Your privacy matters. This policy explains what data we collect for game servers and bots, why we collect it, how we protect it, and when we delete it.
1 What we collect
When you sign up we collect your email and username. If you sign in with Google or GitHub, we keep that account's id and email, and if you link your Discord account, we keep its id and username.
When you buy, we keep a record of your orders, payments and invoices. We also keep the support tickets you open and the ratings and comments you send.
We also collect basic technical logs, such as IP address, device, browser and sign-in time, for security and operations.
2 What your servers and bots hold
We store your server's or bot's files and backups, and show what it prints to the console in the panel. We record its CPU, RAM and network use and whether it is running, to show you its analytics and online time.
For a game server, we record the players who join it by their in-game names and ids, their play sessions, and game events such as players joining and leaving.
For a bot, we keep its code: a copy of the files you uploaded or created from a template, or the commit id, message and author when you deploy from GitHub. We also keep each deployment's log, the bot's variables, and its identity: its Discord application id or Telegram bot id, its name and its picture.
If you turn on the web address, we keep the address, its certificate's state and whether your bot answered. We keep no log of the requests visitors send to it: no IP addresses, paths or content. We pass each visitor's IP address to your bot in the X-Forwarded-For header. When a request can't reach your bot for an unexpected reason, we record the bot's code and the error, and the error can include the request's path and query.
3 Variables and tokens
A sensitive variable, such as your bot's token, is stored encrypted, and once saved it is never shown again, to you, to our team or to the AI. It never enters a backup, it reaches only your bot itself when it starts, and the console masks any sensitive value 8 characters or longer. A variable that isn't sensitive is stored as you typed it and shown in the panel.
If you upload a zip that contains a .env file, we don't store that file. We suggest its variable names so you can add them yourself.
We read the bot's id from the token's format without sending it anywhere. For a Discord bot, we read its application's name and picture from Discord's public data, without signing in, at most once a day.
4 GitHub
If you link your GitHub account, we keep its id, login and avatar, and we store the access tokens GitHub gives us encrypted. From an installation of the Serverk GitHub App we keep the installation id, the account it is installed on and the permissions it was granted, and from a connected repository its id, name and branch.
The app asks to read your code, to read your verified email for sign-in, to create a repository in your account when you use a template, and to write the deployment status on commits. We fetch code with temporary read-only access to the connected repository alone. A public repository connected without the app is read without signing in, or with your own GitHub account if you linked one.
When you disconnect GitHub, automatic deploys stop for all your bots, and what is deployed keeps running. We remove GitHub sign-in from your account if you keep another way to sign in.
5 Payment data
Card numbers never pass through or get stored on our systems; they are processed directly by the licensed payment provider. We only keep the transaction reference, the card brand, and the last four digits to show on your receipts.
6 How we use your data
We use it to run the service, issue receipts, provide support, and protect the platform from abuse. We read your bot's code to detect how to install and start it and which variables it needs, then run it. We do not sell your data or share it for marketing.
7 AI
When you use the Serverk assistant, or open a support ticket that AI answers, the model receives your message and what its tools read on your behalf, such as your server's or bot's state, console lines or a file you ask about. It never receives your email, your Discord id, your card brand or its last digits.
We run the models on Cloudflare Workers AI, and we don't use a provider that trains its models on the data. We delete AI run records, including what their tools read, after 90 days.
8 Connected apps
An app you connect to your account through MCP reaches your data only within the access you approved, and it never receives the value of a sensitive variable, because our tools never return one. We record every change it makes, and every request we refuse, in our audit log for a year, with sensitive data removed from its inputs and without storing its outputs. You can revoke its access at any time from Connected apps in your account.
9 Cookies
We use essential cookies to keep you signed in (30 days), to keep the access a server share link gives you (up to 30 days), and to protect signing in with an outside account (10 minutes). We also use preference cookies that remember your language, country, currency and time zone for up to a year, and the country Cloudflare detects from your IP address until you close your browser, so we show you the right prices and times. We keep where your first visit came from (the site that sent you, the campaign in the link and the first page you opened) for 90 days, and save it with your account when you sign up, so we know how people find us. We do not use advertising or tracking cookies.
10 Mobile app notifications
When you turn on notifications in the mobile app, we store your device's push token, its operating system and its language. To deliver each notification, we send the token, the notification's title and text, the identifiers that open the right screen in the app (such as a server code or a ticket number) and your unread count to Expo, which passes them to Google for Android devices or to Apple for iOS devices. A notification can include a server name, an invoice number or a support ticket subject, never a password, an amount or card details.
11 Sharing
We give each provider the minimum it needs to run the service, and we never share your data for marketing.
StreamPay processes payments: we send it your username, your email, and what you are buying and its amount, and you enter your card details on its own payment page.
Your servers and bots run on OVH machines in France, which hold their files and console output. Oracle Cloud hosts our website and database.
Our website runs through Cloudflare, which detects your country from your IP address. Cloudflare R2 holds the off-site copy of every backup, of our database backups, and of the bot code you uploaded or created from a template. We run AI models on Cloudflare Workers AI.
Resend sends the emails you get from us, so it receives your email address and the message. Emails you send us are kept at Purelymail.
When you link GitHub or Discord, we talk to them only as far as the link needs, such as checking that you are a member of Serverk's Discord server for the trial. Expo delivers mobile notifications as described above.
We may disclose data when legally required.
12 Retention and deletion
Your server or bot is permanently deleted seven days after its time expires, or one day after a free trial ends, together with its files and everything tied to it, such as its variables, deployments, analytics and player history. The backups kept in the backup vault stay there for 30 days after it's deleted.
We take an automatic backup every day when the files changed and keep at most the last seven, and we take a backup before every change that could touch your files and keep it for 72 hours. Backups you take yourself stay until you delete them, within your plan's disk limit. Every backup has an off-site copy.
Each deployment's log, up to 2,000 lines, is kept for 7 days after its last line. We keep each bot's last 50 deployments, and the code of its last 10 deployments and its current one. Code you upload but never deploy is deleted within 7 days of its order being canceled.
We keep the last 5,000 console lines for 6 hours after the last line, usage readings and running state for 14 days, and game events for 30 days.
Your account activity, such as sign-ins and password changes, is kept for 180 days, and sign-in sessions are deleted 30 days after they end. AI run records are kept for 90 days, and the audit log for a year.
Invoices and credit notes are never deleted, because they are financial records. When you delete your account we delete your personal data, except what we must keep by law.
13 Your rights
You can request a copy of your data, correct it, or delete your account at any time by contacting us. From your account you can unlink Discord or GitHub, revoke any connected app, and sign out your other devices.
14 Updates and contact
We may update this policy and will publish the latest version on this page. Questions: [email protected].