Privacy Policy
version: 2026-09-23. English only.
This policy explains what HostDC stores about you, why, for how long, and what you can ask us to do with it. It is written for the GDPR and the German TDDDG. The controller is the operator of hostdc.xyz, reachable at support@hostdc.xyz.
HostDC is run by a small team. When you write to us, a person on that team reads it.
1. What we store
| Data | Why | Kept |
|---|---|---|
| Email address, password hash | account, login, transactional mail | until you delete the account |
Discord user ID, username, avatar and verified email (OAuth, scopes identify email only) |
login and admin role | until you delete the account or unlink Discord |
| Time of your last visit | the inactivity rule for Free accounts (Terms, section 3) | until you delete the account |
| ZIP archive of your bots' files, made when a Free account has been inactive for 30 days | so you can download or restore your bots; it is stored on the server that ran them | until you restore it or day 60 of inactivity, then it is deleted with the inactive account |
| Public ID, plan, reactivation times, payment records | running the service and matching payments | 2555 days (about 7 years) for payment records (tax law), the rest until deletion |
| Your bot's source code, project files, environment variables and /app data | running your bot | until you delete the bot, then a 30-day hold |
| Console output (ring buffer), build logs, resource metrics | debugging and abuse handling | console: a rolling buffer of the most recent lines; build logs 7 days; metrics 24 hours at 1-minute resolution, then 7 days hourly |
| Ticket messages and attachments | support | until you delete the account |
| IP address and user agent for sessions, sign-ups, logins and rate limits | security and abuse prevention | 30 days, then blanked automatically |
| Pro trial record: a keyed hash of your email address and of the network address the trial started from | allowing one trial per person | email hash: kept, so a trial stays once per address; network hash: 90 days |
We do not sell data and we do not share it except as listed in section 4.
You must be at least 14 years old to use HostDC. By creating an account, with email or with Discord, you confirm that you are at least 14.
2. Cookies, consent and analytics
Before you choose anything, the site only stores what it needs to work. These are strictly necessary, so they need no consent (§25(2) no. 2 TDDDG):
| Cookie | What it does | Kept |
|---|---|---|
| Session | keeps you logged in | until you log out, at most 14 days |
| CSRF token | protects forms against cross-site requests | 14 days |
| Two-factor step | remembers, between password and code, that the password was right | 15 minutes |
| Remember this device | skips the two-factor code on a device you trust, only if you tick it | 30 days |
| Discord login state | protects the Discord login against forgery, only while you log in with Discord | 10 minutes |
hostdc_consent |
your choice on ads and statistics, with the version of this banner and the time you chose | 12 months |
We ask again after 12 months, or sooner when what we ask about changes (for example when we added Google Analytics).
Security check. On sign-in, registration and the report form, Cloudflare Turnstile checks that you are a person. Its script comes from Cloudflare and receives your IP address and browser signals. We count it as necessary for security (§25(2) no. 2 TDDDG; Art. 6(1)(f) GDPR: keeping automated sign-ups, password guessing and report spam out).
Analytics is self-hosted Umami on our own server. It sets no cookie, stores nothing on your device, keeps no personal data and builds no profile across sites, so it runs without a consent request.
Ads, only with your consent. On the first visit a banner asks. Accept and Reject are equally easy, and Settings lets you choose per category:
- If you accept advertising, the Google AdSense script loads from Google's servers. Google then stores and reads cookies and similar identifiers on your device and uses them to show ads, which can be personalised, to measure them and to prevent fraud. Legal basis: your consent under §25(1) TDDDG and Art. 6(1)(a) GDPR. Google Ireland Limited is its own controller for this data; its privacy policy applies (policies.google.com/privacy).
- If you reject, or do not choose, no AdSense loads. You see only our own ads, which carry no tracking. If an ad image is hosted on another site, your browser fetches it from there, and that site sees your IP address like any web server does.
- Before any Google script runs, the page tells Google that all ad and analytics storage is denied (Google Consent Mode). Only an Accept switches the ad and analytics signals to granted.
Statistics with Google Analytics. We use Google Analytics 4, provided by Google Ireland Limited, to count how the site is used (pages opened, rough region, device and browser type) so we can improve it. It runs in Google Consent Mode and loads on every page of the public site and your account, so Google receives a request from your browser each time (including your IP address, which GA4 does not store). What it may store depends on your choice:
- Without your consent (you rejected, or have not chosen), Consent Mode keeps all storage denied: Google Analytics sets no cookie and reads none, and only sends cookieless pings that Google uses for statistics and modelling.
- If you accept, Google Analytics sets the cookies
_gaand_ga_<ID>on this domain, which last up to 2 years, to recognise your browser across visits. Legal basis for these cookies: your consent under §25(1) TDDDG and Art. 6(1)(a) GDPR. The cookieless pings rest on our legitimate interest in knowing how the site is used (Art. 6(1)(f) GDPR). You can stop them by blocking the script in your browser. - We turned off Google signals and ad personalisation for it, and keep the statistics for 14 months.
- Google can process this data in the USA. Google is certified under the EU-US Data Privacy Framework (see section 4).
