Privacy

The short version

Pratik Hemanshu Patel, trading as Wyrm Host is the controller of the personal data described here. We collect what running your world requires and no more: there is no advertising, no third-party analytics, no tracking pixels, and no sale of personal data. The site sets one cookie, and it is the one that keeps you logged in.

Questions, or want your data deleted? Email crew@wyrmhost.io.

What we collect, and why

Everything below is either something you typed, something a payment or hosting provider told us, or something a running world reported.

• Account: your email address and a one-way hash of your password. Needed to have an account at all.
• Session: a random token in an httpOnly cookie, so you stay signed in. It is not used for tracking.
• Your world's configuration: its name, region, plan, and the join password, which we store encrypted so we can show it back to you.
• Your in-game player id, which you give us at checkout. It is written into the world's config so the game grants you owner privileges in your own world. We use it for nothing else.
• Billing: a Stripe customer id, your subscription's status, and what you bought. Card numbers go straight to Stripe and never reach our servers.
• Operational data from your running world: its address and ports, resource usage, game build, errors, and who is connected.
• Support correspondence, including messages you send us on Discord or by email.
• Ordinary server logs — IP address, timestamp, and what was requested — kept for security and debugging.

About the other players on your world

When your world is online we poll it for a player count and the names of the players connected, so your dashboard can show who is on and so an empty world can be parked to save resources.

That means we hold a little data about your friends, not just about you. We do not contact them, profile them, or keep a history of their sessions, and the list is discarded when the world is deleted. If you are the world owner, tell the people you invite that this is how it works.

Legal bases

Where the UK/EU GDPR applies, we rely on: performance of a contract (running the world you bought, taking payment); legitimate interests (keeping the service secure and working, preventing abuse); and legal obligation (tax and accounting records). We do not rely on consent, because we do not do anything optional with your data.

Who we share it with

Only the companies we need to run the service, each handling only what their job requires:

• Stripe — payments, subscriptions and invoices. Stripe is the controller of your payment details under its own privacy policy.
• Infrastructure providers — the machines your world runs on, and the machine this site runs on. They hold your world's data and its IP address.
• Our DNS and network provider, which sees requests to the site.
• Discord, if you choose to talk to us there — under Discord's own terms.
• Professional advisers, or an authority where the law requires it.

Where your data is held

Your world runs in the region you picked, which may be outside your own country because that is the point of choosing a region. Our account and billing records are held in the United States and the European Union. Where a transfer leaves the UK or EEA we rely on the standard contractual clauses or an adequacy decision.

How long we keep it

Your account and its worlds last as long as your account does. When a world is deleted, its data and save are erased within 30 days. Server logs are kept for up to 90 days. Billing and tax records are kept for as long as tax law requires, typically six or seven years, which is why closing your account does not erase your invoices.

Your rights

You can ask for a copy of your data, correct it, have it deleted, restrict or object to what we do with it, or ask for it in a portable form. Email crew@wyrmhost.io and we will answer within 30 days. We will ask you to confirm you control the account's email address before acting.

Deleting your account deletes your worlds, so export any save you care about first. If you think we have handled your data badly, tell us — and you can also complain to your local data protection authority.

Security, and children

Passwords are stored hashed, join passwords are stored encrypted, the site is served over HTTPS, and access to the control plane is limited to the people who operate it. No service is perfectly secure; if a breach affects you we will tell you and the relevant regulator as the law requires.

This service is not directed at children under 13, and we do not knowingly collect their data. If a child has created an account, email us and we will remove it.