Privacy policy

Who we are

ServerStats.cc is operated by ServerStats.CC. Contact us about privacy at [email protected].

Who is responsible for what

There are two kinds of data, and the roles differ:

• Your account, meaning your email, team members and billing. We decide how this is used, so we are the controller.
• Data about your players, collected from your game servers. You decide to collect it and why, so you are the controller and ServerStats processes it on your behalf. We only use it to provide ServerStats to you. Our data processing agreement covers this.

What the agents collect

Each game agent sends only what the dashboard needs:

• Sessions: when a player joins and leaves, playtime and the server or map.
• Performance: tick or frame times, plugin, resource or engine-phase timings, entity counts.
• Network quality where the game reports it, such as ping and failed joins. On Roblox, the module also sends each player's country, from Roblox's own localisation service. Other agents send a country code they work out locally from the player's IP address; the address itself never leaves your server.
• Where players came from: the hostname or tracked link they used, on games that report it.
• Store purchases, from your Tebex, PayNow or CraftingStore webhooks: package, amount, currency, creator code, refunds and chargebacks, and the buyer's ID as a keyed hash. Buyer emails, names and addresses in the webhook are ignored. If you import past payments, the store API key you give us is stored encrypted.
• Game-specific metrics you enable, such as economy totals, jobs or wipes.
• Game events from the plugins you choose to listen to: payments between players, shop and auction sales, trades, punishments, rank changes, votes, crates, teams and, on roleplay servers, jobs, vehicles, property and fines. See Payments, punishments and abuse flags.
• Player properties your own plugins set (text values are stored encrypted), and your team's server notes (encrypted).
• Saved player groups hold only keyed player hashes. A public status page or a dashboard share link, if you create one, shows aggregate counts and uptime only, never player names or IDs.
• Basic mode: the public address you enter, which we query about once a minute (less often while it's offline) for player count, map, version and uptime. Basic mode receives no player data.
• Discord, if you add the bot: your Discord server's member counts and, for /link, a keyed hash of the Discord ID next to the player's hash.

We never collect chat messages, payment notes or memos, passwords or payment card details.

Payments, punishments and abuse flags

When your server runs an economy, moderation or team plugin that ServerStats supports, the agent records what happened, not what anyone wrote:

• Payments, sales and trades are stored as the two players' keyed hashes, the amount, the in-game currency and the plugin that reported it. Notes, memos and comments attached to a payment are dropped on your server and never sent. So are bank account numbers, character ids, phone numbers, house addresses and vehicle plates.
• Punishment reasons are stored as a category by default (for example cheating or spam); the text itself is discarded on your server. An owner or admin on Operator or Network can opt in to storing the reason text for a server. The agent first removes IP addresses, email addresses and similar identifiers from it, and we store it encrypted with your account's key, for 90 days by default (30 or 365 if you choose, never longer than your plan keeps data). Only owners, admins and moderators can read a stored reason, one at a time, and every read is recorded in your audit log. Stored reasons are never sent to Ask ServerStats or MCP, and are left out of exports unless the owner includes them.
• Team, town, faction, island and shop names are stored encrypted with your account's key, if the agent sends them, and shown only if you turn on name display. Otherwise they show as a short id.
• Abuse flags (such as money funnelled from new accounts into one account, transfer rings or staff giving themselves money) are computed from these game events only. We never use IP addresses to detect alt accounts, and never will: we never receive them.

Pseudonymised players, no IP addresses

• Analytics use a keyed hash of each player identifier (Minecraft and Hytale UUIDs, Xbox, Steam and Epic Online Services IDs, Cfx licenses, Bohemia IDs). The key is unique to your account, so the same player can't be linked across different owners' servers.
• The original identifier is kept encrypted with your account's own key, so you can look players up and moderate them. It is never shown in the dashboard or the API.
• On Roblox, the module sends only a per-experience pseudonym by default, never the Roblox user ID.
• ServerStats never receives or stores player IP addresses. The Roblox module sends a country from its localisation service. The optional Plan importer can also send an unambiguous country name from a local backup; no IP address is sent.
• Game agents that can see a joining player's IP address look up its country on your game server, using a small database that ships with the agent, and send only the two-letter country code. The address is never logged, stored or sent, and is dropped right after the lookup. Owners can turn this off with send_country: false. IP to country data by DB-IP (db-ip.com), CC BY 4.0.
• Player names are stored encrypted with your account's key and shown only if you turn on name display.
• Our web server access logs don't record visitors' or game servers' IP addresses.

How long we keep data

Older raw data is deleted every hour. After a downgrade or the end of a trial we keep using your previous plan’s window for 30 days, so upgrading again within that time restores everything. Player profiles and store purchase records are not pruned by age yet: they stay until you erase a player or delete the organisation (see Export and deletion). We will update this page before that changes. Aggregate server charts (per-minute totals for 30 days, hourly and daily totals for longer) hold no player data and are kept longer, whatever your plan. If you downgrade, the shorter window applies from the next hourly run. Stored punishment reasons are kept for the shorter of your plan's window and the period you choose (90 days by default). Abuse flags follow your plan's window. Account data is kept until you delete your account. Usage counters (such as AI questions) and report history are kept for up to 400 days. Encrypted backups roll off within 5 weeks.

