← Back to MoonHost

Privacy Policy

This Privacy Policy explains what information MoonHost (“we”, “us”) collects when you use our service, why we collect it, and what we do with it. We aim to keep this short and readable.

1. What we collect

Account information

  • Email address — used for sign-in and service notifications.
  • Optional profile fields — name, pronouns, country (only if you choose to provide them).
  • Authentication details — managed by Amazon Cognito; we never store your password.

Server data

  • Server names, plans, and metadata — what you create.
  • World files, plugins, configs, uploads — stored on encrypted EBS volumes attached to your server.
  • Backups — kept for 7 days in encrypted S3 storage.

Usage data

  • Connection logs (when servers start, stop, get used).
  • API call logs (CloudWatch). Used for debugging, security, and operational monitoring.
  • IP addresses for sign-in events (security).

Payment data

  • The service is free during open beta — there’s no payment data to collect today.
  • If paid plans are introduced later, payments will be processed by Stripe; we will never see your card number, and Stripe’s privacy policy will apply: stripe.com/privacy.

What we don’t collect

  • We don’t run analytics trackers, advertising pixels, or third-party tracking.
  • We don’t sell your data to anyone, ever.
  • We don’t read the contents of your server files except where required for operations or abuse investigation.

2. Why we collect it

  • To provide the service: spin up your servers, store your worlds, deliver backups.
  • To keep things safe: detect abuse, investigate security incidents, fix bugs.
  • To communicate: account notifications, important service changes. You opt in to marketing emails separately on the Account page.

3. Where data lives

MoonHost runs on AWS infrastructure in the us-east-1region (Virginia, USA). Your data is processed and stored there. By using MoonHost, you consent to this transfer if you’re outside the US.

Subprocessors we rely on:

  • Amazon Web Services — compute, storage, identity (Cognito), serverless (Lambda).
  • Porkbun — DNS management.
  • Modrinth — plugin downloads (your IP is shared when you install a plugin from their CDN).

4. How long we keep it

  • Account data: until you delete your account.
  • Server data: until you delete the server. Deletion is final.
  • Backups: 7 days, then auto-deleted.
  • CloudWatch logs: 7–14 days, depending on the source.

5. Your rights

You can:

  • See your account data on the Account page.
  • Update or correct it from the same page.
  • Delete your account, which removes everything we hold about you (within the retention window).
  • Export a backup of any server at any time.
  • Email support@moonhost.pro for any request not covered above.

If you’re in the EU/UK (GDPR), California (CCPA), or another jurisdiction with specific privacy rights, we honor those rights. Contact us with questions.

6. Children

MoonHost is not directed at children under 13 (or the minimum age in your jurisdiction). We don’t knowingly collect personal information from children. If you believe a child has signed up, email us and we’ll delete the account.

7. Security

  • HTTPS / TLS for all traffic between your browser and our service.
  • Encrypted at rest: your server data, backups, and credentials.
  • Authentication via AWS Cognito with industry-standard JWT.
  • Rate limits and security headers (HSTS, CSP, X-Frame-Options).
  • No system is perfectly secure. If a breach affects you, we’ll notify you within 72 hours of confirmed discovery.

8. Cookies and local storage

MoonHost stores your sign-in tokens in browser localStorage (not cookies). We do not set tracking, advertising, or analytics cookies.

We do set two cookies for legitimate operational reasons:

  • Cognito session cookie — scoped to auth.moonhost.pro, set by AWS Cognito’s hosted sign-in pages and required for the OAuth flow.
  • moonhost.lang — remembers your chosen language across visits. First-party, 1-year expiry, set with the SameSite=Lax and Secure attributes.

9. Changes

We may update this policy. If a change is material, we’ll notify you by email or in-app notice before it takes effect.

10. Contact

Questions, requests, or complaints? Email support@moonhost.pro.

Plain-English note:This is templated industry boilerplate and not a substitute for jurisdiction-specific legal advice. We’re working with counsel to refine it; this version is what we currently operate under.