Privacy Policy

1. What we collect

When you create an account

• Your username, which is public, and your email address.
• Your password, stored only as a one-way hash, so we can't read it.
• Your play key. We store a hash of it, its last few characters and a random value that lets us rebuild it, together with a secret kept separately on our servers, to put it into your mod downloads and show it to you.
• When you created your account and when you last logged in.

Friends

• Your profile: the picture and bio you add, whether others may comment, and which games you hide. Other members see your profile, with the games you played, your play time and, where a game's server records them, your wins and matches.
• Comments you write on members' profiles, and reports you send about comments. Moderators see who reported a comment; the author doesn't.
• Messages you send and receive, when they were read, who you blocked, your message settings, and when you last had the site open (so we don't email you about a new message while you're here). Only you and the other person can read a conversation. Moderators see a message only if its recipient reports it, and then only that message. Deleting a message removes it from your side; the other person keeps their copy.
• Friend requests you send and receive, who your friends are, and which of your private servers you've shared with which friends. A friend sees your username and the servers you share with them, which they can join without a paid plan; other players can't see who your friends are. Declining a request doesn't tell the sender.

When you email us or reset your password

• Emails you send to support@zer0lag.net and our replies. Every Zer0Lag administrator can read them, so they can help you.
• When you sign up, and when you sign in from a browser your account hasn't used before, we email you a one-time code (and a button that enters it for you) to check it's really you. We store only a scrambled copy of the code, which stops working after 15 minutes. For each browser you confirm, we keep a scrambled copy of its cookie, its browser and system name (for example "Firefox on Windows") and when it was last used.
• When you ask for a password reset, we email a one-time link to the address on your account. The link itself isn't stored: it's signed with a secret on our servers and stops working after an hour, or once your password changes.

When you use servers

• When you download a mod, we put your play key, username and our server address into its settings file, so it works without setup. That copy of the mod is made just for you and isn't stored.
• Private servers you create, with their names, regions, settings and whitelists, and the servers you save as favourites.
• How long you play each game on our servers, and the wins, losses and matches a game's server records for your account, shown on your profile.
• When you connect to a game server: your username, the server, your IP address, and when you connected and disconnected. We use this to allow one connection per account at a time. For some games we also tell the game server your username and account number, so it knows it's really you (for example, for leaderboards).
• The worlds, saves, logs and console output the game servers produce, which can include your username and things you type in game.
• Crash reports, only when you choose to send one: after your game crashes, the mod shows you the report in the game, and sends it only if you press Submit Crash Log. It holds the game's logs from the session that crashed, the mod, game and Unity versions, your operating system, the last screen and server you were on, the times, and the note you write, linked to your account. The mod removes your play key and your computer's user name from the logs first, and we check again when we receive it. Zer0Lag administrators read crash reports and give them to the people who make that game's mod, so they can fix the problem. Other players never see them.

When you subscribe

• Your plan, billing period, price and currency, payment provider, subscription status and key dates, such as when a trial ends or a period is paid until.
• The payment notices PayFast or PayPal send us, including payment amounts, fees, references and status. PayFast's can also include the name, email address and phone number you gave PayFast; PayPal's can include your PayPal account's name and email address.
• A PayFast subscription token or PayPal subscription ID, which lets us cancel renewals for you. We never receive or store your card or bank details.

Automatically, when you visit

• Your IP address, used briefly to limit repeated login and sign-up attempts, and to work out whether you're in South Africa, so we can show prices in rand or US dollars. We look this up in a copy of the free DB-IP country database kept on our own servers; your IP address isn't sent to anyone to do it, and we don't store the result.
• Standard server logs, such as IP address, pages requested, time and browser type, used to keep the service running and secure.

We don't use analytics, advertising or social-media trackers, and we don't load fonts or scripts from other companies' servers.

2. How we use it

• To create and run your account, and to sign you in to the website and our game servers.
• To run, connect and manage the servers you use and own, and to enforce whitelists and plan limits.
• To process subscriptions, trials, renewals and cancellations, and to keep billing records.
• To keep the service secure: preventing fraud, cheating, abuse and attacks, and enforcing our Terms of Service.
• To answer your messages, and to tell you about your account, billing or important changes to the service.
• To email you password reset links when you ask for one, and a notice whenever your password changes, so you'd know if someone else changed it.
• To fix problems and improve the service.
• To meet legal duties, such as tax and accounting requirements.

