Privacy Policy
Last Updated: July 9, 2026
1. Introduction
Spawnly ("we") values your privacy. This policy details how we handle your data in compliance with the General Data Protection Regulation (GDPR). By using our services, you consent to the data practices described in this policy.
2. Data We Collect
- Identity Data: Email address, encrypted passwords, and OAuth provider IDs (Google).
- Financial Data: Transaction history, subscription statuses, and payment identifiers. Note: We do not store full credit card numbers; these and recurring billing tokens are handled directly and securely by Stripe.
- Technical Data: IP addresses, browser type, login timestamps, and server resource usage logs (CPU/RAM metrics).
- User Content: Game world files, properties files, and server logs uploaded to our infrastructure.
3. Infrastructure & Sub-processors
To provide our service, we use the following third-party providers. We have Data Processing Agreements (DPA) in place where applicable.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Primary Hosting (App, Database, Game Servers) | Germany / Finland (EU) |
| AWS (S3) | Encrypted Backups & File Storage | EU Regions |
| Stripe | Payment Processing & Subscription Management | Global |
| Optional Social Login | Global |
* Note: Our database is self-hosted on Hetzner infrastructure. We do not share your database records with "Supabase Inc."
4. How We Use Your Data
We use your data solely to:
- Provision and manage game server instances.
- Process payments, manage automatic credit refills, and maintain billing ledgers.
- Prevent fraud and abuse (e.g., detecting multiple accounts to bypass free tier restrictions).
- Comply with legal obligations (e.g., tax laws).
5. Data Retention
Account Data: Retained for the lifetime of your account. Inactive accounts may be pruned after 12 months of inactivity.
Server Data: Retained as long as the server exists. Deleting a server via the dashboard immediately schedules the associated S3 data for permanent deletion.
6. Your Rights (GDPR)
You have the right to:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Correct inaccurate data.
- Erasure ("Right to be Forgotten"): Request deletion of your account, active subscriptions, and all associated data, provided we have no legal obligation to keep it.
- Portability: Receive your data in a structured, commonly used format.
Contact support@spawnly.net to exercise these rights.
7. Cookies
We use essential cookies for authentication (maintaining your login session) and security (CSRF protection). We do not use third-party tracking cookies for advertising purposes.