Privacy Policy

At GBR Hosting ("we", "us", or "our"), operated under Gbreed in North Carolina, United States, we are dedicated to safeguarding your personal data. This Privacy Policy outlines our collection, storage, and processing practices across our website, control panel, APIs, cloud backup storage, and Discord integrations, in strict compliance with the Discord Developer Terms of Service & Policy and the Children's Online Privacy Protection Act (COPPA).

1. Information We Collect

A. Discord OAuth2 Information

When you log in or authenticate with Discord, we request access to the identify and email scopes. We collect and store:

• Discord User ID: Your permanent snowflake identifier (used to uniquely authenticate and bind your user account).
• Username & Global Display Name: Used to display your identity across the control panel and Squads.
• Email Address: The primary email address registered to your Discord account.
• Verification Status: Verification status flag provided by Discord.

We never request, access, or store your Discord password, private direct messages (DMs), friend lists, or server memberships.

B. Direct Account & Infrastructure Data

• Credentials: For direct email registration, passwords are salted and hashed using one-way BCrypt encryption before storage.
• Payment Identifiers: Billing transactions are handled via PCI-DSS compliant payment gateways (e.g., Stripe). We do not store raw payment card numbers.
• Cloud Backups: Server save files and configs stored securely in off-site S3-compatible cloud storage (DigitalOcean Spaces).
• Game Server Telemetry: In-game player identifiers (Steam IDs, Minecraft UUIDs, usernames) and firstSeen / lastSeen timestamps logged by our node agents.
• System Audit Logs: IP addresses and request headers collected for rate-limiting, DDoS mitigation, and anti-abuse auditing.

2. How We Use Your Information

• To authenticate and manage your GBR Hosting account sessions via secure JWT tokens.
• To provision Docker containers, orchestrate game server lifecycles, and configure network bypass tunnels.
• To dispatch essential transactional emails (activation links, password resets, payment notifications) via Zoho SMTP (admin@gbrhosting.com).
• To safeguard our host nodes, mitigate network attacks, and enforce our Acceptable Use Policy.

3. Data Sharing & Third Parties

We do not sell, rent, or monetize your personal or Discord data. Information is shared only with trusted infrastructure providers critical to delivering our service:

• Discord Inc.: OAuth2 authentication and user profile resolution.
• DigitalOcean Spaces: Encrypted S3 cloud storage for game backups.
• Zoho Corporation: Secure SMTP transactional email delivery.
• Payment Gateways (e.g., Stripe): Payment tokenization and recurring billing.
• Legal Entities: Strictly when mandated by law, court order, or valid legal process.

4. Data Retention & Deletion Schedule

• Active Accounts: User account data is retained for the lifetime of your active account.
• Server Backups Grace Period: Server volumes and S3 cloud backups are retained for a 7-day billing grace period following expiration or cancellation, after which they are permanently and irreversibly destroyed.
• Player Telemetry: In-game player logs are automatically purged after 30 days of server inactivity.
• Security Logs: Network and diagnostic logs are purged within 90 days.

5. User Rights & Data Deletion Requests

You have the right to inspect, modify, or permanently erase your personal data.

You can also immediately revoke GBR Hosting's OAuth access in Discord via User Settings > Authorized Apps > GBR Hosting > Deauthorize.

6. Children's Privacy (COPPA)

Our Services are strictly restricted to individuals aged 13 and older. We do not knowingly collect information from children under 13. Any account discovered to belong to a minor under 13 will be terminated and all associated data purged immediately.

7. Contact Us

For questions or privacy requests, please contact us at admin@gbrhosting.com.