Privacy Policy

Account data: name, email address, hashed password (scrypt - we never store the password itself), session records, email-verification and password-reset token hashes, and notification preferences.

Service data: your servers' Pterodactyl identifiers, plan, resource limits, allocated address/port, provisioning and lifecycle events, and support ticket contents.

Billing data: invoices, amounts, coupon usage, and payment references from Cashfree (order and payment IDs, status, method summary such as UPI/card). Full card numbers and CVV never reach our systems; they are handled only by Cashfree's hosted checkout.

Technical data: security events (login failures, rate-limit hits), audit logs of admin actions, and standard server logs. Cookies: a session cookie and a CSRF token cookie are required for sign-in and form security; we do not run advertising trackers.

To create and secure your account, verify your email, provision and manage your servers, issue and reconcile invoices, prevent fraud and abuse, and provide support.

To send service messages (verification, invoices, suspension warnings, maintenance notices). We do not sell your data and we do not send marketing email without a way to opt out.

Cashfree (payment processing) receives the information required to process your payment and comply with its own regulatory duties. Pterodactyl (our own self-hosted panel) stores a user record with your email so servers can be attached to you; you set the panel password yourself.

Infrastructure and email providers process data only to deliver the service. We disclose data to authorities only where legally required, and we will tell you unless prohibited.

Application data is stored in our own database on infrastructure we operate in India. Backups of that data are stored on the same trusted infrastructure with restricted access.

Payment data additionally lives with Cashfree under its policies. Email is delivered through the SMTP provider configured by the operator.

Sessions, expired verification/reset tokens and rate-limit records are pruned automatically (within days). Webhook payload copies are stripped after 90 days. Server lifecycle records are kept while your account exists.

Invoices and payment/refund records are retained as required for accounting and tax purposes even if your account is closed. Server data is deleted according to the retention window after termination.

You can update your profile, change your password, and revoke your other sessions from account settings. You can delete your account from settings; we will disable it, cancel active services and minimise your data, keeping only records we must retain.

For access, correction or deletion requests, email us from your registered address. You may also complain to us first - we will answer - before approaching a supervisory authority.

Passwords are hashed with scrypt; session tokens are stored only as hashes; all traffic to the dashboard is encrypted with TLS. Admin actions are logged. We limit who on our side can access customer data.

No system is perfectly secure; if a breach affects your data we will notify you and the relevant authorities as required.