SquidServers Privacy Policy
Nov 2, 2026 · Jean Serrano
Table of Contents
- 1. Controller and scope
- 2. Summary
- 3. Data we collect
- 3.1 Identifiers and technical data
- 3.2 Account data
- 3.3 Minecraft account linking
- 3.4 Payments
- 3.5 Cloud backup and Multi-Host
- 3.6 Data of other players
- 3.7 Analytics and error reports
- 3.8 Website analytics
- 3.9 Discord
- 3.10 Tunnels (Playit.gg)
- 3.11 Log sharing
- 3.12 Resource packs
- 3.13 Mod browsing
- 3.14 Diagnostics and support
- 4. Use of data
- 5. Analytics and cookies
- 5.1 App analytics (PostHog)
- 5.2 Website cookies and analytics
- 6. Data sharing
- 6.1 Service providers
- 6.2 Integrated third-party services
- 6.3 Other disclosures
- 7. International data transfers
- 8. Data retention
- 9. Your rights
- 10. Children
- 11. Security
- 12. Changes to this policy
- 13. Contact
1. Controller and scope
This Privacy Policy describes how Aqura LLC, operating as SquidServers ("SquidServers"), collects, uses and discloses personal data in connection with the SquidServers desktop application for Windows, macOS and Linux (the "App"), the squidservers.com website, and all web services and APIs operated under the squidservers.com domain and its subdomains (together, the "Services"). Aqura LLC is the controller of personal data processed through the Services.
The Services communicate with a database and authentication provider through the domain teldtmuylsriyngnmhat.supabase.co. Third-party services reachable through the Services are governed by their own policies, as described in Section 6.
2. Summary
SquidServers does not sell any data and does not share it for advertising. The App can be used to host Minecraft servers locally without an account; an account is required only for cloud features, Premium, friends and the item shop. Server files remain on the user's device unless cloud backup or Multi-Host is used or logs are shared. Usage analytics are optional and are configured at first launch and in Settings. Analytics data is pseudonymous and is identified by a random analytics ID that is kept separate from account data. Requests concerning personal data may be sent to [email protected] (Section 9).
3. Data we collect
3.1 Identifiers and technical data
The App creates a random install ID on first launch and stores it on the user's device. The install ID identifies the computer that runs Multi-Host servers and, while the user is signed in, is transmitted together with the account ID for presence purposes. It is not used for analytics. Where analytics are enabled, a separate random analytics ID, also stored on the device, is used instead; it is not transmitted to account, server or presence systems. IP address, app version and operating system information are received by SquidServers and its providers whenever the App or website connects, for example to check for updates or download files.
3.2 Account data
Account data consists of the email address, username, optional profile picture (Premium), sign-in method (email link, Google or Discord), session tokens, Premium and subscription status, friends, friend requests, server invites, notifications, pinned servers, and owned or equipped cosmetic items. While the user is signed in, the App transmits a heartbeat every 30 seconds containing the account ID, the install ID and the IDs of locally running servers. The heartbeat is used to display online status and last-seen time.
3.3 Minecraft account linking
Where a Minecraft account is linked through Microsoft sign-in, the Minecraft UUID, username and Xbox user ID (XUID) are stored and associated with the SquidServers account. The Microsoft refresh token is stored only on the user's device. Microsoft passwords are never received.
3.4 Payments
Payments are processed by Stripe. SquidServers receives the Stripe customer ID, subscription status, billing period dates and purchased items. Card and bank details are not received.
3.5 Cloud backup and Multi-Host
When cloud backup or Multi-Host is used, server files are uploaded and stored, including configuration files, whitelist, operator and ban lists, player cache, world data, file names and sizes, and version history. Servers made public appear in the public server directory with their name, address, version, player count and owner.
3.6 Data of other players
Cloud backups and shared logs may contain personal data of other individuals, including player names, UUIDs, XUIDs, banned IP addresses, in-game chat and connecting IP addresses. The user who uploads such data is responsible for having a lawful basis to do so and for informing the affected players. Affected players may submit removal requests as described in Section 9.
3.7 Analytics and error reports
Where analytics are enabled, usage events and error reports are sent to PostHog as described in Section 5.1.
3.8 Website analytics
The website uses PostHog and Google Analytics to measure visits and page views, as described in Section 5.2.
3.9 Discord
Discord Rich Presence is enabled by default and can be disabled in Settings. While Discord is running, the App displays activity on the user's Discord profile, such as "Running Server", the server name and player count, and may include a link to the SquidServers website. Where a Discord account is linked, the Discord user ID and Premium status are used to assign the Premium role in the SquidServers Discord server.
