Legal

Privacy Policy

Version 1.0 · Last updated 5 October 2026

1. In short

Plany processes two broad kinds of information. First, we are a controller of information about Customer accounts and people who interact directly with Plany. Second, when Customers use Plany to run games, we are generally their processor of Player and Customer Content. We use information to provide and secure Plany, operate accounts, process payments, provide support and prevent abuse. Some processing uses service providers outside the UK and EEA, including US-based providers, and we use appropriate transfer mechanisms where required.

2. Who is responsible

For controller processing described in this Privacy Policy, that entity is the controller.

Privacy contact:

privacy@plany.cloud

3. Who this policy covers

This Privacy Policy applies to people who:

  • create or use a Plany account;
  • work for or with a Customer;
  • contact Plany Support;
  • visit Plany's websites or documentation;
  • interact with Plany directly; or
  • are Players whose information Plany processes on behalf of a Customer, to the extent Plany has obligations to provide privacy information directly.

For Player data processed on behalf of a Customer, the Customer is generally the controller and Plany is the processor.

4. Information we collect

Account information

We may process:

  • email address;
  • name;
  • password hash;
  • account membership;
  • project membership;
  • roles;
  • API keys in hashed form;
  • plan information; and
  • billing history.

Card information is provided to Stripe rather than stored by Plany.

Sign-in and security information

For each sign-in device, we process:

  • IP address; and
  • user agent.

We use this information, among other things, to send new-device security emails.

Audit logs

We maintain an audit log of account changes, including:

  • who made the change;
  • what changed;
  • when it changed;
  • source IP address; and
  • user agent.

Passwords and other secrets are removed before an audit entry is stored.

The audit log is append-only and hash-chained. Changing or deleting one entry breaks the chain of subsequent entries.

The intended retention period for these audit logs is 90 days.

Rate limiting

We may process IP addresses for rate limiting and abuse prevention.

Email

We send service and security emails.

You can turn off categories of non-essential email where the relevant preference exists.

Security emails cannot be switched off.

Error and telemetry data

Error and operational telemetry may be processed through:

  • Sentry;
  • Plany's Loki logging system; and
  • Plany's Prometheus monitoring system.

Telemetry may contain identifiers and IP addresses.

Cookies

The Plany console uses httpOnly session cookies.

We do not use marketing analytics or advertising trackers on the console.

5. Customer Content

When you use Plany to host content, Plany generally processes that content as your processor.

Customer Content may include:

  • game server disks;
  • game worlds;
  • uploaded builds;
  • container images;
  • Schematics;
  • hibernation snapshots;
  • game server logs;
  • terminal $HOME archives;
  • secrets;
  • Relay messages; and
  • database connection information.

A hibernation snapshot is a full image of guest RAM and may contain personal information or secrets present in memory at the time.

Secrets

Secrets are encrypted at rest using AES-256-GCM.

Game server logs

Plany collects and retains game server console output.

Logs may contain:

  • Player names;
  • Player IDs;
  • chat;
  • IP addresses; and
  • other information generated by the Customer's game.

The stated retention period is 365 days.

Customers can access their own logs.

Terminal data

Terminal $HOME archives are deleted 30 days after the terminal was last opened.

Two warning emails are sent before deletion.

Relay

Relay messages may contain Player chat and party data.

The payload is encrypted before it reaches the message broker.

The Customer chooses retention for each channel, including an option for the data not to be kept.

LeaderboardDB

LeaderboardDB connection strings to a Customer's own production database are encrypted and are not returned through the API.

6. Player information

Where a Customer operates a game on Plany, Plany may process:

  • Player identifiers such as Minecraft UUIDs and SteamIDs;
  • game-server session records;
  • server and region information;
  • join and leave times;
  • IP addresses and ports;
  • inferred links between an IP address and a named Player;
  • Passport provider account IDs and profile names;
  • GameDB statistics and change history; and
  • Relay messages.

An IP address may be used to associate a connection with a named Player. This is an inference and can be wrong.

Passport

If a Player links a Microsoft or Steam account through Passport, Plany receives and stores the provider account ID and profile name.

