Skip to main content

Privacy Policy

1. Who This Policy Covers

This Privacy Policy describes how GameGrid ("GameGrid," "we," "us") collects, uses, and protects information when you use the platform at wdcgamegrid.com (the "Service"). This policy should be read together with our Terms of Service.

1A. Players on Our Customers' Game Servers

1A.1. Who this section covers. Our customers ("server owners") run game servers on GameGrid. This section covers the people who play on those servers ("players"), whether or not they have a GameGrid account. For the data described here, the server owner decides what it is used for on their server, and GameGrid processes it on the server owner's behalf to provide the Service.

1A.2. What is recorded about players. While a server is running, GameGrid records, for that server:

  • Connections: when each player joins and leaves, how long each session lasts, and the in-game and platform names and identifiers the game reports (for example a Steam ID, an Epic Online Services ID, a Minecraft UUID, a Palworld user ID, a Valheim platform ID, or a Windrose character name);
  • Positions in the game world, about every 30 seconds while the player is connected;
  • Deaths and kills, and how they happened, where the game reports them;
  • Building actions, where the game reports them;
  • Chat messages and in-game commands;
  • Taking part in server events, and activity in the server's economy (purchases, earnings and deliveries);
  • a keyed one-way fingerprint of the player's connection address and of its network, and the country that address belongs to, worked out when the player connects.

The connection address itself is never stored, shown or returned to anyone by GameGrid. Some games write addresses into their own log files; those stay in the game's files as the game wrote them, and GameGrid never shows one.

1A.3. Why. To give the server owner the history and statistics of their server (for example who plays, when, for how long, where in the world and what happens there), optional leaderboards, tools for moderating their server (including a hint that two player accounts may belong to the same person), and to run the server's economy.

1A.4. How long it is kept. Unless the server is deleted sooner:

  • positions (one about every 30 seconds): 30 days;
  • chat messages and in-game commands: 180 days;
  • connection fingerprints and the country: 180 days after the player was last seen;
  • links between possibly related player accounts: 180 days after the last evidence for the link;
  • sessions: 365 days, each with a simplified route of at most 200 points, kept with the session;
  • kill and death events, with where they happened: 365 days;
  • time spent in each place, per day: 24 months;
  • other activity (events taken part in, building, and moderation and admin actions on the player): 12 months;
  • event results and wallet history: 2 years;
  • daily statistics: for the life of the server (a server owner may start a new statistics season; earlier seasons stay viewable and nothing is deleted when a new one starts);
  • names a player has used: with the player's profile on that server;
  • maps of where players spend time, which identify no player: 12 months.

Everything recorded about a server's players is deleted with the server (when an account closes, after the 30-day grace period in Section 7.1).

1A.5. Who can see it. The server owner, and the people they give access to their server's control panel. GameGrid staff can see player-level information only through a support session on the server owner's account, and every such view is recorded. Players see nothing about other players. Leaderboards, public statistics and a player's own statistics page are off unless the server owner switches them on. A player can choose to be left off a server's Metrics leaderboards. A server owner may choose to show players' positions on a public map of their server, even for a player who has hidden their position in the game. Countries, fingerprints and possible links between accounts are never shown to players.

1A.6. A player's rights. A player can ask the server owner, or us at admins@wdcgamegrid.com, to see or erase the information recorded about them on a server. To erase it, the server owner uses Forget player: every fingerprint, link between accounts, position, time spent in places, name, chat message and activity recorded for that player is deleted, and the player's profile, sessions, kill and death records and daily statistics are anonymised so the server's totals stay correct. Economy records (the player's wallet, purchases, and the link between their game and Discord accounts) are not erased by Forget player: they belong to the server's economy, and the server owner removes them in the server's Economy page.

1A.7. No automated decisions. A hint that two player accounts may belong to the same person never causes a ban, a kick or an economy block by itself. Any such decision is the server owner's.

2. Information We Collect

2.1. Account information. Your email address, username, and password (stored as a salted cryptographic hash by our identity provider, Keycloak, never in plaintext) when you register.

2.2. Billing information. Our payment processor, Stripe, collects and stores your payment card details directly; GameGrid does not store your full card number. We retain a reference to your Stripe customer/subscription records, your transaction history, and your account credit balance.

2.3. Service data. Information generated by your use of the Service: your game server's configuration and settings, world/save-file data, uploaded files (including mods), console/log output, and connection metadata (IP address, ports).

