Privacy Policy

This Privacy Policy explains how PacketGrid, operating from Auckland, New Zealand (“PacketGrid”, “we”, “us” or “our”) collects, holds, uses and discloses personal information in connection with the packetgrid.xyz website and dashboard and the hosting services made available through them (together, the “Service”). It is written to comply with the New Zealand Privacy Act 2020, including the Information Privacy Principles (“IPPs”) set out in that Act, which govern how we may collect, hold, use, disclose and secure personal information, and it applies to every visitor to and customer of the Service, regardless of where you access it from.

This Policy should be read together with our Terms of Service. Terms defined in the Terms of Service have the same meaning here unless stated otherwise.

We collect the following categories of personal information:

Account information. When you register, your email address, and your name and a profile picture if you choose to provide them. Account passwords are submitted over an encrypted connection and hashed for storage — see section 8.

Sign-in information. If you register or sign in with Google, GitHub or Discord, that provider's account identifier for you and the verified email address it discloses to us. We do not receive your password with any of those providers, and we do not post to, or otherwise act on, your account with them.

Payment information. When you order a paid plan, the plan and price you ordered, and the outcome of the payment. Your card or bank details are entered directly into Stripe's or PayPal's own systems and never reach PacketGrid's servers; we store only the customer or subscription reference those providers give us, and the resulting invoice record (amount, currency, date and status).

Service and usage information. The servers and bots on your account, their names, configuration and environment settings, the files you upload to them, and a record of administrative actions taken on your account or servers (by you or by our staff), so that any change can be traced to who made it. For servers on a resource-limited plan, we also record aggregate resource usage (CPU, memory, network transfer) necessary to enforce the limits described in the Terms.

Fraud and abuse prevention information. For free plans and trials only, a one-way cryptographic hash of the network (IP) address a request came from. This lets us detect that the same network has already claimed a free plan or trial; it cannot be reversed back into an address, and we do not otherwise log or retain IP addresses in identifiable form for this purpose.

Communications. Any email you send us, for example to support@packetgrid.xyz, and our reply.

Technical information. Standard web server logs (such as the network (IP) address a request came from, request timestamps and error codes) generated in the ordinary course of operating the Service, retained only as long as reasonably necessary for security and diagnostic purposes. This is separate from, and retained for a much shorter period than, the one-way hashed IP address described below under Fraud and abuse prevention information.

We set two cookies of our own, both strictly necessary for the Service to function: one that keeps you signed in, and a short-lived one used only during sign-in with Google, GitHub or Discord to verify the round trip returned to the same browser. Neither is used for tracking, profiling, or advertising, and neither is shared with any third party for those purposes.

On desktop, you can choose to load banner advertisements on the home page. When you allow them, your browser connects to the banner provider at bauval.org and its advertising partners, which may receive your network address and browser information and use cookies for delivery or measurement. Your choice is stored in your browser. Choose “Essential only” in Cookie settings to turn the banners off. They are not loaded on mobile or for signed-in customers with a paid server.

When rewarded video is enabled for free Discord bots, choosing “Watch video” loads ayeT-Studios and its advertising partners. They receive browser and network details and may use cookies for ad delivery and measurement. PacketGrid supplies an opaque account identifier, server reference and single-use watch reference, not your email or password. We verify a signed completion receipt and retain watch records for up to 30 days after their expiry to prevent duplicate rewards. No video advertising SDK is loaded before you choose to watch. Additional regional consent may be requested by the advertising provider's consent platform.

When enabled, Cloudflare Turnstile checks your browser before a paid-plan server starts. Cloudflare receives technical browser and network information for abuse prevention. This is not an advertising check. PacketGrid verifies the resulting single-use token on its server.

Separately, our live-chat widget is provided by Tawk.to (section 6). It is off until you allow it in the cookie notice, and you can change your answer at any time with “Cookie settings” in the footer of any page. Nothing of it loads, and none of its cookies is set, before you do. Once allowed, it loads on our pages and sets its own cookies in your browser to run the chat and remember your conversation. While you are on the site, Tawk.to can show our staff basic technical details such as the page you are on, your browser and your approximate location. We use this only to answer your questions, not for advertising or profiling.

The files on your server are yours. We do not read, scan or analyse them other than as described in section 4, and we do not build a profile of you from your activity on or off the Service.

Your server's console output is relayed live through PacketGrid between your browser and the node running your server, and is not stored in PacketGrid's own database or logged by us. We do not keep a history of what a server printed to its console.

When you submit an abuse, security or privacy report, we receive the contact details you provide, the reported locations or service identifiers, your explanation and relevant evidence, and a report reference. We use this information to investigate, communicate a decision, protect people and the service, and meet legal obligations. The form does not require an account and does not accept attachments. Child-safety reports can be anonymous.

We collect and use personal information only for the following purposes:

• to create and administer your account, and to provide the Service you have ordered;
• to process payments and maintain the billing and tax records the law requires us to keep;
• to communicate with you about your account, your servers, and changes to the Service or these policies;
• to detect, investigate and prevent fraud, abuse of free plans, and breaches of the Terms' Acceptable Use Policy;
• to maintain the security, stability and performance of the Service; and
• to comply with our legal obligations, including tax, accounting and any lawful request from a regulator or law enforcement body.

Staff access to the contents of your server is limited to when you ask for support, when reasonably necessary to diagnose or resolve a fault affecting the Service, or when we reasonably believe access is necessary to investigate a suspected breach of the Terms or a legal obligation. Access under this paragraph is recorded in that server's own activity log, visible to you.

We send marketing email only if you have switched it on in your account settings, and you may switch it off at any time; this does not affect service emails (such as billing, security or free-plan notices) that are necessary to operate your account.