Access and refresh tokens are discarded immediately.

Unlinked identities are retained as history.

Deleting a Player removes the Passport identity associated with that Player.

GameDB

GameDB can store per-Player statistics and a record of which Player caused each change.

The Customer can instruct Plany to revert or purge that data.

7. Children's data

Customers may operate games played by children.

Customers are responsible for determining the lawful basis and appropriate notices, permissions and safeguards for their processing of Player data.

Customers must comply with laws applicable to children, including, where relevant:

  • COPPA;
  • the UK GDPR;
  • the UK Data Protection Act 2018;
  • the UK Age Appropriate Design Code; and
  • applicable EU or national children's privacy requirements.

Plany does not generally have a direct relationship with Players merely because they play a Customer's game.

Encore and Passport may create a direct relationship with a Player. Those products have additional terms and notices.

8. How we use account information

We use account information to:

  • provide the Services;
  • authenticate accounts;
  • administer plans and Credit;
  • process payments;
  • provide Support;
  • send security and service notifications;
  • prevent fraud and abuse;
  • maintain platform security;
  • investigate incidents;
  • enforce our Terms;
  • comply with law; and
  • maintain records necessary for our business.

9. Lawful bases

For controller processing, our lawful bases may include:

Contract

Where processing is necessary to provide the Services or manage the Customer relationship.

Legitimate interests

For purposes such as:

  • security;
  • fraud prevention;
  • abuse prevention;
  • maintaining platform reliability;
  • protecting Customers and Plany; and
  • operating and improving security systems.

We will only rely on legitimate interests where the processing is necessary and our interests are not overridden by the individual's rights and freedoms.

Where processing is necessary to comply with a legal obligation.

Where we specifically ask for consent and applicable law requires or permits consent as the lawful basis.

10. Audit logs and individual rights

Our security audit logs may contain personal data.

We retain them for 90 days because they help us investigate account compromise, fraud, abuse and security incidents.

Because the audit log is append-only and hash-chained, changing or removing one historical entry may make later entries cryptographically inconsistent.

If a person exercises a right of rectification or erasure, Plany will assess the request under applicable data protection law.

Where lawful, we may preserve an audit record as evidence of what actually happened while correcting or annotating the relevant information rather than rewriting history.

11. Log learning using AI

When Plany encounters a game's logs for the first time, it may send a small sample of log lines to Anthropic once for each log-line format.

The purpose is to help Plany identify patterns that indicate events such as Players joining or leaving.

The resulting pattern is validated before it is used.

The sample may contain Player names, Player IDs or IP addresses.

This processing is disclosed because the data may contain personal information.

12. Guardian abuse detection

Plany operates an abuse-detection system called Guardian.

Guardian monitors workload signals including:

  • CPU activity;
  • network activity;
  • disk activity; and
  • Player activity.

The purpose is to identify suspected cryptocurrency mining and related abuse.

Guardian does not itself impose an enforcement action.

A person reviews each finding before Plany takes enforcement action.

13. Automated quota approval

Plany may automatically approve certain quota-increase requests.

This system can only grant an increase.

It cannot automatically refuse a request.

Where a request is refused, a person makes the refusal and provides a reason.

14. Internal operations assistant

Plany uses an internal AI-based operations assistant provided by Anthropic.

It can read platform logs and metrics to help Plany staff investigate operational issues.

It has read-only access.

15. Support

Support cases and attachments are stored by Plany.

Support content is also displayed to Plany staff in a private Discord forum.

Discord is therefore used as a processor for support case content.

Support staff may see the Customer's:

  • account;
  • plan;
  • Credit balance;
  • named resource state; and
  • recent logs,

when needed to handle a case.

Staff respond under a case-specific pseudonym. Their real identity is recorded internally.

16. Sub-processors

Plany uses service providers to process personal information.

