Privacy Policy

Data Controller

GameSentry is the data controller for personal data collected directly from Platform users (account holders). For player data collected from game servers, the Organization (server owner) is the data controller and GameSentry acts as a data processor on their behalf. Contact: [email protected]

Information We Collect

We collect different types of data depending on how you interact with our Platform:

Legal Bases for Processing

Under GDPR Article 6, we process personal data on the following legal bases:

• Contractual Necessity (Art. 6(1)(b)) — Processing account data and server data is necessary to provide you with the GameSentry platform services you have subscribed to.
• Legitimate Interest (Art. 6(1)(f)) — Processing player data from game servers for server administration, abuse detection, and platform security. We have conducted legitimate interest assessments for these processing activities.
• Consent (Art. 6(1)(a)) — Where we rely on consent (e.g., optional features like friends list VAC checking), you may withdraw consent at any time through your Organization settings.
• Legal Obligation (Art. 6(1)(c)) — Retaining financial records for tax and accounting compliance.

How We Use Your Information

We use the information we collect for the following purposes:

• To provide and maintain game server management services, including real-time monitoring, RCON command execution, player tracking, and automation
• To detect and prevent abuse, including VPN/proxy detection, alt account identification, and VAC ban monitoring
• To display server information in the public server browser for game discovery
• To send notifications you have configured, including Discord webhooks and server status alerts
• To process payments and manage subscriptions through Stripe
• To improve and develop the Platform based on aggregated usage analytics

Server Owner & Organization Data

When an Organization provides RCON or SFTP credentials to GameSentry:

• RCON Data: We maintain a persistent connection to your server and process all data accessible through that connection, including player connections, chat messages, game events, and administrative commands. This data is stored and made available to your Organization members based on their assigned permissions.
• SFTP Data: We access server files only for the purposes you configure: backups, configuration management, and plugin deployment. File contents are encrypted in transit and at rest.
• RCON and SFTP credentials are encrypted at rest using AES-256-GCM and are never exposed through our API or displayed in the user interface after initial configuration.

Player Data (Third-Party Data Subjects)

We collect data about players who connect to servers monitored by GameSentry. These players may not have a GameSentry account and have not directly consented to our data processing.

• Legal Basis: Player data is processed under the legitimate interest of the Organization (server owner) for server administration, security, and abuse prevention. Organizations are the data controllers for this data.
• Data Minimization: We only collect data that is necessary for server administration purposes. IP addresses are encrypted immediately upon collection.
• Player Rights: Players can exercise their data protection rights by contacting the server Organization directly, or by emailing GameSentry at [email protected]. We will respond to valid requests within 30 days.
• Steam profile data (public information) is cached temporarily and refreshed periodically. Expired data is automatically cleaned up.

Data Security

We implement robust security measures to protect your data:

• All player IP addresses are encrypted using AES-256-GCM with random nonce and authentication tag before storage
• RCON passwords and SFTP credentials are encrypted at rest and never exposed through the API
• All data transmission uses TLS 1.3 encryption
• JWT authentication with HttpOnly secure refresh cookies and RSA signing
• SteamIDs and IP addresses are automatically redacted from production application logs
• Role-based access control ensures Organization members only see data they are authorized to access

Data Sharing & Third Parties

We share data with the following categories of recipients:

• Organization Members — Server data and player information is shared with Organization members based on their assigned role and permissions.
• Cross-Organization Sharing — If enabled by the Organization, certain data (bans, player notes, name history) may be shared with other Organizations on the Platform. This is configurable and off by default.
• Sub-Processors — We use carefully selected third-party services to provide our Platform, including services for payment processing, player authentication, security checks, geolocation, messaging integrations, and game metadata. All sub-processors are contractually bound to protect your data and comply with applicable privacy regulations.
• Law Enforcement — We may disclose personal data if required by law, court order, or to protect the rights, property, or safety of GameSentry, our users, or others.

International Data Transfers

GameSentry operates servers in the European Union. When data is transferred outside the EU/EEA (e.g., to third-party services based in the United States), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or the service provider’s adequacy certification.

Data Retention

We retain data for the following periods:

• Player session data: Based on Organization subscription tier — Free (24 hours), Starter (7 days), Pro (30 days), Enterprise (365 days)
• Encrypted IP addresses: Same retention periods as session data
• Steam profile data: Cached for 30 days, then refreshed or deleted for inactive players
• Account data: Retained while your account is active. Deleted or anonymized within 30 days of account deletion.
• Financial records: Retained for 7 years as required by tax and accounting regulations
• Audit logs: Retained for 12 months, then anonymized

Cookies & Local Storage

We use minimal cookies for essential platform functionality:

• Authentication refresh tokens are stored in HttpOnly secure cookies (essential, cannot be disabled)
• Session state is stored in memory, not in localStorage, for security
• Cookie consent preferences are stored in localStorage
• We do not use third-party tracking cookies, advertising cookies, or analytics cookies. We do not use Google Analytics, Facebook Pixel, or similar tracking services.

Automated Decision-Making

GameSentry uses automated processing in the following areas. Under GDPR Article 22, you have the right to contest automated decisions:

• VPN/Proxy Detection — IP addresses are checked against IPQualityScore databases. Server administrators configure the response: notify only (default), auto-kick, or auto-ban. All automated actions are logged in an audit trail.
• Threat Assessment — Players are assigned a threat level based on VAC ban history, account age, and behavioral factors. This score is visible only to server administrators and does not automatically result in any action.
• To contest an automated decision, contact the server administrator or email [email protected].

Your Rights

Depending on your jurisdiction, you have the following data protection rights:

Children’s Privacy

GameSentry is not intended for use by individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child under 16 has provided personal data through our Platform, please contact us at [email protected] and we will promptly delete the data.