Privacy Policy

The controller for the central ServerSentry website, customer portal, licensing service and the ServerSentry Ban Network is Mario Rauch, Am Grettert 9, 6460 Imst, Austria. Privacy requests can be sent to [email protected].

A DayZ community that runs the self-hosted ServerSentry product normally determines why its own player telemetry is collected and is therefore responsible for that local processing. See the Player Privacy Notice for the distinction between local community data and the optional central Ban Network.

This policy covers serversentry.app, the ServerSentry account and licensing backend, Stripe-related order records, support communications and the optional central Ban Network. It does not make ServerSentry the controller of every record stored in a customer's self-hosted PostgreSQL database.

Where ServerSentry processes customer-controlled personal data on managed infrastructure or during authorized support, the parties may act as controller and processor under the applicable Data Processing Agreement. The central Ban Network is treated separately because ServerSentry defines core network purposes, access rules and retention safeguards.

When you access the website or API, technical connection data can be processed, including IP address, request time, requested path, HTTP status, user agent, proxy/security information and rate-limit state. This is used to deliver the service, secure accounts and APIs, prevent abuse, investigate incidents and diagnose failures.

The legal bases are Article 6(1)(b) GDPR where processing is necessary to provide a requested service and Article 6(1)(f) GDPR for our legitimate interests in secure and reliable operation. Central application log files are configured for a maximum of 14 daily files. Dedicated licensing and security-check records are retained for no more than 90 days unless they are required for an active security investigation or legal claim.

ServerSentry uses Discord OAuth with the identify and email scopes. We may receive your Discord user ID, username, display/profile information, avatar and email address. We also process authentication timestamps, account state, organization membership and permissions required for the customer dashboard. ServerSentry does not receive or store your Discord password and does not retain Discord OAuth access or refresh tokens after login.

This processing is necessary for account creation, authentication and contractual access under Article 6(1)(b) GDPR. Security-related account processing may additionally rely on Article 6(1)(f) GDPR.

Payments are handled by Stripe. ServerSentry receives and stores the data required to reconcile and provide purchases, such as Stripe customer, checkout, subscription and invoice identifiers, customer email/name where provided, product and pricing information, currency, payment status and timestamps. Full payment-card details are handled by Stripe and are not stored by ServerSentry.

The legal basis is Article 6(1)(b) GDPR for contract performance and Article 6(1)(c) GDPR for statutory accounting and tax obligations. Records that form part of legally required Austrian business and accounting documentation are retained for the applicable statutory period, generally seven years, and longer only where another legal duty or pending proceeding requires it.

To issue and protect software licenses, ServerSentry can process product and license identifiers, organization/account identifiers, installation IDs, server/deployment identifiers, license entitlement, software version, activation state and technical request data. Request IP addresses may be used for rate limiting and abuse prevention; where licensing security events are persisted, the backend stores a hash and/or masked form rather than a player IP address.

Linux/container downloads may be delivered from the Nexus repository hosted on infrastructure operated for ServerSentry at wpmates.io. These operations are based on Article 6(1)(b) GDPR and, for license fraud and security controls, Article 6(1)(f) GDPR.

If you contact us, we process the message, your contact information and any files or technical details you choose to provide. The purpose is to answer your request, provide contractual support and document security or legal matters. The basis is Article 6(1)(b), Article 6(1)(f), or where applicable Article 6(1)(c) GDPR. Ordinary support correspondence is normally retained for up to three years after the matter is closed unless a shorter period is appropriate or longer retention is legally necessary.

The installed ServerSentry product can process DayZ player-related data in the customer's own environment, including Steam64 and BattlEye identifiers, Bohemia identifiers, player names, timestamps, positions, combat and death events, economy/item events, chat or command events, moderation records, notes, support records and related telemetry depending on the customer's enabled modules. RCON enrichment and optional hybrid ban enforcement can also process a player connection IP address locally in the customer deployment. External GeoIP enrichment is disabled by default. If a customer deliberately enables it and configures a third-party lookup provider, the queried player IP address is sent to that provider and the customer is responsible for the corresponding lawful basis, transparency and provider assessment. If a community enables the optional storefront, its local checkout/order records can additionally contain buyer or target Steam64 identifiers, payment/order references, customer IP address, user agent and country information used by that community's checkout and fraud/security workflow. Local administrator/API audit records can likewise contain request IP address and user agent. These customer-controlled records are stored in the customer deployment and are not routinely transmitted to the central serversentry.app account API merely because ServerSentry is installed.

The product's current privacy-oriented defaults retain raw telemetry payload details for 7 days and telemetry events for 30 days; local system and PostgreSQL logs use shorter default retention periods. Local RCON player connection-history enrichment is limited to 30 days after last observation. An IP association used by optional hybrid Ban Network enforcement remains local and may be kept while needed for an active ban; inactive associations are pruned after 30 days. Customers remain responsible for choosing and configuring lawful, proportionate retention for other community records.

If a customer deliberately enables and uses the central Ban Network, selected moderation data leaves the customer's local installation. The central service can receive Steam64 identifiers, BattlEye GUIDs, ban reason, optional evidence references, ban category/list information, timestamps, status and customer/user audit identifiers. We receive this information from participating server communities rather than directly from the affected player.

The purpose is to provide shared abuse and moderation intelligence to participating communities. We rely on Article 6(1)(f) GDPR for the legitimate interests of ServerSentry and participating communities in protecting game servers and communities against documented abuse, subject to the rights and interests of affected players. Customers must have their own lawful basis, submit accurate and necessary information, and provide appropriate player transparency. A list marked public is public within the authenticated Ban Network, meaning other authorized ServerSentry customers can query matching identifiers and see the data exposed by that list; it is not intended as a public internet database.

