Privacy
Whoever runs an installation is responsible for the personal data in it (under the GDPR: the controller). This page lists what the panel stores, so you can describe it in your own privacy notice and answer requests.
What is stored
Section titled “What is stored”In the panel’s database:
| Data | About whom | Kept |
|---|---|---|
| Account: email, display name, password hash, two-factor secret and recovery codes, passkeys, linked sign-in providers | every user | until the account is deleted |
| Memberships and server permissions | members | until removed, or the account is deleted |
| SSH public keys, with when they were last used | users who add them | until removed |
| Push subscriptions: the browser’s push address and a device name | users who turn notifications on | until turned off, or the browser drops them |
| API tokens: name, a hash, last use and the IP address of the last use | token owners | until revoked |
| Invitations: the invited email | invited people | 30 days after they are used or expire |
| Audit log: who did what (user id), when, from which IP address | everyone acting in the panel | IP addresses: 30 days; entries: 365 days (both adjustable) |
| Webhook deliveries: the event sent, with server names | — (may contain names users chose) | 30 days |
| Metrics: CPU, memory, network, players per minute | — | 7 days |
On the nodes: the game servers’ files and console logs (2 MB per server, rotated), which can contain player names and chat. They are deleted with the server.
The panel itself sends data to nobody, except where you configure it: your mail server, your webhooks and port forwarding providers, Steam (for downloads), and the push services of the browsers your users choose (Google, Mozilla, Apple), which receive only encrypted messages.
Requests from people
Section titled “Requests from people”People handle most requests themselves, on their Account page:
- Access: Your data → Download my data gives a JSON file with everything the panel stores about them: account, sign-in methods, memberships and permissions, SSH keys, notification devices, personal API tokens, and their entries in the audit log.
- Correction: the display name directly; a new email address counts once they confirm it with the link sent there (the old address is told). Operators can also change an address under Admin → Users, without confirmation.
- Deletion: Your data → Delete my account, confirmed with the password (or, for accounts that sign in only with a provider, the email address). It removes the sign-in methods, memberships, permissions, personal tokens, SSH keys and notification devices. Servers belong to their tenants and stay. The last operator, and the only owner of a tenant, have to hand over first. Operators can delete accounts under Admin → Users too.
The audit log keeps its entries about a deleted account under the user id only, without the email address, until its retention period ends.
Retention
Section titled “Retention”Admin → Settings → Privacy sets how long the audit log keeps data; the panel removes older data once a day:
| Setting | Default |
|---|---|
| Remove IP addresses from the audit log after | 30 days (the entry stays) |
| Delete audit entries after | 365 days |
0 keeps the data. Webhook deliveries and used or expired invitations are removed after 30 days. Write the periods you choose into your privacy notice.
Hosting for others
Section titled “Hosting for others”With the hosting profile, tenants are kept apart, and webhooks can’t reach private networks by default. If you host for customers, you are usually their processor for the game servers’ contents: agree on that in your terms, and list the subprocessors you use (the cloud provider of your nodes, your mail provider).