Privacy Policy

1. Who is responsible

Raxz Ltd, trading as Styx Networks and operating ObolHost, is responsible for the personal data described here. Contact support@obolhost.com with privacy questions or requests.

2. Data we collect

• Account email, username, password hash and security settings. Passwords are not stored in readable form.
• An over-13 confirmation and the versions/time of Terms and Privacy acceptance, with the request IP and a hash of the browser user-agent for an agreement audit trail. We do not request a date of birth.
• If you use social login: the provider name, its stable account ID and verified email/profile information needed to create or link your account. We do not retain OAuth access or refresh tokens.
• Server names, addresses, configuration, worlds, uploaded files, backups and operational history. Game logs and player data may contain player names, UUIDs, chat or connection information.
• Security/operational logs, IP addresses, session cookies, advert claims and resource usage needed to run the service and enforce limits.
• Billing references and entitlement status if you buy upgrades. Payment providers handle payment details; we do not store full card details.

3. Why we use it

Support requests also contain the subject, messages and replies you send, an optional related-server reference, and delivery/status records. These are used to investigate your request, keep a conversation history and notify you or support staff about replies.

We use data to provide your account and hosting contract, authenticate access, deliver purchased benefits, process adverts, operate backups/cloud restores, prevent abuse, investigate errors and meet legal obligations. Optional social login requires your choice to connect the provider. Accepting this Policy acknowledges how data is used; it is not a blanket consent to unrelated marketing or non-essential tracking.

4. Providers and sharing

Our infrastructure currently uses SMLL for the panel, OVH for the game node, Wasabi for cloud storage, Amazon SES in Ireland (eu-west-1) for transactional account and service emails, and Cloudflare for DNS and, where enabled, security/captcha services. Google or Discord receives social-login data only if you choose its login. Google also processes optional public-page analytics as described below. Discord receives operational and support notifications; support alerts include the request subject, account username, optional server name and a link for staff, while message bodies stay in the panel. Configured payment and advert providers receive information needed for those functions. Mod/plugin catalogs and cosmetic asset providers may receive requests required to display or install their content.

We do not sell personal data. Providers process data under their own applicable terms and safeguards. Some processing may take place outside your country, including outside the UK/EEA; appropriate contractual or other lawful safeguards are used where required.

5. Cookies, analytics and adverts

Essential cookies maintain your signed-in session and protect forms against cross-site requests. Optional advert or analytics tracking requires the appropriate notice/choice where applicable. The current test advert is a server-timed placeholder. We do not use the age confirmation as proof of an independently verified age.

With your permission, Google Analytics (GA4) measures visits to public pages such as the homepage and these policies. It can use first-party _ga cookies and collect public page paths, browser/device information and visit events. GA4 scripts do not load before you allow analytics. Analytics is not added to account, authentication, admin or support screens; our page-view events omit URL query strings and fragments. Google Signals and analytics ad personalisation are disabled. Use Cookie preferences on a public page to decline or withdraw permission; your separate analytics and advertising choices are remembered on this browser for up to 180 days.

Advertising is a separate choice. If you allow it, the homepage can load Google AdSense for publisher ca-pub-5059555449637186, with non-personalised ad requests. Google may use advertising cookies such as __gads and __gpi to serve and measure ads, and may display its own privacy messages where configured. The AdSense tag does not load on account, authentication, support or admin pages. You can decline advertising while allowing analytics, or change either choice through Cookie preferences. Withdrawing advertising permission reloads the public page without the advertising tag.

6. Retention and deletion

Account and agreement records are kept while needed for your account and legal/security purposes. Operational platform logs are generally retained for seven days; game files and logs remain with the server until removed or deleted under the service's retention rules. Backup copies may persist until their scheduled rotation or deletion completes. Unused free servers may be deleted after the 60-day warning/90-day inactivity process. Contact us to request account deletion or ask about a particular copy.

7. Your choices and rights

You can manage server files, backups, account details, security settings and social connections in the panel. Depending on applicable law, you may request access, correction, deletion, restriction or portability of personal data, object to certain processing, withdraw optional consent and complain to a relevant data-protection authority. We may need to verify your identity and retain information which we are legally required to keep.

8. Children and updates

The service is for people aged 13 and over. If an account is known to belong to someone under 13, contact us so we can investigate and remove or restrict it appropriately. Material Policy updates receive a new version, with renewed acknowledgement requested in the panel.