Privacy Policy

1. Who we are

This service is operated by PLAYYOURWAYHOSTING (ABN 33 985 231 059), trading as Play Your Way Hosting. We provide game-server hosting: you subscribe to a plan, and we provision and run a game server for you on our infrastructure in Australia.

We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). For visitors in the EEA or UK, the GDPR supplement in section 10 also applies. Privacy questions: support@playyourway.com.au.

2. Information we collect

• Account information - your name, email address and, if you upload one, an avatar image. Passwords are handled by our authentication provider (Supabase) and are never visible to us in plain text. We also keep, with your account, the page you first landed on and the site that sent you there (domain only), so we can understand which searches bring customers; this sets no cookie.
• Billing information - payment is processed by Stripe. We store a Stripe customer reference and your invoice history; we never store full card numbers.
• Service data - the servers you provision and their configuration, backups you create, and your support tickets and live-chat conversations.
• Account activity - when you sign in (time and a running count) and when you last used your dashboard. We use this for security review and support, and so we can tell an active account from an abandoned one.
• Optional Discord link - if you connect Discord, we store your Discord user ID to link the accounts. You can unlink at any time from your account page.
• Friend referrals - if you share your referral link, the page it opens shows the first word of your account name to anyone who opens it, so your friend knows who sent it. If you claim a friend's link and sign up, we record whose link it was so you both get your free month.
• Technical data - IP addresses and basic request logs used for rate limiting, abuse and fraud prevention, and to keep the service secure. Guest live-chat sessions record the IP they were started from for spam prevention.
• Cookie-consent records - when you make a choice in the cookie banner, or claim a friend's referral link (which switches on referral attribution only), we keep a record of it: a random identifier (the same one stored in your own browser), which of the two optional categories you allowed (referral attribution, and analytics with session replay), the version of the notice you were shown, and the time. We deliberately do not log your IP address, device or browser against it - proving a privacy decision should not mean collecting more data than the decision itself. If you were signed in at the time, the record is linked to your account.
• Product analytics and session replay - only if you switch analytics on in the cookie banner. PostHog records which pages you visited and what you clicked, and builds a replay of how you moved through the interface, against a random analytics id and, while you are signed in, against your account. What you type is recorded as you typed it, except passwords: anything entered into a password field is replaced with asterisks in your browser before it is sent, the passwords the panel can reveal to you are hidden the same way, and two-factor setup is left out entirely. Every figure on your billing pages is masked. The rest of what you see, including your server console, the file manager, database and SFTP screens, support tickets and live chat, is recorded as it appeared on your screen, and the console can include lines about your server’s players. Messages your browser writes to its developer console are recorded with the replay. We use replays to find where the site confuses people and to work out what went wrong when you ask for help. Nothing is collected until you switch it on, and switching it off stops it immediately. Our Cookie Policy explains exactly what a replay does and does not capture.
• Launch-interest contacts - if you ask to be notified when a game goes live, or you back a game request, we store the one contact you typed in (an email address or a Discord username) against that game and the time you asked. Nothing else - no name, no IP address, and it is not linked to an account. We use it for that one message and nothing else, we have never sent anything from these lists, and you can ask us to remove your contact at any time by emailing support@playyourway.com.au.
• Help Centre feedback - when you tell us whether a guide helped, we store your yes or no against that guide together with a code made from your IP address, the guide and the date. We do not store the IP address itself, the code changes every day, and it is not linked to your account; it only stops the same visitor voting twice on one guide in a day.
• Product events from our own systems - a short, fixed list of things that happen on your account (you signed up, a subscription started or was cancelled, a server was provisioned, a power action ran, a backup was taken, a ticket was opened). These are sent from our server rather than your browser, keyed only to your account id, and they are not controlled by the cookie banner - see section 10 for the legal basis and how to object.
• Fault reports from the machines that run game servers - if a server runs out of memory, keeps crashing or fails to install, the machine running it reports that fault to PostHog. A report identifies the server and the machine, never you or your account, and is not controlled by the cookie banner. Reports cannot be deleted one server at a time, so what is held is removed when it reaches the 1 year analytics retention in section 6. To object, email us and we will stop them.
• Which advert or link first brought you here - when you first arrive, a small first-party cookie (pyw_attr) remembers the campaign labels in the address you arrived on (the ones we put in our own adverts and links), the page you landed on and the website that sent you, for 30 days. If you then create an account, that record is kept against it, and if you place an order the campaign labels are noted on the order. It holds no identifier, nothing is sent to any advertising network, and it is used for one thing: telling whether the money we spend on advertising brings in customers. See our Cookie Policy.

