Privacy policy

We keep the records required to operate the service:

• Account email, a password hash when you set one, and Google or GitHub account ids if you continue with those
• USD wallet balance and ledger entries
• Invoices: coin, amount, address, payment reference, and status
• Instance plan, image, hostname, assigned IPs, and SSH or RDP credentials
• Tickets, message bodies, and files you attach
• Sign-in sessions and email activation or password-reset tokens
• Transactional mail we sent you
• Desk activity on the account

Server and network logs are kept only as long as needed for operations and abuse response.

We do not ask for government ID, a billing address, a phone number, or a card number. There is no bank or PayPal checkout. A working email is enough — typed in or shared by Google or GitHub if you continue with those.

Top-ups go through our crypto checkout. We create the quote, deposit address, and confirmation. We store the payment reference so a confirmed chain transaction can credit the wallet. On-chain transfers are public on their networks.

We send activation links, invoices, SSH or RDP access, renewals, suspensions, and ticket mail to the account address. We store the template and destination so the desk can see what was sent.

Sign-in uses an HTTP-only cookie named vpster_session. It lasts up to seven days, uses SameSite=Lax, and is marked Secure in production. We do not use advertising cookies.

After you continue on the cookie notice we load Google Analytics 4 to see which public pages are used. Google may set first-party cookies such as _ga and _ga_*. The tag does not load until you continue, and it does not run on localhost.

Continue with Google uses a short-lived HTTP-only cookie named vpster_google for the OAuth state, then the same vpster_session cookie. Continue with GitHub uses vpster_github the same way. Google or GitHub receives the redirect and the account email they already hold.

On the public site we may load Google reCAPTCHA on sign-up, sign-in, and ticket forms to limit abuse. That is disabled in local development.

The cookie notice remembers that you acknowledged it in localStorage as vpster_cookie_consent. That is not a cookie. Clear site data to see the notice again.

Support tickets live on the account. You can attach files and link an instance. Staff can see those messages. Do not send passwords or seed phrases in a ticket.

We do not sell personal data. Google Analytics receives page URLs, a browser identifier, and device data as our processor. We will disclose information when required by lawful process.

Write if you need a copy of the data on the account or want the account closed. We keep what we still need for invoices, abuse response, and legal holds. Effective 4 September 2026.