This policy explains how Wilderack (“Wilderack”, “we”, “us”) handles personal data when you visit wilderack.com, use our panel at https://app.wilderack.com, or play on a Wilderack server. It’s written to be read, so it’s in plain words. If anything is unclear, ask us at privacy@wilderack.com.
Who we are
Wilderack is a company in the United States, at [registered postal address]. For the personal data in your account, we are the “controller”: we decide why and how it’s used.
- Contact: privacy@wilderack.com
- Our representative in the EU: [our representative in the EU]
- Our representative in the UK: [our representative in the UK]
The short list of what we collect
When you create an account
| Data | Why we need it |
|---|---|
| Email address | To sign you in (we email you a code) and send receipts and important notices about your servers. |
| Month and year of birth | To check you’re 13 or older, and to know when special rules for under-18s apply. We ask for your full date of birth, but we only keep the month and year. |
| Display name | So you and the friends on your servers can see who did what. It isn’t public. |
| Sign-in accounts you link | If you sign in with Discord, Google or Microsoft, we get an ID for that account and its verified email. If you link Steam, we get your Steam ID so the panel can make you an admin in Steam games. We don’t get your passwords or your friends lists. |
| Passkeys | If you add one, we store its public key. Your fingerprint or face never leaves your device. |
If you’re under 13, our sign-up stops at the birthday question and we don’t store anything about you.
When you buy something
Stripe, our payment provider, collects your card or other payment details directly. We never see or store your full card number. From Stripe we keep your customer ID, what you bought, your invoices, and the country and postal code needed to work out sales tax or VAT. For a 3-day pass we also keep the card’s fingerprint, a code Stripe makes that can’t be turned back into the card number, so one card can’t take a new pass again and again. If a parent pays through the Ask a parent to pay link, the receipt and payment details belong to them, and they don’t need a Wilderack account.
When you use your server
- Your content: your worlds, settings, mods, uploads and server logs. We store and back them up only to run your server. Our support team can only open your files or console when you grant them access in the panel, and that access runs out on its own. Outside that, we only look at your content when we have to keep the service safe or follow the law, for example to investigate a report of abuse.
- Activity log: a record of actions on your server, such as who started it, who installed a mod, which console commands were typed and which files were changed (the file’s name and size, never what’s inside). Owners see their server’s log in the panel. We keep it for one year.
- Support messages: what you send us and our replies.
When you visit our site or panel
- IP addresses: we need them to deliver pages and block attacks. We don’t store them in our account database. Our activity log keeps a scrambled (salted and hashed) version, and the salt changes every month, so it can’t be turned back into your address.
- Usage statistics: we count things like page views and which features get used, with our own first-party tools. These counts aren’t linked to you, have no advertising cookies, and are kept for 90 days.
- Cookies: only the ones needed to keep you signed in, keep the site secure and take payments. See our cookie notice.
When you join someone’s server as a player
Anyone can join a Wilderack server to play, even without an account. Your game connects through our gateway, which protects servers from attacks. It sees your IP address and the network traffic your game sends, and passes it to the server you’re joining.
- Our gateway keeps connection records (IP address, time, which server) for 7 days to stop attacks and handle abuse, then only totals with no IP addresses.
- The server’s owner can see your IP address and in-game name, like on any game server, and some games and mods record more. The owner decides what happens to that data, and our terms only let them use it to run the server.
Parental controls
If a parent or guardian turns on parental controls, we keep their email address and a protected (hashed) version of their PIN, plus the settings they choose. We delete them when parental controls are turned off or the player turns 18.
Why we use your data, and our legal basis
If you’re in the EU or the UK, the law asks us to name a legal basis for each use.
| What we do | Legal basis |
|---|---|
| Create your account, run your servers, take payment, send receipts and service emails, give support | Contract: we need it to provide the service you asked for. |
| Keep invoices and tax records | Legal obligation: tax laws say we must. |
| Protect Wilderack and its players: stop attacks, fraud, spam and abuse, keep security logs | Legitimate interests: keeping the service and everyone on it safe. |
| Improve Wilderack using statistics that don’t identify you | Legitimate interests: making the service better. |
| Send news and offers by email | Consent: only if you’re 16 or older and opted in, or a parent agreed for a younger player. You can stop any time with one click. |
| Report illegal content to the authorities where the law requires | Legal obligation. |
We don’t make decisions about you that have legal or similarly big effects using only automated systems. Our automatic abuse filters (for example, slowing a server that is attacking other networks) are always checked by a person before an account is closed.