What we do not do: we run no advertising trackers, no ad networks and no social-media pixels; we do not build advertising profiles; we do not sell or share personal information for anyone else’s marketing; and nothing we use follows you to other websites. We do run product analytics and session replay, through PostHog in the European Union, but only if you switch it on - it is off until you do, and you can switch it back off at any time.

3. How we use your information

• To create and manage your account, and to provision and operate your servers.
• To process payments, renewals and refunds through Stripe.
• To send transactional email (verification, billing, server status, support replies).
• To send you a welcome email, and - if you are a customer - to ask you once for a public review. These are the only emails we send that are not strictly about running your account, they each carry an unsubscribe link, and unsubscribing stops them without affecting anything above. We run no newsletter, no mailing list and no marketing campaigns, and we never email people who are not customers.
• To provide support and respond to your enquiries.
• To see which help guides actually help, so we can rewrite the weak ones.
• To secure the service - rate limiting, fraud and abuse prevention, and investigating incidents.
• To meet legal obligations, including tax and consumer-law record keeping.

4. Cookies and similar technologies

We use essential cookies (sign-in session, checkout fraud prevention, live-chat continuity) and two optional categories that are only ever switched on by you: referral attribution, and product analytics with session replay. They are separate switches. The full list, durations, exactly what a replay records, and how to change your mind are in our Cookie Policy.

5. Third parties we share with

We share personal information only as needed to run the service, with:

• Stripe - payment processing and card fraud prevention (privacy policy).
• Supabase - authentication, database and file storage (privacy policy).
• Resend - transactional email delivery (privacy policy).
• Cloudflare - network security and content delivery in front of the site, and Cloudflare Web Analytics, which counts page views so we can see how many people visit and which pages they land on (privacy policy). It is not the same thing as the analytics in the cookie banner: it sets no cookie, stores nothing on your device, gives you no identifier and cannot follow you between visits or between sites, so there is nothing about you for it to build a profile from. That is also why it is not behind a consent switch.
• PostHog - product analytics and session replay, processed in the European Union (privacy policy). It receives nothing at all from your browser unless you have switched analytics on.
• Sentry - error reporting, so a crash on your screen reaches us with enough detail to fix it (privacy policy).
• Our infrastructure and game-panel providers - the Australian servers and the Pelican panel that provision and run your game servers.
• Discord - only if you use Discord sign-in prefill or link your Discord account (privacy policy).
• Browser push services - only if you opt in to push notifications, your browser’s push endpoint (Google, Mozilla or Apple, depending on your browser) receives the messages we send you.

We may also disclose information where required by law. We do not sell your personal information to anyone.

6. Data retention

• Account and service data - kept while your account is active. When a server is deleted, a minimal archival record may be retained as support history.
• Billing records - kept as required by Australian tax law (generally five years).
• Email support tickets - kept while your account is active so we have context for future support.
• Live chat transcripts - closed chats are moved to an internal archive around 30 days after they end, and permanently deleted around 30 days after that. Download a transcript from your dashboard before then if you want to keep one.
• Guest chat details - the name and email a guest gives us are removed automatically once their chat transcripts are gone.
• Technical logs - short-lived operational logs, rotated on a rolling basis.
• Email records - we log that each account email was sent, so we can prove a notice reached you and avoid sending it twice. After 24 months the address and subject are automatically stripped from that log, leaving only the fact that a message of that kind was sent.
• Cookie-consent records - kept for 3 years from when the decision was made, as proof that it was given (GDPR Article 7(1)), then automatically deleted.
• Analytics events and session replays - only exist if you opted in. PostHog holds analytics events for 1 year and session replays for 30 days, then deletes them. Switching analytics off stops new ones being created; ask us and we will delete the ones already held.
• Help Centre feedback - your yes or no, and the daily code it is stored under, are kept for as long as that guide exists and are deleted with it. Nothing in the row points back to you or your account, so deleting your account does not reach it.
• Machine fault reports - PostHog holds them for 1 year, then deletes them. They name a server, not your account, so deleting your account does not reach them.
• After account deletion - personal information is deleted or de-identified, except records we must keep by law.