Export and deletion

• Download your own account data (profile, memberships, devices, sign-in methods, API tokens, notification choices and audit entries about you) as JSON or CSV from Settings → Security. Owners and admins can export an organisation from Settings → Data & privacy: a ZIP of CSV and JSON files with servers, players (pseudonymous ids; names only if you turned names on and your role may see them), sessions, purchases, events, campaigns, groups, alert rules, dashboards and the audit log, limited to your plan’s history window (24 hours on Free). It is built in the background into a private file, we email a signed link that works for 24 hours, then the file is deleted. One organisation export a day; each is recorded in the audit log. Every chart and table also has a Download CSV button. For anything else, email [email protected].
• Delete an organisation from Settings. This destroys its encryption key first, which makes its encrypted fields unrecoverable, then deletes its servers and data. Encrypted backups that still contain the key expire within 5 weeks.
• Delete your own account from Settings. This removes your login and your membership of every organisation. If you are the only owner of an organisation, delete it (or add another owner) first; an account created with Discord or Google needs a password set before it can be deleted.
• If one of your players asks to be removed, you can delete that player's data from their profile. This also removes them as the other side of other players' payments, trades and punishments (those rows then show an erased player), deletes any stored punishment reasons about them and removes them from abuse flags. It completes within minutes, and data about them that an agent had buffered offline and sends later is erased for 7 days after the request. Purchase records are kept for accounting but unlinked from the player, and aggregate server totals keep only anonymous counts. We will help if you contact us.

Sign-in data

• Passkeys: we store the passkey's public key, the name you give it and when it was added and last used. Your fingerprint, face or device PIN never leaves your device.
• Steam: if you connect Steam, we store your Steam ID encrypted with your account's key, plus a keyed hash to find your account when you sign in. It is never linked to player data. Remove it in Settings → Security.
• Your account export includes your passkeys (names and dates) and your Steam ID.

Security

Agents connect out over HTTPS and never open ports. Each agent enrols once with a single-use claim code, then signs everything it sends with its own key; we keep only the public half, and it can send data but never read it. Personal data (player IDs, names and notes) is encrypted with a key unique to your account, wrapped by a master key kept outside the database. Backups are encrypted with a separate key. Moderation actions are off unless you turn them on for a server, and each one is signed. See Security for the full design.

Ask ServerStats (AI)

When Ask ServerStats is enabled for your account and you use it, your question and the relevant aggregated statistics from your account (with players shown only as pseudonymous IDs, and names only if you have turned name display on) are given to a language model that runs on our own server, next to your data, to generate the answer. Nothing is sent to an outside AI provider. The model never sees raw player IDs, IP addresses or email addresses, and we don't store your questions.

Subprocessors

We use a small number of providers to run ServerStats. The same list is part of our data processing agreement.

Account, security and alert emails are sent by our own mail service on our OVHcloud server, not by a separate email provider. The IP-to-country database in the agents (DB-IP) is a data file that runs on your game server; DB-IP receives nothing from us or from you.

Cookies

We set only strictly necessary first-party cookies, so there is no cookie banner:

• Session (__Host-ss_session): keeps you signed in. HttpOnly, up to 30 days, removed when you sign out.
• Browser recognition (__Host-ss_dev): a random id plus a signed token per account, so we can email you about a sign-in from a browser we haven't seen. HttpOnly, up to 400 days. It holds no IP address.
• Sign-in with Discord or Google (__Host-ss_oauth, __Host-ss_oauth2fa): only while you are signing in with one of them, for 10 minutes or less.
• Steam (__Host-ss_steam): only while you connect or sign in with Steam, for 10 minutes or less.
• Passkey sign-in (__Host-ss_wa): only during a passkey sign-in, for 5 minutes or less.

The anti-forgery token for requests is kept in memory, not in a cookie. Your browser's local storage keeps a hint that you are signed in and preferences such as your chosen date range. No advertising, analytics or cross-site tracking cookies.

Tracked links

Tracked links (serverstats.cc/go/…) count clicks per link per day and then send you to the server owner’s page. We don’t set cookies or store your IP address, device or where you came from; to avoid counting the same visit twice we briefly keep a scrambled form of your address in memory only and never write it down.

Status page email updates

If you subscribe to a status page (serverstats.cc/s/status/…), we store your email address, encrypted, a keyed hash of it so the same address isn’t added twice, and when you subscribed and confirmed. We don’t store your IP address, device or where you came from. We email you only after you click the confirmation link, and only about that page: outages, recoveries and the maintenance or incident notices its owner posts. Unconfirmed addresses are deleted after 48 hours. Every email has a one-click unsubscribe link that deletes your address straight away. The page’s owner and admins can see, export and remove the addresses subscribed to their page; deleting the page or the organisation deletes them.

Changes

If we change this policy in a way that matters, we will email account owners before the change takes effect.