Skip to content

Privacy Policy

Last updated: April 2026

This Privacy Policy describes how NovaStack, operated by 24 Hour Gaming ("24HG", "we", "us", or "our"), collects, uses, and protects your personal information when you use our game server hosting platform and related services ("Service"). We are committed to protecting your privacy and handling your data transparently.

1. Information We Collect

Account Information: NovaStack accounts are created and authenticated through 24HG Accounts using single sign-on (SSO). We do not collect or store your password; your login credentials are managed entirely by 24HG Accounts. When you sign in, we receive your email address and username from your linked 24HG Hub profile.

Payment Information: When you make a purchase, payment is processed by our payment providers, Stripe or PayPal. We do not store your full credit card number, CVV, or other sensitive payment card details on our servers. These providers may share with us limited information such as the last four digits of your card, card type, expiration date, and billing address for record-keeping and fraud prevention purposes.

Server Usage Data: We collect data related to your use of the Service, including server resource usage (CPU, RAM, disk, bandwidth), server start/stop events, console access logs, file management activity, and backup history. This data is used to provide the Service and monitor for abuse.

Technical Data: We automatically collect certain technical information when you access the Service, including your IP address, browser type and version, operating system, referring URL, pages visited, and timestamps. This information is used for security purposes, abuse prevention, and to improve the Service.

Communications: If you contact us via support tickets, email, or Discord, we retain the content of those communications along with your contact details to provide support and maintain records.

2. How We Use Information

We use the information we collect for the following purposes:

  • Providing, operating, and maintaining the Service
  • Processing payments and managing your account balance
  • Sending transactional emails (account verification, payment receipts, server alerts)
  • Preventing fraud, abuse, and violations of our Terms of Service
  • Providing customer support and responding to your inquiries
  • Monitoring and improving the performance, security, and reliability of the Service
  • Complying with legal obligations

We do not sell, rent, or trade your personal information to third parties. We do not use your data for advertising or marketing profiling purposes.

3. Data Storage and Security

Our infrastructure is located in Frankfurt, Germany. All data, including your account information, server data, and backups, is stored on servers within this location.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

  • Encryption of data in transit using TLS/SSL
  • Two-factor authentication recovery codes hashed with bcrypt
  • Encrypted backups using AES-256-GCM
  • Access controls and authentication for all administrative systems
  • Regular security updates and monitoring

While we take reasonable precautions to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your information.

4. Third-Party Services

We use the following third-party services that may process your data:

  • Stripe — Payment processing. Stripe collects and processes your payment information in accordance with their own privacy policy (stripe.com/privacy).
  • PayPal — Alternative payment processing. If you choose to pay with PayPal, PayPal collects and processes your payment information in accordance with their own privacy policy (paypal.com/privacy).
  • Pterodactyl Panel — Open-source server management panel used as the backend for server administration. This runs on our own infrastructure and data does not leave our servers.
  • Cloudflare — DDoS protection and content delivery. Cloudflare may process your IP address and request metadata in accordance with their privacy policy.
  • Discord— Community communication and optional account integration. If you link your Discord account, we store your Discord user ID to enable integration features. Discord's own privacy policy governs their processing of your data.

We do not use any third-party analytics trackers or advertising networks on the NovaStack platform.

5. Cookies and Tracking

We use only essential cookies that are strictly necessary for the operation of the Service. These include:

  • Session cookies: Used to maintain your authenticated session while you are logged in. These expire when you log out or after a period of inactivity.
  • Security cookies: Used for CSRF protection and other security measures.

We do not use tracking cookies, third-party analytics cookies, or any form of cross-site tracking. We do not participate in advertising networks or serve targeted advertisements.

6. Data Retention

We retain your data according to the following schedule:

  • Account data: Retained for as long as your account is active. Upon account deletion, your personal data is purged after a 30-day grace period to allow for account recovery.
  • Server data: Retained while your servers are active. After server deletion or account termination, server data is deleted within 7 days.
  • Backups:Backups you create (on-demand from the Backups panel or via a scheduled task) are stored until you delete them or the associated server is removed; older backups may be rotated out once your server's backup limit is reached.
  • Audit and security logs: Retained for 90 days for security and abuse prevention purposes.
  • Payment records: Retained as required by applicable tax and financial regulations (typically 7-10 years).
  • Support communications: Retained for 2 years after your last interaction, or until account deletion, whichever is sooner.

7. Your Rights (GDPR)

As our infrastructure is located in Germany and we serve users in the European Union, we comply with the General Data Protection Regulation (GDPR). Regardless of your location, we extend the following rights to all users:

  • Right of Access: You may request a copy of the personal data we hold about you.
  • Right to Rectification: You may request correction of inaccurate personal data. You can also update most information directly through your dashboard.
  • Right to Erasure: You may request deletion of your personal data. You can initiate account deletion from your dashboard settings.
  • Right to Data Portability: You may request an export of your data in a machine-readable format.
  • Right to Restriction: You may request that we restrict processing of your personal data under certain circumstances.
  • Right to Object: You may object to the processing of your personal data where we rely on legitimate interest as the legal basis.
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time.

To exercise any of these rights, contact us at privacy@novastack.org or use the relevant options in your dashboard Account settings. We will respond to your request within 30 days as required by GDPR.

You also have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated. The relevant authority for Germany is the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI).

8. Children's Privacy

The Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child under 13 has provided personal information to us, please contact us at privacy@novastack.org and we will take steps to delete such information promptly.

Users between 13 and 18 years of age must have the consent of a parent or legal guardian to use the Service, as outlined in our Terms of Service.

9. International Data Transfers

Our servers and data are located in Frankfurt, Germany, within the European Economic Area (EEA). If you access the Service from outside the EEA, please be aware that your data will be transferred to and processed in Germany. By using the Service, you consent to this transfer. We ensure that all data processing complies with GDPR requirements.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on this page with a new "Last updated" date and, where appropriate, by sending you an email notification.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data. Your continued use of the Service after changes are posted constitutes acceptance of the updated Privacy Policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

  • Privacy inquiries: privacy@novastack.org
  • General support: support@novastack.org
  • Support tickets: Available through your NovaStack dashboard
  • Discord: discord.gg/ymfEjH6EJN