7. Security

All traffic, including live chat, is encrypted in transit (TLS). Data at rest is encrypted by our hosting providers. Access to customer data is restricted to the operator, full card numbers are never stored by us, and two-factor authentication is available on every account. No method of storage or transmission is completely secure, but if a data breach is likely to result in serious harm to Australian account holders we will notify you and the OAIC as required by the Notifiable Data Breaches scheme. See section 10 for the separate notification standard that applies if you are in the EEA or UK.

8. Children

The service is for adults: you must be 18 or older to create an account (see our Terms of Service). We do not knowingly collect personal information from anyone under 18 as an account holder. If you believe a minor has created an account, contact us and we will delete it.

9. Your rights (Australia)

You can download everything we hold about your account at any time from your account page - profile, subscriptions, invoices, servers, support history and cookie choices, as a machine-readable file.

Analytics events and session replays are held by PostHog rather than in our own database, so they are not part of that automatic download. Email us and we will export or delete them for you.

You may also request correction of your information, or ask us to delete your account and its data. Email support@playyourway.com.au from your account email address; we respond within 30 days. Deletion is handled by us rather than a self-serve button so that any active subscription is cancelled and settled first. If you are unhappy with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

10. EEA and UK visitors (GDPR supplement)

If you are in the European Economic Area or the United Kingdom, this section also applies.

• Controller - PLAYYOURWAYHOSTING (ABN 33 985 231 059), Australia; contact support@playyourway.com.au.
• Legal bases - performance of a contract (your account, servers and billing); legitimate interests (service security, abuse prevention, account-activity records, the server-side product events and machine fault reports in section 2, and Help Centre guide feedback, which is stored under a daily code made from your IP address rather than the address itself); consent (the optional attribution cookie, and product analytics with session replay); and legal obligation (tax and accounting records).
• Why analytics and product events are on different bases - session replay and everything else that runs in your browser stores things on your device, needs your consent, and is off until you give it. The server-side product events in section 2 store nothing on your device: they are our own records of things you did on your own account, kept on legitimate interests so we can tell whether the service works. Switching analytics off in the cookie banner therefore stops the browser half but not those records - to object to those, email us and we will stop them and delete what is held.
• Your rights - access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Access and portability are self-serve: use “Download my data” on your account page to get a structured, machine-readable copy. Where processing relies on consent you may withdraw it at any time (for cookies, via the Cookie Policy page).
• International transfers - we are an Australian business and our providers (including Stripe, Supabase, Resend and Cloudflare) may process data in the United States or other countries, under safeguards such as Standard Contractual Clauses. PostHog is the exception in the other direction: analytics and session-replay data is processed in the European Union (Frankfurt) and stays there. It is still accessed by us from Australia, which is itself a transfer, and is covered by the same safeguards.
• No automated decision-making - we make no automated decisions about you that have legal or similarly significant effects.
• Breach notification - if a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to you, we will also notify you directly without undue delay.
• Complaints - you may lodge a complaint with your local supervisory authority, though we would appreciate the chance to resolve it first.

11. Other regions

Wherever you are, the same principles apply: we collect only what the service needs, we do not sell personal information, and we do not share it with advertising networks. Analytics and session replay are opt-in everywhere, not only where the law requires it, and if your browser sends a Global Privacy Control signal we treat that as a no.

12. Changes

We may update this policy from time to time; the “Last updated” date above reflects the latest version. For material changes we will give notice on the site or by email.

13. Contact

Privacy questions, requests and complaints: support@playyourway.com.au. We aim to respond within 30 days.