Our intended sub-processors include:

Sub-processor Purpose Location
Amazon Web Services Hosting, storage and SES email UK (London); container images may pass through CloudFront edge locations worldwide
Stripe Payments and potentially merchant-of-record services US
Anthropic Log-pattern learning and internal operations assistant US
Discord Support case handling US
Sentry Error monitoring EU (Germany)
Microsoft Passport Geographically nearest datacenter
Valve/Steam Passport and Steam-related features US

GitHub is used for source code, CI and staff sign-in and is not intended to receive Customer data.

Tailscale and 1Password are internal tools and are not intended to receive Customer data.

The Plany status page is self-hosted OpenStatus and is not intended to receive Customer data.

17. International transfers

Some service providers process information outside the UK or EEA.

Where a transfer is legally restricted, Plany will use a legally recognised transfer mechanism and appropriate safeguards.

These may include:

  • an adequacy decision;
  • the UK International Data Transfer Agreement;
  • the UK Addendum to the EU Standard Contractual Clauses; or
  • EU Standard Contractual Clauses,

as appropriate to the transfer.

18. Security

We use technical and organisational measures designed to protect information.

These include:

  • hardware-isolated microVMs for Customer workloads;
  • encryption of Secrets at rest;
  • encryption of LeaderboardDB credentials at rest;
  • encryption of Relay payloads at rest;
  • Argon2id password hashing;
  • access controls; and
  • audit logging.

We do not claim that any system is completely secure.

We will notify affected parties where required by applicable law.

19. Retention

Our stated retention periods include:

Data Retention
Security audit log 90 days
Game server logs 365 days
Terminal $HOME archives 30 days after terminal last opened
Inactive workloads after Credit reaches zero 90 days
Purchased Credit Expires after 1 year
Monthly plan Credit Expires at end of relevant month

Other data may be retained for different periods where necessary for legal, accounting, security or operational purposes.

20. Your rights

Depending on the applicable law and circumstances, you may have rights including:

  • access;
  • rectification;
  • erasure;
  • restriction;
  • objection;
  • data portability;
  • withdrawal of consent where consent is the lawful basis; and
  • rights relating to automated decision-making.

To exercise rights relating to account data, contact privacy@plany.cloud.

Where Plany processes Player data as a processor, you should normally contact the relevant Customer, because that Customer is the controller.

21. Complaints

UK individuals may complain to the Information Commissioner's Office.

EU individuals may complain to their relevant supervisory authority.

22. California

If the California Consumer Privacy Act, as amended by the CPRA, applies to Plany's processing, California residents may have rights including rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information and receive equal treatment.

Plany does not sell personal information for money.

We do not use advertising trackers on the Plany console.

Where Plany processes Player information solely on behalf of a Customer, the Customer may be the relevant CCPA business and Plany may act as its service provider/contractor.

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

For material changes, we will normally provide at least 30 days' notice.

The latest version will be published at plany.cloud/privacy.

Version: 1.0 Last updated: 5 October 2026

1. Purpose

This Data Processing Addendum ("DPA") applies where a Customer is a controller of personal data and Plany processes that personal data as the Customer's processor.

This DPA forms part of the Plany Terms of Service.

2. Roles

For Customer Content and Player personal data processed through the Services:

  • the Customer is the Controller; and
  • Plany is the Processor.

The Customer determines why and how the personal data is processed.

Plany processes that data to provide the Services, in accordance with the Customer's documented instructions and this DPA.

3. Subject matter and duration

The subject matter is Plany's provision of cloud infrastructure and related Services.

Processing begins when the relevant data is provided to Plany and continues for the duration of the Customer's use of the relevant Services, followed by the applicable deletion or retention period.

4. Nature and purpose

Processing may include:

  • hosting;
  • storage;
  • transmission;
  • execution of Customer code;
  • autoscaling;
  • logging;
  • networking;
  • backups and snapshots;
  • authentication;
  • support;
  • security monitoring;
  • abuse prevention;
  • troubleshooting;
  • AI-assisted log pattern detection;
  • operational monitoring; and
  • other processing necessary to provide the Services.

5. Types of personal data

Depending on the Services used, personal data may include:

  • names;
  • email addresses;
  • Player identifiers;
  • IP addresses;
  • ports;
  • user agents;
  • chat messages;
  • game logs;
  • session information;
  • account-provider identifiers;
  • profile names;
  • game statistics;
  • connection records;
  • content in Customer files;
  • information in RAM snapshots;
  • support communications; and
  • any other personal data a Customer chooses to process through Plany.