An active ban is retained while it remains active. After revocation or expiry, player identifiers, reason and evidence are scheduled for erasure after 90 days. An explicit owner deletion causes the central record to be scrubbed promptly. A minimal non-player deletion/synchronization tombstone may be retained as needed to propagate the deletion and protect system integrity; it does not retain the removed Steam/BattlEye identifiers, ban reason or evidence reference. Details and player rights are set out in the Player Privacy Notice.

The customer dashboard uses a secure, HttpOnly authentication cookie that is necessary to keep you signed in. The frontend uses session storage to preserve a checkout selection while you complete the requested Discord login flow. A first-party serversentry_consent cookie records whether you accepted or rejected optional analytics for up to 180 days. Cloudflare may set strictly necessary security cookies as part of proxy, DDoS and abuse protection.

With your express consent, we use Google Analytics 4, provided by Google Ireland Limited and Google LLC, to understand visits and navigation on public pages. The service can process the page path without its query string, page title, referrer, browser and device information, approximate location derived from the IP address, usage events and the identifiers stored in _ga and_ga_* cookies. We do not send a ServerSentry account ID to Google Analytics, and dashboard, activation, product-authorization, invitation and subscription-management and withdrawal routes are excluded from analytics. Analytics is only enabled on our production website; local development, staging and the separate Wiki hosts are not measured.

• serversentry_consent: remembers your cookie choice for up to 180 days. This necessary preference cookie is set when you save your choice, including when you reject Analytics.
• _ga: distinguishes browsers for visitor statistics, only after Analytics consent.
• _ga_4RM4Q0ET3K: maintains session information for our Google Analytics 4 measurement, only after Analytics consent. The identifier-cookie lifetime is configured to 180 days without extending it on each visit.

Google receives your IP address as part of the network request and uses it to derive approximate location information. According to Google, GA4 then discards the IP address before logging the collected data. Google may process Analytics data outside the EEA, including in the United States; the transfer safeguards are described in section 12. Further information is available in Google's Privacy Policy and its Analytics cookie documentation.

Google Analytics is disabled by default. Its script is not loaded and no analytics request is sent until you choose “Accept analytics” or enable Analytics in the settings. Advertising storage, Google Signals, advertising personalization and ad user data remain disabled. The legal basis is your consent under Article 6(1)(a) GDPR and the applicable rules for access to information on your device. Rejecting analytics does not restrict the service. You can change or withdraw your choice at any time through “Cookie settings” in the footer; withdrawal applies for the future and removes accessible Google Analytics cookies from this site.

• netcup: central ServerSentry infrastructure hosted in Vienna, Austria.
• Cloudflare: DNS, proxy/CDN, WAF, DDoS and security services; tracking features are not intentionally enabled.
• Google Ireland Limited / Google LLC: optional Google Analytics 4 website measurement, only after consent.
• Stripe: payment processing, subscriptions, invoices and customer billing portal.
• Discord: OAuth authentication and optional Discord community/support integrations.
• WPmates (Christian Czopnik), Germany: infrastructure used for the Nexus software repository and ServerSentry's self-hosted Mailu email service.
• Professional advisers, authorities or courts where disclosure is legally required or necessary to establish, exercise or defend legal claims.

A maintained overview is available on the Service Providers & Subprocessors page.

Some providers, including Cloudflare, Google, Stripe and Discord, are international organizations and may process data outside Austria or the EEA. Where GDPR Chapter V applies, transfers are based on an applicable adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses, as applicable to the provider and processing in question. Provider-specific information is available through their privacy documentation.

• Central application log files: up to 14 daily log files.
• Central license/security check events: maximum 90 days unless required for a documented incident or legal claim.
• Customer account and subscription operational data: for the account/contract lifetime and a limited wind-down period where necessary.
• Accounting and legally required transaction records: for the applicable statutory period, generally seven years in Austria.
• Ordinary support correspondence: normally up to three years after closure.
• Analytics consent choice and first-party Google Analytics identifiers: up to 180 days; Analytics is not loaded again unless consent remains granted.
• Google Analytics user-level and event-level data: the Analytics property is to remain configured for two months. Google's standard aggregated reports are not governed by that event-level retention setting and may remain available longer.
• Central Ban Network: active bans while active; revoked/expired player data for 90 days; explicit deletions are scrubbed promptly.
• Self-hosted telemetry: controlled by the customer; current product defaults are described in section 8.
• Local RCON connection/IP enrichment history: maximum 30 days after last observation; it remains in the customer deployment.

Account, authentication, billing and licensing data marked as required is necessary to create an account, conclude or perform a contract, or activate licensed software. Without it, the relevant service cannot be provided.

ServerSentry does not use customer account data for solely automated decisions that produce legal effects concerning you. The optional Ban Network supplies moderation matches and data to communities; an individual community decides its moderation policy and may configure its own automated enforcement. Such community enforcement is the responsibility of that community.

Where the GDPR applies and the legal requirements are met, you have rights of access, rectification, erasure, restriction, data portability and objection. If processing is based on consent, you may withdraw that consent for the future. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation.

Send requests to [email protected]. We may ask for information reasonably necessary to verify identity. You also have the right to lodge a complaint with a competent supervisory authority. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), available at dsb.gv.at.

We may update this policy when the service, providers or legal requirements change. The current version and update date are published on this page. Material changes affecting an existing contractual relationship will be communicated where required by law.