Privacy Policy

Short version: we collect what's needed to run your servers and bill you, we don't sell or share your data for advertising, and our analytics are cookieless.

TrueTick is operated by a sole proprietor (ФОП) registered in Ukraine, who is the data controller for the information described here. The operator's legal name is available on request and in the Ukrainian state register (ЕДР). Contact: support@truetick.gg.

1. What we collect

• Account: your email address and a hash of your password (we never store the password itself). If you arrived through a link with campaign tags (utm_source, utm_medium, utm_campaign), we keep those tags with your account to see which channels bring customers. Before that they're held in your browser tab's session storage (gone when the tab closes), never in a cookie, and sent to us only when you sign up.
• Billing: your wallet balance and a ledger of charges and top-ups. Card details never reach us — checkout is handled entirely by Paddle, our payment processor and merchant of record.
• Server data: the worlds, configs and files you upload or generate. We store them to run your servers and touch them only for operations (backups, quotas, support you ask for).
• Operational data: server state and performance metrics (TPS, MSPT, player counts), plus logs needed to keep the platform healthy.
• IP addresses: used transiently for security rate-limiting on login and signup.
• TickWait reports: if you run our free TickWait plugin and choose to share a report, we store what it uploads: per-hour sums of its CPU measurements and of the number of players online, an hour-of-day profile, the server's CPU model, CPU count and limit, cgroup version, operating system, kernel, Java and server versions, and any host or plan label you typed. Not the server's address, player names or world. The IP address an upload or a deletion comes from is counted in memory toward hourly limits, and an upload's is compared with our own servers' addresses (to mark reports sent from TrueTick machines); it isn't saved with the report. A shared report is public to anyone with its link.
• Analytics: first-party, cookieless page analytics (self-hosted Umami). No cross-site tracking, no advertising identifiers.

2. What we use it for

Running your servers, charging your wallet for what you actually use, preventing abuse, sending transactional email (such as address verification) when that feature is enabled, answering your questions in the server assistant when you use it, publishing the TickWait reports you choose to share, and measuring which marketing channels bring customers (the campaign tags in §1). Nothing else.

3. Who else sees data

Only processors necessary to operate the service:

• Paddle — payment processing and invoicing (their privacy policy applies at checkout);
• OVHcloud — the data center hardware your servers run on: Beauharnois, Canada (NA region) or Gravelines, France (EU region), depending on which you picked;
• Cloudflare — DNS and network protection for truetick.gg;
• Resend — delivery of transactional email, when enabled;
• Anthropic — generates the server assistant's replies. Only when you use the assistant: what you ask, and what it reads from that server (metrics, lag diagnoses, logs and files), is sent to Anthropic's API.

We do not sell personal data and we do not share it with advertisers.

4. Retention

Account data lives while your account does. Deleting a server removes its files and backups from our systems. Billing records are kept as long as accounting law requires. Stale operational logs are rotated out. A shared TickWait report stays until it's deleted with the token the plugin received when it uploaded it (/tickwait unshare), or by us on request. Server assistant conversations are deleted 30 days after their last message. Anthropic, which generates the assistant's replies, separately deletes API inputs and outputs from its own backend within 30 days of receipt or generation, except where it must keep them longer to comply with the law or to enforce its Usage Policy: inputs and outputs its automated trust-and-safety systems flag as violating that policy are kept for up to 2 years, per its retention policy. By default, Anthropic does not use API inputs or outputs to train its models, per its training-data policy.

5. Your rights

You can ask us to show, correct, export or delete the personal data we hold about you — email support@truetick.gg from your account address. If you're in the EU/EEA or UK, this includes your GDPR rights; deletion requests are honoured except where billing records must legally be retained.

6. Security

Traffic is TLS-encrypted, passwords are hashed with bcrypt, file access is jailed per server, and the control plane is not exposed to the public internet. No system is perfect; if we learn of a breach affecting your data we will notify you without undue delay.

7. Contact

Privacy questions: support@truetick.gg.