We collect and use personal information because it is reasonably necessary for the lawful purposes set out in section 4: to perform our contract with you (providing the Service you ordered), to comply with a legal obligation we are subject to (such as tax record-keeping), or for our legitimate interests in operating a secure service and preventing abuse of free plans, balanced against your own privacy interests. Where we rely on your consent, such as for marketing email, you may withdraw that consent at any time as described in section 4.

We disclose personal information to the following categories of recipient, and no others:

• Stripe and PayPal, to process payments for paid plans;
• ayeT-Studios and its advertising partners, only when you choose a rewarded video on a free Discord bot;
• Adsterra and its advertising partners, and AntiAdBlock Core, when you allow banner advertising. Advertising protection runs inside the advertising frame rather than the account or report page.
• Cloudflare, when a Turnstile browser-verification check is enabled;
• Google, GitHub and Discord, where you choose to sign in with one of them;
• Tawk.to, which provides our live-chat widget: when you use the chat, it receives the messages and details you enter, and it receives technical information from your browser while the widget is loaded (section 3);
• our email delivery provider, to send you the account, billing and service email described in this Policy;
• Modrinth, when you search for or install a mod or plugin through the Service — only the search or install request itself, containing nothing that identifies you personally;
• GitHub, when you install a real framework (such as vMenu, QBCore or QBox) through the Service — only a request for that project's own public release, containing nothing that identifies you personally;
• a professional adviser (such as our accountant or lawyer) bound by confidentiality obligations, where reasonably necessary; and
• a regulator, court, or law enforcement body, where we are legally required to, or where we reasonably believe disclosure is necessary to prevent harm to a person or to the Service. Where legally permitted, we will tell you about a disclosure under this paragraph.

We do not sell personal information. If you choose to allow banner advertisements or watch a rewarded video, the advertising providers and their partners may use the information described above for advertising and measurement.

Servers, their files, and the PacketGrid database are hosted on infrastructure located in Auckland, New Zealand. Some of the third parties listed in section 6 process personal information outside New Zealand as a necessary part of providing their service to us: Stripe and PayPal process your payment and billing details (section 2) on infrastructure located outside New Zealand, and Google, GitHub and Discord process your sign-in identifier and verified email address (section 2) on infrastructure they control, which may be located outside New Zealand. Tawk.to likewise processes live-chat messages and the related browser information on infrastructure that may be outside New Zealand.

Information Privacy Principle 12 of the Privacy Act 2020 restricts disclosing personal information to a person or organisation outside New Zealand unless comparable safeguards apply. Before we rely on a provider under this section, we satisfy ourselves that it is subject to a comparable data protection framework, is a certified participant of an approved binding scheme, or is otherwise required to protect the information to a standard comparable to the Privacy Act 2020, and we only disclose the minimum information that provider needs to perform its function for us.

Account passwords are stored as strong, industry-standard hashes. Service credentials we need to use on your behalf, such as mailbox credentials and stored API keys, are encrypted at rest. Access to the infrastructure running the Service is limited to staff who need it to do their job, and administrative actions are logged. We use industry-standard transport encryption for data in transit to and from the Service.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach occurs that is likely to cause serious harm, we will notify affected individuals and the Privacy Commissioner as required by the Privacy Act 2020, without undue delay.

• Account information: for as long as the account is open, and for 90 days afterwards.
• Server files: until the server is deleted, whether by you or under the Terms. When a free plan, trial or 2 Week Phase ends, its files are kept for 90 days after it ended so you can export them, then deleted.
• Invoices and payment records: 7 years, to meet New Zealand tax record-keeping requirements.
• Administrative action records: 2 years.
• Free-tier fraud-prevention hashes (section 2): 30 days.
• Support correspondence: for as long as reasonably necessary to resolve the matter and for a reasonable period afterwards for quality and dispute-resolution purposes.

Where we are required by law to keep a record for longer than these periods, or need to retain it to establish, exercise or defend a legal claim, we will keep it for that longer period.

Under the Privacy Act 2020, you have the right to ask us for a copy of the personal information we hold about you, and to ask us to correct it if it is wrong. You may also ask us to delete personal information we hold about you, and we will do so unless we have a lawful reason to keep it (for example, a tax record we are legally required to retain). You can also download a copy of your information, or close your account once your servers are deleted, yourself at any time from Account Settings. To exercise any of these rights, email privacy@packetgrid.xyz. We will respond within 20 working days, as the Act requires, and will tell you if we need longer or are unable to action your request and why.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.

The Service is not directed at children, and we do not knowingly collect personal information from a child without the consent described in section 2 of the Terms of Service. If you believe a child has provided us with personal information without that consent, contact privacy@packetgrid.xyz and we will investigate and delete it where appropriate.

We may update this Privacy Policy from time to time, for example to reflect a new feature that collects a new category of information. Where a change is material, we will notify you by email at least 14 days before it takes effect. The “Last updated” date at the top of this page always reflects the current version.

Use Report abuse for content notices, network abuse, vulnerabilities and privacy incidents. Authorised staff handle reports in our mail system. Reports are retained only while necessary for investigation, enforcement, legal claims or a statutory requirement, then deleted or redacted. Where necessary to investigate or comply with law, we may share the relevant allegations with an affected service operator; we do not routinely disclose the reporter’s identity.

Where GDPR applies, we facilitate the applicable rights of access, correction, erasure, restriction, objection and portability, subject to legal exceptions. We respond without undue delay and generally within one month. A permitted extension of up to two further months is explained within the first month. You may complain to the competent supervisory authority. We assess requests concerning data controlled by a customer with that controller, as applicable.

Questions about this Policy, or a request under section 10, can be sent to privacy@packetgrid.xyz. For anything else, including support, email support@packetgrid.xyz.