2.3A. Vault saves. If you use the Vault, each save is a copy of a game world from one of your servers, with the server's game settings and configuration files and your GameGrid setup for that server (setting presets without their secret values, scheduled commands, the mod list, economy settings, the update preference, the backup schedule and a list of your Event Manager events). A game world and its files can contain the in-game names and game account identifiers (such as Steam IDs) of the people who play on your server, and anything else your server's files contain. We also record each save's name, note, size and game, and when it was saved, loaded, downloaded or deleted, and by whom.

2.4. Support data. The content of support tickets you submit, including any files you attach. This also includes information submitted through public forms such as studio inquiries, creator applications, and affiliate signups.

2.5. Usage and technical data. Standard technical data such as your IP address, browser/device information, and log-in timestamps, collected for security, fraud-prevention, and service-operation purposes. Server logs are retained for 30 days.

2.6. We do not knowingly collect more data than is necessary to provide the Service, process payment, provide support, and meet our legal obligations.

3. How We Use Your Information

We use the information described above to: (a) create and manage your account; (b) provision, operate, and bill for the Service; (c) provide customer support, including AI-assisted support features (Section 5); (d) detect and prevent fraud, abuse, and security incidents; (e) communicate with you about your account, billing, service changes, and (where you have not opted out and where permitted by law) product updates; and (f) comply with our legal obligations.

We do not use your personal information to send marketing emails unless you have explicitly opted in. We do not sell your personal information to third parties.

4. Sensitive Data Protections

4.1. Certain fields we consider especially sensitive - including payment-related identifiers, credit/balance figures, and secret-valued server settings (e.g., API keys or passwords embedded in a game's configuration) - are protected with field-level encryption at rest, in addition to standard database access controls.

4.2. Secret-valued fields are masked (shown redacted, e.g., as asterisks) in our own administrative and support interfaces by default; a human support agent does not see your secret values in plaintext during ordinary support interactions.

5. AI-Assisted Features

5.1. If you use our AI-assisted support chatbot or accept an AI-suggested help article, your question/request is processed to generate a response. A response an AI system drafts as a direct reply to you from our support team is always reviewed by a human staff member before being sent - no AI-generated message reaches you as an official support response without that human review step.

5.2. Content from resolved support tickets may be used, after a redaction process that removes personally identifying and sensitive information, to build and improve a knowledge base and support-assistant corpus. This redacted, de-identified corpus is kept structurally separate from any corpus a customer-facing assistant can access versus one only our own support staff can access, so that information intended only for internal use is not exposed to a customer-facing AI feature. Only knowledge that a member of our staff has reviewed and approved is reused.

5.3. When you ask us for help, or when our support staff investigate a problem with one of your servers, a staff member may ask an AI model to explain a redacted digest of that server's health data, logs, and events. Before anything is sent, addresses (including IP addresses), secrets such as passwords and keys, email addresses, and the names of people (yours, your players' and our staff's) are removed, and the request is stopped if an address, email address, or secret is still found in it. The explanation is for our support staff; it does not reach you as a support response without the human review described in Section 5.1.

5.4. We keep a copy of each redacted request we send to the AI model for 14 days, so our staff can check the quality of its answers; then it is deleted. Our AI model provider, OpenAI, does not use data sent through its API to train its models. OpenAI keeps that data for up to 30 days to monitor for abuse (longer only where the law requires it), unless zero data retention applies to our account; we have requested zero data retention from OpenAI.

6. Who We Share Information With

We share information only as follows:

  • Stripe (our payment processor) - to process payments, manage subscriptions, and handle refunds/disputes. See Stripe's Privacy Policy.
  • Keycloak (our identity provider) - operated as part of our own infrastructure, not a data-sharing arrangement with an independent third party. Manages your login/authentication.
  • Wasabi (our backup storage provider) - stores automated and manual server backups, and the saves in your Vault, in S3-compatible cloud storage in its US Central region (United States). Each Vault save is encrypted before it is sent to Wasabi.
  • Resend (our email delivery provider) - sends the account, billing, server, and support emails we send you. It receives your email address, your name where we have it, and the content of each email.
  • OpenAI (our AI model provider) - processes the content of support requests and tickets, questions to our AI-assisted support chatbot, and redacted digests of server logs, health data, and events, to generate suggested help articles, draft replies, and diagnostic answers (Section 5).
  • Discord - only if you connect a Discord server or add a Discord webhook to your game server. We send the server events, chat messages, and command results you choose to that Discord server.
  • Nexus Mods, CurseForge, Modrinth, Thunderstore, and Hangar (PaperMC) (mod marketplaces) - when you search for, install, or update mods, we query these services with the game, mod identifiers, and search terms. We do not send them your account information.
  • Steam/SteamCMD - used for game server file distribution and mod installation, including Steam Workshop content.
  • YouTube (Google) - only if you take part in our content creator program. We look up public statistics for the videos you submit.
  • Law enforcement or regulators - only where required by valid legal process, or where necessary to protect the rights, property, or safety of GameGrid, our customers, or the public.