3.10 Tunnels (Playit.gg)
When communicating with Playit.gg, the user's platform name, update channel, agent name and IP address may be shared with Playit.gg. The agent key is stored on the user's device. Tunnel settings and changes (local port, region, tunnel name and local IP) are sent to Playit.gg.
3.11 Log sharing
When logs are shared, the log text, app version, operating system, log types and context added by the App (such as a server ID) are stored. The App attempts to redact IP addresses and chat messages before upload, but redaction is not fully reliable. Logs may therefore contain player names, chat messages, IP addresses and folder paths that include the computer username. Anyone with the report link can view the report.
3.12 Resource packs
Uploaded resource packs are stored as ZIP files under a random ID, together with the sanitized file name, size, checksum, download count and timestamps. No uploader or downloader identity is stored.
3.13 Mod browsing
When searching for mods or modpacks, search terms and the user's IP address are shared with Modrinth and/or CurseForge, either directly or through SquidServers servers.
3.14 Diagnostics and support
The App can generate a diagnostics report containing system specifications, Java installations, the server list including online player names, and recent errors. The report remains on the device unless it is sent to SquidServers. Support correspondence and attachments are retained.
4. Use of data
| Purpose | Data involved |
|---|---|
| Account creation, sign-in, friends and notifications | Account data (3.2) |
| Online status and last-seen time | Account ID, install ID, server IDs |
| Minecraft linking, cloud backup, Multi-Host, resource packs, log sharing and tunnel provisioning | Data described in 3.3, 3.5, 3.10, 3.11 and 3.12 |
| Payments, Premium, item shop and Discord Premium role | Data described in 3.4 and 3.9 |
| Tax and accounting records | Payment and subscription records |
| Product improvement and error reporting | Analytics ID, device and usage data (Section 5.1) |
| Website measurement | Page views, device and browser data (Section 5.2) |
| Discord Rich Presence | Server name, player count, status |
| Security, abuse prevention, rate limiting and removal of infringing packs | IP addresses, file checksums |
| Support and data requests | Correspondence and diagnostics provided by the user |
| Service emails, including login codes, notifications, invoices and policy changes | Email address, account name |
Personal data is not used for advertising or profiling.
5. Analytics and cookies
5.1 App analytics (PostHog)
Analytics are optional. At first launch the App presents an analytics setting, and no analytics data is sent until the user confirms the choice. The setting can be changed at any time in Settings, after which the App stops sending events immediately.
Each event includes a random analytics ID, the app version, operating system details (name, version, architecture and, on Linux, distribution) and a timestamp. Events cover launches of servers and Minecraft clients, including the Minecraft version, mod loader, number of mods, and server, modpack and mod names, together with the outcome of each launch. They also cover errors in server launch, backups, tunnels, mod installation and updates, with the error message and, for client launch failures, recent log lines from which personal details are redacted on a best-effort basis, as well as update settings and tunnel startup results.
Event data is sent to PostHog in the United States, which may derive approximate location from the IP address. The analytics ID remains on the device until the app data folder is deleted.
5.2 Website cookies and analytics
The website uses cookies and similar browser storage. Session cookies set by Supabase keep the user signed in, and temporary cookies lasting 10 minutes support Microsoft sign-in during Minecraft account linking. A session cookie of up to 30 days supports fleet device management. The App does not use cookies. No advertising or analytics cookies are used, and analytics data is not shared with advertisers.
6. Data sharing
SquidServers does not sell personal data.
6.1 Service providers
Personal data is disclosed to the following providers as required to operate the Services. Each provider processes data under its own standard terms and privacy policy.
| Provider | Data | Purpose |
|---|---|---|
| Supabase | Account, social, subscription and server data, server file metadata | Database and authentication |
| Cloudflare | Backups, shared logs, resource packs, request IP addresses | Storage, hosting and security |
| Backblaze | Older cloud backups | Storage |
| PostHog | Analytics events, analytics ID, page views | Analytics and error reports |
| Google Analytics | Website traffic and device data | Website analytics |
| Stripe | Email address, payment details (provided directly), subscription data | Payments |
| Zoho Mail | Support correspondence and attachments | Support email |
| Amazon Web Services (SES) and Brevo | Email address, account name and related data | Delivery of service emails, including login codes, notifications, invoices and policy changes |
6.2 Integrated third-party services
The following services receive data when the related feature is used. Each is governed by its own privacy policy, over which SquidServers has no control.
- Microsoft and Mojang: Minecraft sign-in and ownership verification.
- Discord: Rich Presence activity and Premium role assignment.
- Playit.gg: tunnel provisioning and tunnels.
- Modrinth and CurseForge: mod search and downloads.
