Privacy Policy

1. Information We Collect

We collect information you provide directly, including your name, email address, and payment information. We also collect technical data about how you use our services, such as server usage and IP addresses.

2. How We Use Your Information

We use your information to provide and improve our services, process payments, communicate with you about your account, and ensure the security and stability of our platform.

3. Payment Information

Payment processing is handled by our payment provider (Stripe). We do not store your full payment card details on our servers.

4. Data Sharing

We do not sell your personal data. We never sell or share your email address for marketing, and we do not pass it to any advertiser, list broker, data broker or partner. This is the same promise made in the wishlist consent checkbox you tick, and it applies to the whole Service.

We share data only with the processors below, each of which processes it on our instructions to run the Service, and only the part of it that service needs:

We do not use any of these processors for advertising or remarketing, we do not run advertising or tracking pixels on the VPS wishlist or the deposit flow, and we do not sell data. Beyond the processors above, we share data only with your consent or where the law requires it.

Each processor has its own privacy policy and may process data outside your country; we encourage you to read them.

Links in our email. Email we send through Postmark — wishlist confirmations, account and verification messages, and order, receipt and payment notices — may have its links rewritten so they go through a Postmark address (track.pstmrk.it) before reaching the page they point to. Anything carried in a link, such as a wishlist confirmation token, therefore passes through Postmark on the way. When you click one, Postmark records that the click happened, with the time, your IP address, the browser you used and an approximate location worked out from the IP. We use that only to confirm a signup link worked and to troubleshoot delivery — never for marketing profiling — and we do not sell or share it. Postmark keeps this activity for 45 days by default, and we keep no separate copy.

5. Data Retention

These periods are commitments, not aspirations. Where a deletion is not yet carried out by an automatic job, the row says "not yet automated" — the commitment is the same; the mechanism is still being built. You can ask us to delete any of these sooner under §11, and we will.

6. The VPS wishlist

6.1 What the wishlist is

The wishlist is free and is not a pre-order. It reserves nothing — no slot, no price, no place in a queue. Joining it does not create a contract and does not commit you to anything.

6.2 What we store when you join

• your email address;
• the plan you said you were interested in, if you chose one — this field is optional, and the "not sure yet" option is stored as nothing at all;
• the version of the consent text you ticked (currently 2026-10-26-v2), so we can show what you agreed to;
• a hash of the confirmation link token — we store the hash, not the link itself, so a copy of the database does not let anyone confirm on your behalf;
• timestamps: when you signed up, when we sent the confirmation email, and when you confirmed.

We do not store your IP address on the wishlist record. Your IP is used at the moment of signup for the anti-abuse checks in §6.6.

6.3 Double opt-in

Your signup counts only when you click the link in our confirmation email. That link stops working 7 days after we send it. If you do not confirm, we never email that address again. The confirmation link is click-tracked by Postmark, so the token in it passes through their servers on the way to you (§4).

6.4 The two emails you will get, and nothing else

1. one email asking you to confirm your address (immediately);
2. one email when VPS hosting opens.

No newsletter, no drip sequence, no "while you wait" content. We will not add you to any other list.

If the VPS product never opens, we will tell you that once and then delete your address. We are not putting a date on that promise, because we do not yet know when we would conclude the product will not happen.

6.5 Unsubscribing

Every wishlist email carries a one-click unsubscribe link; no login is needed. Unsubscribing deletes your row from the wishlist table — your address is removed, not just flagged as unsubscribed, and we will not email you about VPS again. The unsubscribe page's "we have deleted your address" is literally true.

6.6 Anti-abuse on the wishlist

To stop automated signups we run, at the moment of submission:

• a Cloudflare Turnstile check — Cloudflare sees your IP address and returns a pass or fail to us;
• rate limits: per-IP and per-submission counters held in our own in-memory store (Redis), which expire on their own with the window they measure (one hour for the per-IP limits, up to 24 hours for the per-email one). The per-email counter is keyed on a truncated hash of your address, not the address itself.

Neither is used for profiling, and neither is shared beyond Cloudflare under §4.

7. VPS pre-orders and the deposit

7.1 What a pre-order is

A pre-order is an optional, refundable deposit ($5 for the first 50 pre-orders, $10 after) that is credited to your first invoice if the product launches. It is a separate product from the wishlist. You must be signed in to place one, because a deposit has to be tied to an account we can refund and convert.

7.2 What we collect for a deposit

• your account identifier (an opaque Keycloak subject string, not a name);
• the plan and the deposit amount, and which price phase ($5 founding / $10) you were in;
• the status history of the pre-order (pending, paid, refund pending, refunded, refund failed, expired, converted) — this history is append-only: it cannot be edited or deleted, by us or by anyone with database access;
• the Stripe identifiers for the checkout session, payment intent, charge and any refund;
• an opaque card fingerprint from Stripe (see §7.3);
• flags that mark a test account or an exclusion, with a written reason, so internal test money is never counted as demand;
• timestamps: created, paid, refund requested, refunded, disputed, converted.

We do not collect your card number, its expiry or its CVC. The card is entered at Stripe and never touches our servers.

7.3 The card fingerprint, and why

Stripe gives us a stable, opaque identifier for a card. It is not the card number, it cannot be reversed into one, and it is not a payment credential. We use it for exactly one purpose: to spot the same card being used to place many deposits (which would fake demand for a product we would then have to build). It is not used for marketing, profiling, credit decisions, or shared with anyone.