We do not share your Service data (server configuration, save files, uploaded content) with any third party except as necessary to provide the Service (e.g., our infrastructure/hosting providers) or as described above.

7. Data Retention

7.1. We retain your account and Service data for as long as your account is active. If you cancel or your subscription lapses, your server data is retained for a 30-day grace period before permanent deletion, unless you request earlier deletion.

7.2. We retain certain records (such as billing/transaction history) for longer than the general retention window where required for legal, tax, fraud-prevention, or accounting purposes. Server logs are retained for 30 days then automatically purged. Support tickets are retained for 2 years for reference and quality assurance.

7.3. The redacted requests we send to our AI model provider (Section 5.4) are kept for 14 days, then automatically deleted.

7.4. Vault saves are kept for 12 months from the day each one was saved and are then deleted automatically; loading or downloading a save does not extend that period. We email the account 30 days and 7 days before a save is deleted this way; when a save is deleted this way or by GameGrid support, a notice appears on your account page. A save you delete, or that GameGrid support deletes at your request, is deleted at once together with the key that protects it, and cannot be recovered by anyone. A save attempt that fails is removed, and its record is deleted after 30 days. Your Vault is not deleted when a server is deleted or a plan ends, so the grace period in Section 7.1 does not apply to it; when you ask us to delete your account and its data (Section 8.1), your saves are deleted too. After a save is deleted we keep a short record of it (its name, size, and when, why and by whom it was deleted), never its contents, in the account's history and our audit log.

8. Your Rights and Choices

8.1. You may access and update your account information at any time in your account settings. To have your account and its data deleted, email us at admins@wdcgamegrid.com or open a support ticket from your account; we confirm the request with you and then carry it out, apart from the records we must keep under Section 7.2.

8.2. Depending on your jurisdiction, you may have additional rights (e.g., the right to data portability, the right to object to certain processing, or rights under the EU/UK GDPR or California's CCPA/CPRA). To exercise any of these rights, contact us at admins@wdcgamegrid.com.

9. Security

We use industry-standard technical and organizational measures to protect your information, including:

  • Field-level encryption at rest for credentials we store for you, including secret-valued server settings (such as admin or RCON passwords) and webhook signing secrets
  • HTTPS/TLS encryption for all web traffic
  • Role-based access controls on all administrative functions
  • Audit logging of access to sensitive administrative functions, including a tamper-evident audit trail for actions taken on your account by our staff (such as an approved support-impersonation session)
  • Encryption of every Vault save with its own key before it is stored. In your account, only the owner and administrators can download, load or delete a save; other users of your account can see the list of saves. GameGrid staff can see the list of your saves (names, sizes and dates) in our administration panel, reach their contents only through a recorded support session, and change your Vault (such as its size or a deletion you asked for) only with a reason recorded in our audit log
  • Passwords hashed by Keycloak using industry-standard algorithms
  • Payment data handled exclusively by Stripe (PCI-DSS compliant)

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children's Privacy

The Service is not directed to children under 13 (or the relevant minimum age in your jurisdiction), and we do not knowingly collect personal information from children under that age without appropriate parental consent. If we learn we have collected such information without appropriate consent, we will take steps to delete it.

11. International Users

GameGrid is operated from the United States. If you access the Service from outside the US, your information may be transferred to and processed in the United States. By using the Service, you consent to such transfer.

12. Cookies

Our use of cookies is described in our Cookie Policy. We use essential cookies, and a first-party referral cookie that is set only when you follow a content creator's referral link. We do not use advertising cookies or third-party tracking cookies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email of any material change, and continued use of paid services after a material change requires your acceptance of the updated policy.

14. Contact

Questions about this Privacy Policy, or requests regarding your personal information, may be directed to:

*Last updated: October 2026*