Privacy policy

We keep the records required to operate the service:

• Account email, a password hash when you set one, and Google or GitHub account ids if you continue with those
• USD wallet balance and ledger entries
• Referral share code, who referred the account, and referral credits
• Invoices: coin, amount, address, payment reference, and status
• Instance plan, image, hostname, assigned IPs, and SSH or RDP credentials
• Tickets, message bodies, and files you attach
• Sign-in sessions and email activation or password-reset tokens
• Transactional mail we sent you
• Desk activity on the account

Server and network logs are kept only as long as needed for operations and abuse response.

We do not ask for government ID, a billing address, a phone number, or a card number. There is no bank or PayPal checkout. A working email is enough — typed in or shared by Google or GitHub if you continue with those.

Top-ups go through our crypto checkout. A checkout processor creates the quote, deposit address, and confirmation. We store the payment reference so a confirmed chain transaction can credit the wallet. On-chain transfers are public on their networks.

We send activation links, invoices, SSH or RDP access, email sign-in codes, renewals, suspensions, and ticket mail to the account address. We store the template and destination so the desk can see what was sent.

Sign-in uses an HTTP-only cookie named vpster_session. It lasts up to seven days, uses SameSite=Lax, and is marked Secure in production. We do not use advertising cookies.

The Google Analytics 4 tag is in the public HTML so Google can verify it. Until you continue on the cookie notice, analytics storage stays denied. After Continue, Google may set first-party cookies such as _ga and _ga_*. The tag does not run on localhost.

Continue with Google uses a short-lived HTTP-only cookie named vpster_google for the OAuth state, then the same vpster_session cookie. Continue with GitHub uses vpster_github the same way. Google or GitHub receives the redirect and the account email they already hold.

Email signup may set vpster_pending_verify for up to 24 hours so we can finish activation. An email sign-in code uses vpster_login_challenge for about 10 minutes. Both are HTTP-only, SameSite=Lax, and Secure in production.

A customer register link may set vpster_ref for 30 days, SameSite=Lax, so we can attach that referrer when the account is created. It is not an advertising cookie.

We may load Google reCAPTCHA on account forms (sign-up, sign-in, verify, forgot password, reset) and on ticket forms to limit abuse. That is disabled in local development.

The cookie notice remembers that you acknowledged it in localStorage as vpster_cookie_consent. That is not a cookie. Clear site data to see the notice again.

Support tickets live on the account. You can attach files and link an instance. Staff can see those messages. Do not send passwords or seed phrases in a ticket.

We do not sell personal data. A crypto checkout processor creates the deposit address and confirmation. The infrastructure host that runs the VM receives the hostname, image, and assigned IPs. If you use the Telegram store bot, Telegram delivers those messages and we store the chat id so we can send deploy and wallet notices there. Google Analytics receives page URLs, a browser identifier, and device data. Google also provides reCAPTCHA and optional sign-in. GitHub provides optional sign-in. We will disclose information when required by lawful process.

Write if you need a copy of the data on the account or want the account closed. We keep what we still need for invoices, abuse response, and legal holds.