6. Categories of data subjects

Data subjects may include:

  • Customer personnel;
  • Customer account holders;
  • Players;
  • Players' friends or party members;
  • support users; and
  • other people whose data appears in Customer Content.

7. Customer instructions

Plany will process personal data only:

  1. to provide the Services;
  2. on the Customer's documented instructions;
  3. as necessary to comply with applicable law; or
  4. as otherwise expressly permitted by this DPA.

If Plany is required by law to process personal data other than on the Customer's instructions, Plany will, where legally permitted, inform the Customer before carrying out that processing.

8. Confidentiality

Plany will ensure that people authorised to process Customer personal data are subject to appropriate confidentiality obligations.

9. Security

Plany will implement appropriate technical and organisational measures appropriate to the risks of processing.

These include the security measures described in the Privacy Policy and Terms.

10. Sub-processors

The Customer gives Plany general authorisation to use the sub-processors listed below.

Sub-processor Processing Location
Amazon Web Services Hosting, storage, compute and SES UK (London); container images may pass through CloudFront edge locations worldwide
Stripe Payment-related processing US
Anthropic Log-pattern learning and internal operations assistance US
Discord Support case content US
Sentry Error monitoring EU (Germany)
Microsoft Passport Nearest datacenter
Valve/Steam Passport / Steam features US

GitHub, Tailscale and 1Password are not intended to receive Customer personal data and are not listed as Customer-data sub-processors on that basis.

Plany will provide notice of intended changes to the sub-processor list.

11. International transfers

Where Plany or a sub-processor transfers personal data outside the UK or EEA in circumstances requiring a transfer mechanism, the parties will use the applicable lawful transfer mechanism.

The relevant transfer mechanism will be documented in Plany's transfer records.

12. Assistance with data-subject rights

Taking account of the nature of the processing, Plany will provide reasonable assistance to the Customer in responding to requests from data subjects exercising their applicable rights.

The Customer remains responsible for responding to the data subject.

13. Assistance with security obligations

Plany will provide reasonable assistance with the Customer's obligations concerning:

  • security;
  • breach response;
  • impact assessments; and
  • consultation with regulators,

taking into account the nature of the processing and information available to Plany.

14. Personal-data incidents

Plany will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer personal data.

Nothing in this DPA promises a breach-notification period shorter than applicable law unless expressly inserted here.

15. Audits

Plany will make information reasonably necessary to demonstrate compliance with applicable processor obligations available to the Customer.

16. Return and deletion

At the end of the Services, Plany will delete or return Customer personal data as instructed by the Customer, unless applicable law requires continued retention.

Where Plany's ordinary retention periods apply, data may remain subject to those periods before deletion.

17. Customer responsibilities

The Customer must:

  • determine the purposes and means of processing;
  • provide lawful instructions;
  • provide appropriate privacy notices;
  • establish an appropriate lawful basis;
  • comply with applicable children's privacy laws;
  • comply with applicable game and platform rules;
  • ensure its instructions are lawful; and
  • respond to Player/data-subject requests.

18. Children

Where Customer Services are likely to be accessed by children, the Customer must assess and comply with applicable children's privacy requirements.

The Customer must not instruct Plany to process children's data unlawfully.

19. AI processing

The Customer authorises the processing described in the Services and Privacy Policy, including:

  • limited log samples sent to Anthropic for log-pattern learning; and
  • platform logs and metrics made available to Plany's internal operations assistant.

20. CCPA

Where the Customer is a business subject to the CCPA and Plany acts as its service provider or contractor, Plany will process personal information only for the permitted purposes and in accordance with the Customer's instructions.

Plany will not sell or share Customer personal information for cross-context behavioural advertising.

The parties will include any additional CCPA contractual language required for the applicable relationship.

21. Conflict

If this DPA conflicts with the Terms regarding processing of personal data, this DPA controls to the extent of that conflict.