Metrics and Your Players' Privacy

What Metrics records about your players

While your server runs, Metrics records, for that server: when each player joins and leaves and how long each session lasts, their in-game name, their position in the game world about every 30 seconds, their deaths and kills where the game reports them, the distance they travel and the places they spend time in. Players are identified by the account id the game gives (a Steam id wherever there is one); a game that gives no durable id is identified by the character name.

A player's connection address is never stored, shown or returned to anyone by GameGrid: not on any page, in any download, in the API or in the Discord bot. Addresses a game writes into its own log files stay in those files and are never shown.

To help you spot possible alternative accounts, the machine your server runs on turns a player's connection, the moment the player connects, into a keyed one-way fingerprint (a code that cannot be turned back into the address) and notes the country it comes from. Only the fingerprint and the country are kept; the address itself is thrown away at once. Fingerprints are made with a key unique to your account, so they can only ever be compared between your own players, never with another server owner's. It works on the games whose server tells the platform where a player connects from; Metrics: Moderation says which.

Everything Metrics records is described in section 1A of the Privacy Policy, and your duties as a server owner are in section 8A of the Terms of Service.

How long it is kept

• Positions: 30 days.
• Sessions, each with a simplified route of at most 200 points: 365 days.
• Kills and deaths, with where they happened: 365 days.
• Time spent in each place, per day: 24 months.
• Maps of where players spend time, which identify no player: 12 months.
• Daily statistics: for the life of the server. Starting a new statistics season deletes nothing.
• Names a player has used: with the player's profile on that server.
• Connection fingerprints and the country: 180 days after the player was last seen on that connection.
• Possible alternative accounts: 180 days after the last sign of them, including a link you marked Not the same person. After that only a one-way code of the two accounts is kept for another 180 days, so the same pair is not suggested to you again in that time; it holds no name or id, and goes sooner if either player is forgotten or leaves your servers. Once it has gone, the pair can be suggested again.

Everything recorded about a server's players is deleted with the server.

Who can see it

You, and the people you give access to your server's control panel. Player ids, the player CSV downloads, starting a season, the Player access card and Forget player are for the account owner and administrators only. GameGrid staff can see player-level information only through a support session on your account, and every such view is recorded.

Your players see nothing about other players unless you switch something on.

Possible alternative accounts and the countries players connect from are for the account owner and administrators only. Nobody ever sees a fingerprint, and your players never see any of it, not even their own country.

The Player access card

Open Metrics, then Settings, then Player access: what your players can see. Every switch is off until you turn it on.

• Show live player positions on share links and public maps. A share link shows where players are only when its own Live player positions tick is on and this switch is on. Positions are dots on the map, never names.
• Also show players who hid themselves in the game's own map. Some games let a player hide from the map. With this on, your share links show them anyway. It is off by default, and only works while live positions are on.
• Places lets the distance and places leaderboards be posted and shown publicly (see Metrics Leaderboards).
• Leaderboards for players: Posted leaderboards, the /leaderboard command and Public leaderboard API reads, each off until you switch it on. A player you hide on their profile's Admin tab is never named on them.

If one of your share links already showed player positions before the card existed, it keeps doing so and the card shows a banner saying so, until you review the switches and click Save.

When a player asks to be forgotten

Open the player's profile from Metrics, choose the Admin tab, and click Forget this player. Type the player's name to confirm.

• Their positions, places and names are deleted from Metrics, on all your servers when the game identifies them by an account id, or on that server when it identifies them by name.
• Their connection fingerprints and countries, every possible alternative account they are part of (including ones you marked Not the same person) and their On Watch entries are deleted too.
• Their statistics are kept as Deleted player, so your totals stay right.
• The two Metrics files GameGrid's host agent keeps for your server (the activity log and the session journal) are cleaned too.
• The files a game's own GameGrid plugin, server mod or server module keeps on your server are cleaned too, such as a leaderboard or an event log. On a server that is running, those are cleaned the next time it stops or restarts.
• Backups and Vault saves keep a copy until they expire. Forget player does not reach into a backup or a Vault save, so one taken while a player's lines were in those files still holds them. Every backup is deleted 30 days after it was made, except your server's newest automatic backup, which is kept until a newer one replaces it. A Vault save is deleted 12 months after it was saved.
• Economy records (balances, purchases, rewards) are not changed. If the player asked for those to go as well, remove them in Economy.
• It cannot be undone. A player who comes back later is recorded again as a new player.

If a player contacts GameGrid instead of you, GameGrid support confirms the request, opens a recorded support session on your account and uses the same button.

In the API

GET /api/public/v1/servers/{id}/metrics/player-access reads the card with metrics:read. PUT saves it and needs player_metrics:write on a key created by the account owner or an administrator. Forget player is only in the panel.

The key the API, a CSV download and a panel link use to name a player is not the player's Steam ID and does not contain it: it is k- followed by 22 characters, the same every time for the same player, and it works only inside your own account. Another account sees the same player under a different key, and a key copied from another account matches nothing. An older key of the form p- followed by 16 characters is still accepted.

Chat

Chat and commands typed on your server are stored for 180 days so you can review them. Only the server's owner and

administrators see the text; everyone else sees only that a message was sent. Each time someone opens a player's chat, it is

recorded in your audit log. Link codes typed with !link are never stored, and any network address in a message is

hidden before it is stored. A password typed after a login command (Palworld's /AdminPassword, /login or /register

on a server with a login plugin, DayZ's #login) is stored as [hidden]: the command is kept, the password is not.

Forget player deletes that player's stored chat.