- Server software providers (PaperMC, Fabric, Quilt, Forge, NeoForge and Geyser): IP address upon download of server software.
6.3 Other disclosures
Developers, employees and support agents of SquidServers may access analytics data and account data as required to process support tickets and data requests. Aggregated and de-identified statistics derived from analytics data may be shared publicly or with third parties for any reasonable purpose; such statistics do not contain personal information. Data may be disclosed to law enforcement or government entities where required by law or to protect rights and safety, and to a successor in connection with a merger, acquisition or sale of SquidServers. Content shared through log report links and resource pack links is accessible to anyone who has the link.
7. International data transfers
SquidServers and its providers operate primarily in the United States, and personal data is processed and stored there. By using the Services, users acknowledge that their personal data is transferred to and processed in the United States, whose data protection laws may differ from those of their country of residence.
8. Data retention
| Data | Retention |
|---|---|
| Account data (profile, friends, notifications, Minecraft links) | Until the account is deleted, and for 30 days thereafter |
| Cloud backups and version history | 30 to 90 days |
| Multi-Host server files | Until the account is deleted. For paid plans, until the subscription is cancelled and for up to 30 days thereafter |
| Server files and backups stored locally | On the user's device only, until deleted by the user |
| Payment and subscription records | As required by applicable tax and accounting law |
| App analytics events | Up to 7 years |
| Website analytics | Up to 7 years |
| Shared logs | 30 days after the last view; each view extends the period, up to a maximum of 90 days |
| Resource packs: unfinished uploads | 1 hour |
| Resource packs: never downloaded or checked | 48 hours |
| Resource packs: inactive | 14 days after the last download; metadata is purged after a further 30 days |
| Fingerprints (SHA-1 hashes) of packs removed for infringement | Permanently, to prevent re-upload |
| Rate-limit IP addresses (resource packs) | In memory only, up to 1 hour |
| Rate-limit IP addresses (logs) | Rolling windows of 1 to 5 minutes |
| Support emails | 12 to 24 months, unless legal requests or proceedings require longer retention, in which case multiple copies, including physical copies, may be kept as evidence |
| Install ID, analytics ID, local settings and sign-in session | On the device until deleted or until sign-out |
System backups may retain deleted data for a short period before they are overwritten.
9. Your rights
Subject to applicable law, individuals may request access to, correction of, deletion of, or a portable copy of their personal data, may object to or request restriction of its processing, and may withdraw consent where processing is based on consent, including by disabling the relevant setting in the App. Requests may be sent to [email protected]. Requests concerning an account should originate from the email address registered to that account, and further verification may be requested where an account cannot be confirmed. Users without an account should include their install ID and, where analytics are enabled, their analytics ID (available in app settings), which are used solely to locate and process the request. Players whose data appears in another user's shared logs should provide their Minecraft username or UUID and the location of the data.
Requests are answered and resolved within one month and usually sooner. Complex requests may require up to two further months, in which case the requester is informed of the reason. Requests are free of charge unless they are manifestly unfounded or excessive. Data that cannot be linked to a requester cannot be searched, and records that must be retained by law, such as invoices, are retained after an account is deleted. Residents of the European Union, the United Kingdom and other jurisdictions may lodge a complaint with their local data protection authority. SquidServers does not sell personal data or share it for cross-context behavioral advertising, and residents of US states with privacy laws may exercise their rights through the same email address.
10. Children
The Services are not directed to children under 13, and SquidServers does not knowingly collect personal data from them; any such data that is identified is deleted promptly. The minimum age at which an individual may consent to the processing of personal data or enter into an agreement varies by country and may be higher than 13. Users are responsible for complying with the laws that apply to them, and where local law requires parental or guardian authorization, such authorization is required to use the Services. Parents and guardians may contact [email protected] to request the review or deletion of a minor's data.
11. Security
Personal data is protected by encryption in transit, encryption at rest provided by storage providers, access controls on databases, signed and time-limited upload and download links, hashed deletion tokens and rate limiting. Shared log links and resource pack links are unlisted but not private, and anyone with the link can open the content. No system is completely secure. In the event of a data breach, affected users and authorities are notified as required by applicable law, including within 72 hours of becoming aware of the breach where the GDPR applies.
12. Changes to this policy
This Privacy Policy may be updated from time to time. The current version and its effective date are published on the website. Material changes are communicated to registered users by email and by notice on the website or in the App. Continued use of the Services after the effective date of an update constitutes acceptance of the updated policy.
13. Contact
Aqura LLC (SquidServers)
5900 Balcones Drive, STE 100, Austin, TX 78731-6298
Email: [email protected]
Support Center: support.squidservers.com