- Google Analytics is never loaded on the admin area or the sign-in and registration pages.
Withdraw at any time. The Privacy settings link in the footer
of every page opens the choice again. A withdrawal takes effect from the next page you
open: AdSense no longer loads, Google Analytics falls back to cookieless counting, and we
expire the cookies they set on our domain (including _ga and _ga_<ID>).
Cookies Google set on its own domains you can delete in your browser settings. A
withdrawal does not make the processing before it unlawful (Art. 7(3) GDPR).
We may switch to asking through Google's own consent message, which Google certifies for the EU. Then Google's script loads with the page so that it can show that message, but it only stores or reads identifiers for ads after you agree there. The footer link then opens Google's message, where you can change or withdraw your choice.
Ads never appear in the editor, the console or the authentication pages. Google ads are never shown to an account on Lite or Pro or in a Pro trial.
Sponsored ads (pictures from sponsors, and our own "Advertise here" card) are shown on every plan and load from our own server, without cookies or tracking. We count how often each one is seen and clicked, as plain totals per day. To count a visitor only once, we use the network address for up to 30 minutes and do not store it with the totals.
3. Staff access to your code and data
Staff may inspect hosted code, project files, /app contents, console output and
tickets when investigating an abuse report or when you ask for support. Every such view is
written to an audit log with the administrator, the account, the bot and the path.
HostDC never displays environment variable values. Administrators see key names only,
and we store secrets AES-256-GCM encrypted.
4. Who else sees your data
We name recipients by category where they work for us, and by name where they decide for themselves what happens to the data:
- Hosting providers in the EU that operate our servers for us. Your bots, their files, your account and our backups are stored on these servers in the EU. They act as our processors under Art. 28 GDPR.
- Email. We send transactional mail from our own mail server at those hosting providers. Your mail provider receives what we send you.
- Discord, when you log in with OAuth and when your bot connects to Discord.
- Stripe, for card payments. Stripe is the controller of the payment itself; your card details go to them, never to us.
- Cloudflare, as the DNS provider for hostdc.xyz and for the Turnstile security check described in section 2.
- Google, for AdSense and Google Analytics, only after you accept (section 2).
Nothing else. We do not sell data.
Transfers outside the EU. Stripe, Cloudflare and Google are US companies or have US parent companies, so data can reach the USA. All three are certified under the EU-US Data Privacy Framework, for which the European Commission found an adequate level of protection (Art. 45 GDPR, decision of 10 July 2023). Where a transfer is not covered by that, they use the EU standard contractual clauses (Art. 46 GDPR).
5. Why we may process it
- To run the account and host your bots, as the contract with you (Art. 6(1)(b) GDPR).
- Payment records, because tax law requires them (Art. 6(1)(c) GDPR).
- IP addresses, logs, the security check and abuse handling, for our legitimate interest in a secure service that is not misused (Art. 6(1)(f) GDPR).
- Ads from Google, only with your consent (Art. 6(1)(a) GDPR, §25(1) TDDDG).
- Reports of illegal content and our statements of reasons, because the Digital Services Act requires them (Art. 6(1)(c) GDPR with Art. 16 and 17 DSA).
6. Reports of illegal content (DSA)
Anyone can report a bot or account that they believe hosts or spreads illegal content, at /report, without an account. We store what you send: the content you point at, your explanation, and your name and email address. Name and email are optional only for reports of child sexual abuse material. We use them to confirm receipt, to tell you our decision, and to document how we handled the report. We do not tell the person you reported who you are, unless the law obliges us, for example towards an authority. Reports are kept with their support ticket; ask us to delete your contact details once the case is closed.
When we stop or flag a bot, or suspend or ban an account, the person affected gets a statement of reasons: what we restricted, why, whether it was automated, and how to object.
7. Your rights
- Access, rectification, erasure, restriction, objection, and data portability.
- Withdraw your consent to ads at any time, through Privacy settings in the footer (section 2).
- Export: Account → Export produces a machine-readable archive of your account, bots, project files and tickets. 1 export per day.
- Deletion: Account → Delete removes your account. Source code is kept for a 30-day hold (Terms section 3), then deleted. Payment records are kept as long as tax law requires. An inactive Free account is deleted by the schedule in Terms section 3, together with its archive.
- Complaints: your local data protection authority.
8. Mail
Transactional mail (verification, password reset, two-factor codes, reactivation reminders, deletion notices, ticket replies, abuse notices, export ready) is sent regardless of any marketing preference, because it is required to operate your account. Marketing mail carries an unsubscribe link and is opt-out at any time.
9. Security
Bots run in their own sandbox with RAM, CPU and process limits. Raw sockets are not allowed. The sandbox (gVisor) drops capabilities, uses a read-only root filesystem and sits behind a firewall that isolates bots from the platform and from each other. Secrets are encrypted at rest. Backups are nightly and stored locally on the platform host. We do not copy them offsite, so losing that machine loses the backups.
10. Contact
support@hostdc.xyz for anything in this policy; abuse@hostdc.xyz or the form at /report for reports of abuse or illegal content, with a 3 business days response commitment.