We won't send you marketing emails unless you've agreed to receive them.

3. Cookies

We use only the cookies the site needs to work:

• a session cookie that keeps you logged in and protects forms from forgery, deleted when you close your browser;
• a "remember me" cookie, set only if you tick "remember me" when you log in, which keeps you logged in for up to 30 days; and
• a trusted browser cookie, set once you've entered an email code in a browser, so that browser doesn't need a code at your next sign-in. It holds a random value and lasts 180 days. You can see and forget your trusted browsers on the Change password page.

We don't use advertising or tracking cookies, so there's nothing to opt out of.

4. Who sees your information

• Other players see your username on servers, whitelists, friend requests and in games. When the mod lists servers in your game, it gets the names of the friends who shared servers with you. Owners of private servers see the usernames of players connected to their servers, but not their IP addresses or email addresses.
• Zer0Lag staff can see account, server and billing details, including the IP addresses of connected players, to run the service, give support and stop abuse.
• Mod makers: crash reports you choose to send are passed to the people who make that game's mod, so they can fix it. They get the report with your username, not your email or IP address.
• PayFast (in South Africa) and PayPal (elsewhere) process payments. We send them only what a subscription needs: the plan, price and our reference for it. What you give them at checkout is handled under their own privacy policies. PayPal may process your information outside your country.
• Our hosting provider runs the computers the service is hosted on, and stores data only on our behalf.
• Email: we run our own mail server and don't use an outside email service. Emails we send pass to your email provider to be delivered, and it handles them under its own privacy policy.
• Authorities, when the law requires it, or when it's needed to protect the rights, property or safety of our players, the public or Zer0Lag.
• A new owner, if Zer0Lag is sold or merged. They'll have to protect your information as this policy describes.

We don't sell or rent your personal information, or share it for advertising.

5. How long we keep it

• Account information is kept while your account is open. When you delete your account, we delete your email address, username, password and play key, your private servers and their data, your favourites and whitelist entries, and your friends, friend requests and shared servers, your profile, play time and game stats, the comments you wrote and received, the messages you sent and received, and the crash reports you sent, straight away. We keep some details only where we have to, for example billing records or records of serious abuse.
• Billing records are kept for as long as tax and accounting law requires.
• Emails you send us are kept as long as we need them to deal with your request and keep a record of it, and then deleted. Ask us to delete them sooner at support@zer0lag.net.
• Server data is deleted when you delete the server, or 10 days after an unpaid free trial ends, as our Terms explain.
• Connection and server logs are kept for a limited time, usually a few weeks, and then deleted or overwritten.
• Crash reports are kept for up to 180 days, or until an administrator deletes them, whichever comes first.
• Login and sign-up rate-limit counters, which use your IP address, are kept only in memory and cleared within an hour.

6. Security

We protect your information with measures such as encrypted connections to the site, one-way hashing of passwords, password reset links that expire after an hour and work only once, logging out your other devices when your password changes, play keys that can only be rebuilt with a secret kept apart from the database, limits on login and password reset attempts, a firewall, and isolated environments for each game server. No system is perfectly secure, so keep your password and play key secret, and tell us straight away if you think your account has been compromised.

7. Your choices

• Play key: you can see it or make a new one anytime on your account page. A new key stops the old one, including in mods you downloaded before, from working.
• Subscription: you can cancel anytime on the Pricing page.
• Servers: you can delete your private servers, and everything they've saved, anytime.
• Deleting your account: use Delete my account on your account page. It takes effect immediately and can't be undone.
• Access and correction: to get a copy of your information or correct it, email support@zer0lag.net from the address on your account. We may need to confirm it's you before we act.

8. Children

Zer0Lag isn't for children under 13, and we don't knowingly collect information from them. Players aged 13 to 17 need a parent's or guardian's permission to use the service. If you think a child under 13 has an account, contact us and we'll delete it.

9. Changes

We'll update this policy when what we collect or how we use it changes, and change the "last updated" date above. If a change is significant, we'll tell you on the site or by email before it takes effect.

10. Contact

Questions or requests about your privacy: support@zer0lag.net.