7.4 Refunds, conversion, and what we keep afterwards

• If the product is cancelled or you ask before delivery, the deposit is refunded through Stripe.
• A refunded deposit does not delete the pre-order record. It is a financial record, and our database is designed never to hard-delete a pre-order for that reason: the amount, currency, phase, status history and Stripe identifiers are kept for as long as tax and accounting rules require.
• We clear the card fingerprint 24 months after the pre-order's last status change, so the duplicate-card check has a bounded memory. This clearing is not yet automated.
• If your deposit converts into a paid subscription, the pre-order becomes an ordinary invoice record under §1 and §5.
• We do not use your deposit record to contact you about anything except this product.

7.5 Duplicate and abusive pre-orders

We limit pre-orders per account and per IP, we review deposits placed with the same card, and we may exclude a pre-order (with a recorded reason) where it is a test, a duplicate, or an attempt to distort the demand count. Exclusion does not keep your money: an excluded paid deposit is refunded.

8. Running a VPS: what we can see, and what we keep

8.1 You hold the machine

VPS is unmanaged KVM virtualisation: the server is yours, you hold root, you choose and install the operating system, and we provide no control panel and no managed layer. Patching, configuration and application security are your responsibility.

8.2 The honest technical position

Our virtualisation host operator holds administrative access to the physical machine your server runs on. That means your server's disk image and memory are technically reachable by us — we are not going to claim otherwise.

What we commit to: we do not open, read, copy, scan or analyse the contents of your server, its filesystems, its memory or its database. We do not deploy tools that index or search guest data.

The only exceptions are:

1. an abuse investigation — where your server is the apparent source of abuse, illegal content or a threat to other customers, we may inspect the minimum needed, and we tell you we did it and why wherever it is practicable to do so;
2. where the law requires it (a valid legal request — see §8.5);
3. at your request — for example restoring a server for you, or investigating a fault you have reported, and then only with your instruction.

8.3 What we do keep, all the time

These are operational records, not your data, and they are what let us run a network without watching your machine:

• Per-server traffic counters — bytes and packets in and out, per server. They exist because bandwidth is metered and shared with other customers, so the platform has to know how much each server is using.
• Edge connection metadata — source IP, destination IP, port and timestamp for connections entering and leaving the network. We hold this because the upstream provider makes us the hosting provider and requires connection logs to be retained. It is metadata; we do not capture or inspect packet contents, and we do not intercept or terminate TLS.
• Outbound mail is blocked on port 25 at the network edge by default, so a compromised or misconfigured server cannot send mail directly. Mail submission on 587/465 is open to you.
• Abuse signals — blocklist hits, complaint reports, and the automated thresholds that flag a server (see the VPS Acceptable Use addendum).

Retention periods for all of the above are in §5.

8.4 IP addresses we assign you

We keep a record of which IPv4 address (and which forwarding ports, on the shared-address plans) was assigned to which account, and from when to when. We keep it because abuse complaints and blocklist reports routinely arrive weeks after the traffic, and because a re-issued address carries its previous reputation.

8.5 Who can see your records, and who can ask for them

• You can ask us for your own assignment history and traffic counters at any time.
• An abuse reporter is told whether an address was in use and what the outcome was. They are not told who the customer is, unless the law requires it.
• Law enforcement or a regulator receives data only on a valid legal request, and only what the request covers. We log every such request and, where we are permitted to, we tell the affected customer.
• Internally, assignment history, counters and logs are accessible only to staff handling abuse, security and platform operations, and that access is logged.

8.6 When your VPS is terminated

We power the machine off and delete the disk image after 7 days. Restore points age out under §9 rather than being deleted the same day. The AUP addendum carries the same 7-day figure.

9. VPS backups and restore points

9.1 What they are

We take periodic restore points of your server onto our own network storage (TrueNAS), on a daily, weekly and monthly rotation. They exist so that a host failure does not cost you the whole machine.

9.2 They are a convenience, not a guarantee

As the VPS Acceptable Use addendum states: restore points are a convenience, not a backup guarantee, and we make no promise about data loss. If your data matters, keep your own copy off our platform. We do not read the contents of a restore point except to restore it for you or under the §8.2 exceptions.

9.3 How long, and what happens when you delete a server

• At most 14 restore points per server, rotating out within 3 months (§5).
• Deleting a server does not reach into restore points already written. They expire with the normal rotation and are then gone; we do not keep a deleted server's restore points beyond that window, and no copy of them is held by a third party today.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit and at rest, and access controls.

11. Your Rights

You may access, correct, or delete your personal information. Contact us to exercise these rights. You may also contact your local data protection authority. Three honest limits apply, and they are the same three everywhere in this policy: an unsubscribe deletes your wishlist address immediately (§6.5); a pre-order record survives a refund because it is a financial record (§7.4); and a legal retention obligation or an open abuse investigation suspends deletion of the specific records involved until it ends.

12. Cookies

We use essential cookies for authentication (Keycloak session) and for the analytics described in §4. We do not use third-party advertising cookies, and we set no advertising or tracking cookies on the VPS wishlist or deposit flow.

13. Contact

For privacy questions, contact us at [email protected].