1. What we collect

When you sign in. Your name, email address, profile picture and Google account ID, sent to us by Google. We do not get your Google password.

When you buy a server. The plan you chose, the name and settings you gave your server, the price, and the order and subscription details Stripe sends us, including your billing email. Your card details go straight to Stripe and never reach us.

When you run a server. Everything on it: your world, mods, plugins, settings and anything you upload or import. We also keep an activity log of actions taken in Luna Panel (for example who started, stopped or changed a server, and when), and the email addresses of people you invite to help run it.

If you make a profile. Having a profile is optional. If you make one, we store the username, display name and “about you” text you choose, a profile picture if you upload one (we shrink it and remove hidden details such as where a photo was taken), which of your servers you chose to show, your friends, friend requests you send and receive, server invites you send to friends, and anyone you block.

If you are a LunaLink partner and link your account with the bot’s /linklunahost command, we store which Discord account and partner server it was linked from.

When you visit the site. Like every web server, ours records each request, including your IP address and browser type. These logs are kept for about seven days to keep the site secure and are then deleted.

2. Your players

If you run a server, the people who join it are your players, not our customers. Minecraft records their usernames, player IDs, chat and commands in your server’s logs. If you turned on “see players’ real IP addresses”, their IP addresses are logged too. You and anyone you have given access to can see these. Please let your players know what your server records and use it responsibly.

3. Cookies

We use one cookie of our own, to keep you signed in. There are no analytics, advertising or tracking cookies on this site. When you pay, Stripe’s payment form may set its own cookies to prevent fraud.

4. Who can see it

We (the operator, and anyone helping run LunaHost) can see your account, orders and servers, so we can support you and keep things running. People you add to a server can see that server, as far as the role you gave them allows.

If you make a profile, anyone with the link to it can see your username, display name, picture, “about you” text and the month you joined. Your servers and their addresses only show if you turn those on. Your email address is never on your profile page; your friends see it only if you turn that on. Profile pages are kept out of search engines, and there is no way to search or list people on LunaHost. Someone you block is not told.

We share information only with the services we need to run LunaHost:

• Google, for signing in;
• Stripe, for taking payments and managing subscriptions;
• Cloudflare, which stores server backups and imported files, in its Oceania region;
• the company that hosts our web server in Sydney.

Google and Stripe may handle your information in other countries, including the United States, under their own privacy policies. We do not sell your information or share it for advertising. We will only give it to anyone else if the law requires us to.

5. Where it is kept, and for how long

Your account and order details are kept on our server in Sydney. Your game server’s files are kept on our machines in Victoria, and its backups with Cloudflare.

• Account details are kept while you have an account with us.
• Your profile and friends list are kept until you delete your profile, which you can do yourself at any time. A profile picture is deleted as soon as you replace or remove it. A friend request you decline is kept for 30 days and then deleted.
• Order and payment records are kept for five years, because Australian tax law requires business records to be kept that long.
• A server’s files are kept for at least 14 days after its subscription ends, then may be deleted. Backups of a deleted server are removed after 14 days.
• Imported files that are never used are deleted within a week.
• Web server logs are deleted after about seven days.

6. Keeping it safe

Sign-in goes through Google, and the site is served over an encrypted connection. Access to our machines and databases is restricted. No system is perfectly secure, but if we ever find that your information has been exposed, we will tell you.

7. Your choices

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete your account and servers. We will delete everything except the records the law requires us to keep. Message us on our Discord server and we will sort it out.

8. Changes and contact

If we change what we collect or who we share it with, we will update this page and the date at the top. For an important change, we will also let customers know before it applies.

Questions? Ask us on our Discord server. See also our Terms of Service.