused it. These logs exist for security, debugging and abuse investigation.

• We do not inspect your game content. We do not read your world files, your chat logs, your player inventories, your builds, your console output beyond what the control panel streams back to you, or the content of files you upload. A game server is a workload on our infrastructure, not a dataset we mine.
• We do not sell personal data. Not to advertisers, not to data brokers, not to anyone. We do not share your personal data with third parties for their own marketing.
• We do not run advertising or cross-site tracking. There are no advertising cookies on this site, no third-party analytics pixels, no fingerprinting, and no social login buttons that phone home on page load.
• We do not profile you. We do not build behavioural profiles, infer sensitive characteristics, or use your data to train machine-learning models.
• We do not collect more than we need. We do not ask for a postal address, a phone number, a date of birth, or a government identifier, because none of them are required to run a game server.

Where the GDPR or a comparable law applies, each processing activity rests on one of the legal bases below.

• To perform our contract with you (Art. 6(1)(b)). Creating your account, provisioning and running your server, connecting your domain, delivering the control panel, processing your payment, and providing support. If we did not process this data, there would be no service to deliver.
• For our legitimate interests (Art. 6(1)(f)). Keeping the platform secure and available; detecting, investigating and stopping abuse such as denial-of-service attacks, crypto mining, malware hosting and attempts to escape a server’s isolation; preventing fraud and account evasion; and debugging failures. We have weighed these interests against your rights: the processing is limited to what security requires, and you can object (see section 10).
• To comply with legal obligations (Art. 6(1)(c)). Retaining billing and tax records for the period the law requires, and responding to lawful requests from authorities.
• With your consent (Art. 6(1)(a)). Only where we ask for it explicitly, such as an optional product email. You can withdraw consent at any time, and doing so never affects your access to the service itself.

• Clerk - authentication and session management. Receives your email address, name, avatar URL and sign-in metadata.
• Amazon Web Services - compute and DNS. Hosts your game server instances and their encrypted volumes, and serves DNS records where we manage the zone through Route 53.
• Neon or Supabase - managed PostgreSQL hosting for the application database: accounts, servers, configuration and billing records.
• Vercel or AWS Amplify - application hosting for the website, dashboard and API. Requests to the dashboard necessarily pass through their infrastructure.
• Modrinth and CurseForge - the add-on catalogues the plugin and modpack browser queries. When a catalogue request is made directly from your browser, those providers will see your IP address along with the project identifiers you searched for. Requests made from our servers disclose our IP address instead. Their handling of that data is governed by their own privacy policies.

We may also disclose data where we are legally required to, or where it is necessary to establish, exercise or defend a legal claim. If we are ever acquired or merged, your data may transfer to the successor entity; we will notify you before that happens and this policy will continue to apply until it is replaced.

We set session cookies, and only session cookies. They are issued by Clerk to keep you signed in, and they are strictly necessary - without them the dashboard cannot tell one request from the next, and you would be asked to authenticate on every page.

Because they are strictly necessary, they do not require consent under the ePrivacy Directive, and we do not show a cookie banner for them.

There are no advertising cookies, no analytics cookies, no cross-site tracking cookies and no third-party marketing pixels on any Octic page. We also do not use browser storage to follow you between sites.

You can clear or block cookies in your browser settings. If you block the session cookie you will not be able to sign in, but the marketing pages will still work.

• Account data is kept while your account is open, then deleted within 30 days of closure.
• Server data - worlds, backups and configuration is kept for as long as the server exists, then for the backup retention window of your plan, and never longer than 30 days after termination. After that it is deleted. See section 10 of our Terms of Service for the full process.
• Billing records are retained for up to 7 years, because tax and accounting law requires it. Deleting your account does not delete these.
• Technical and security logs are retained for 30 to 90 days, depending on the log, and then rotated out. Logs relating to an open security incident or an abuse investigation are kept until it is closed.
• Encrypted provider backups may retain copies of the above for a short additional period before rolling off on their own schedule.

To request deletion, email support@octic.host from the address on your account, or use the delete-account control in the dashboard. We will confirm what we deleted, and tell you plainly about anything we are required to keep and for how long. Deleting your account is irreversible: download your worlds first.

The measures below are the ones that matter most, and they are all in force today.

• Encrypted volumes. Every game server runs on an encrypted EBS volume, so a world file is unreadable at rest even if a disk is detached from its instance.
• IMDSv2 enforced. Instances require IMDSv2 tokens, which closes off the server-side request forgery route that historically allowed credentials to be scraped from the instance metadata service.
• Least-privilege IAM. The platform’s AWS identity can only start, stop, reboot or terminate instances it created and tagged itself. A bug in our code cannot reach infrastructure we do not own - it becomes a permission error instead.
• Secrets stay server-side. API keys and service credentials are read only in server code and are never exposed to the browser, never inlined into a client bundle, and never returned by an API response.
• Isolation between customers. Each server runs as an unprivileged user on its own instance. Subdomain claims are validated so one customer cannot take a hostname another is using.

No system is perfectly secure, and we will not pretend otherwise. If we become aware of a breach affecting your personal data, we will notify you and the relevant authority without undue delay, and tell you what we know, what we are doing, and what you should do.

Octic runs on infrastructure spread across many AWS regions, and our vendors operate globally. Your data may therefore be processed outside the country you live in, including in the United States.

Where personal data moves out of the UK, the EEA or Switzerland, we rely on appropriate safeguards: the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an equivalent mechanism, agreed with each vendor. Where a vendor is certified under an applicable adequacy framework, we rely on that certification too.

You can request a copy of the safeguards that apply to a specific vendor by emailing support@octic.host.

Depending on where you live, you have some or all of the following rights over your personal data. We apply them to everyone, wherever you are, unless a law forces us not to.

• Access. Confirm what we hold about you and receive a copy of it.
• Correction. Have inaccurate data corrected, and incomplete data completed.
• Deletion. Have your data erased, subject to the retention we are legally required to keep - see section 7.
• Portability. Receive the data you gave us in a structured, machine-readable format, and have it transmitted to another controller where technically feasible.
• Objection. Object to processing based on our legitimate interests. We will stop unless we can demonstrate compelling grounds that override yours.
• Restriction. Ask us to limit what we do with your data while a dispute about it is resolved.
• Withdraw consent. Where processing rests on consent, withdraw it at any time.
• Complain. Lodge a complaint with your local supervisory authority. We would rather you came to us first - we usually fix the problem faster - but it is your right either way.

Email support@octic.host to exercise any of these. We respond within 30 days, and we will not charge you for a reasonable request. We may ask you to verify your identity first, because a request that anyone could make about anyone is not a privacy right - it is a vulnerability.

Octic is not directed at children. You must be at least 13 years old to hold an account - or the higher minimum age at which you can consent to online services in your country, up to 16 - and we do not knowingly collect personal data from anyone below that age.

We do not ask for a date of birth and we do not attempt to profile the age of our users, so we rely on you to meet the eligibility requirement in our Terms of Service. If you believe a child has created an account, email support@octic.host and we will investigate and delete the account and its data.

We update this policy when what we do with data changes - a new sub-processor, a new category of collection, a change in retention. The “Last updated” date at the top of the page always reflects the current version, and previous versions are available from us on request.

If a change materially affects how we handle your personal data, we will notify you by email or in the dashboard before it takes effect. Continuing to use the service after that means you accept the updated policy.

Privacy questions, data-subject requests and security disclosures all go to support@octic.host. Put “privacy” or “security” in the subject line so it reaches the right person.

Octic is operated by Lavender Software Development. If you are not satisfied with our response, you have the right to complain to your national data-protection authority.