Who we share data with
We don’t sell your personal data, and we don’t share it for advertising. We use a few trusted companies to run Wilderack. They may only use your data to provide their service to us, under contracts that protect it.
| Company | What they do for us | Where |
|---|---|---|
| Cloudflare | Hosts our website, panel and database; sends sign-in codes, receipts and notices; security and attack protection; stores backups | Worldwide network; backups of EU servers stay in the EU |
| Stripe | Payments, tax calculation and fraud checks | US and worldwide |
| OVHcloud | Servers that run EU game servers | EU |
| Latitude.sh | Servers that run US East game servers | United States |
| Discord, Google, Microsoft, Steam | Only if you choose to sign in or link those accounts | Their own locations |
We also share data when the law requires it (for example a valid court order), to protect someone from serious harm, to report child sexual abuse material to NCMEC as US law requires, or if Wilderack is sold or merged (we’ll tell you first, and this policy keeps applying).
The friends you invite to your server see your display name. They never see your email address.
Where your data is stored
Wilderack is a US company, so some of your data is handled in the United States.
- Game worlds and backups stay in the region you pick. A server in our EU region keeps its world and backups in the EU.
- Account data (your email, birth month and year, display name) is kept in Cloudflare’s database and may be processed in the US and other countries.
When EU or UK data goes outside those areas, we rely on legal safeguards such as the European Commission’s Standard Contractual Clauses and our providers’ certifications under the EU-US Data Privacy Framework. Ask us at privacy@wilderack.com for a copy of the safeguards.
How long we keep it
| Data | How long |
|---|---|
| Email, birth month and year, display name | Until you delete your account |
| Worlds, settings, mods and backups | Until you delete them or your server ends. After a plan ends we keep them for 44 days so you can come back, then delete them for good |
| Activity log | 1 year, and anonymised if you delete your account |
| Gateway connection records with IP addresses | 7 days |
| Usage statistics | 90 days, never linked to you |
| Invoices and tax records | As long as tax law requires, usually up to 7 years |
| Support messages | 2 years after the conversation ends |
| Parental control details | Until they’re turned off or the player turns 18 |
Your rights and choices
You can do most of this yourself in the panel, under your account settings:
- See and download your data: export everything in your account as a file, with links to download your worlds.
- Correct it: change your email or display name.
- Delete it: delete your account. We stop and delete your servers, cancel your plans, destroy the encryption keys for your worlds so they can never be read again, and remove your personal data, except the invoice records we must keep by law.
- Stop marketing emails: use the link at the bottom of any of them, or your settings.
Depending on where you live, you may also have the right to object to or limit how we use your data, to withdraw consent, and to complain to your data protection authority. In the US, residents of some states have the right to know what we collect, to delete it, to correct it, and to opt out of its sale or sharing. We don’t sell or share personal data, so there’s nothing to opt out of, and we treat everyone the same whichever rights they use.
To use any right we don’t offer in the panel, email privacy@wilderack.com. We reply within one month. We may ask you to confirm it’s you, usually by replying from the email on your account. A parent or guardian can make requests for a player under 18.
Players under 18
Many of our players are teenagers, so we go further than the law asks:
- Nobody under 13. Our age check comes before anything else in sign-up and doesn’t hint at the age limit. If we learn that someone under 13 has an account, we delete it and its data.
- No ads and no profiling. We don’t show ads to anyone, and we never build advertising profiles.
- Marketing email only with permission: to players aged 16 or older who opt in, or younger players whose parent or guardian agrees through parental controls.
- Private by default: no public profiles, no friend search, no messaging between users, no location features.
- Parental controls: a parent can set a spending limit, play times, and get receipts and a weekly summary. They never see chat or console contents. See our page for parents.
How we protect your data
- Everything travels encrypted (HTTPS and TLS), including file transfers over SFTP.
- Each world is encrypted with its own key. Deleting the key makes the world unreadable, even in backups.
- No passwords to leak: you sign in with an emailed code, a passkey or an account you already trust.
- Only the people who need it can reach customer data, and every access to production systems is logged.
- If a breach puts your data at risk, we’ll tell the right authority within 72 hours where the law requires, and tell you without undue delay.
Changes to this policy
When we change this policy in a way that matters, we’ll email you before the change takes effect. The date at the top shows the last update.
Contact
Wilderack, [registered postal address]
Email privacy@wilderack.com with any question or request about your data. If you’re in the EU or the UK and you’re not happy with our answer, you can complain to your local data protection authority.