Privacy Policy

Last updated: May 25, 2026

This policy explains what data Refuge Game Hosting ("RGH") collects, why, and what we do with it. Short version: we collect only what we need to run the service.

1. What we collect

Steam identity. Your 64-bit Steam ID + your public Steam persona name and avatar. Provided by Steam during sign-in. We never see your Steam password.
Optional profile. A display name and contact email you provide on the account page.
Billing data. Stripe-issued customer ID + subscription IDs. Your card number, billing address, and tax info live with Stripe — we never store or see them.
Server state. Which game/tier you rented, the panel instance ID, ports allocated, and timestamps. Required to actually provide the service.
Operational logs. Web request logs (IP, user-agent, timestamps) and panel logs (status changes, RCON commands you issue, file uploads). Retained for up to 30 days for debugging + abuse detection.
Cookies. One first-party session cookie (rgh_session) so you stay signed in. No third-party tracking, no analytics, no ads.

2. How we use it

To run the service: authenticate you, provision and manage your servers, bill you through Stripe, send transactional emails (server-down alerts if you opt in), and respond to support requests.

We do not sell your data. We do not share it with advertisers or data brokers. We do not use it to train AI models.

3. Who we share with

Stripe — billing. Their privacy policy: stripe.com/privacy.
Valve / Steam — we redirect you to Steam for sign-in and read back the public ID + persona. Their policy: steampowered.com/privacy_agreement.
Our infrastructure providers — the VPS + LAN hardware where servers and databases live. They host the bytes; they don't access them.
Law enforcement — only when compelled by a valid legal process or to protect the safety of others. We will tell you about a legal request unless prohibited.

4. Your server's player data

Game servers you rent collect data about their players (Steam IDs of who connects, chat logs, in-game positions, etc.). That data is yours — you control it via the panel. If you operate a public server you are responsible for telling your players how you use their data.

5. Retention

Account data — kept while you have an account. Deleted on request (see below).
Cancelled subscriptions — server files retained 30 days for resubscription, then deleted.
Logs — up to 30 days.
Billing records — retained 7 years to meet US tax-reporting requirements.

6. Your rights

You can request export or deletion of your account data at any time by emailing support@refugegaming.org from the email associated with your account (or proving Steam ownership). We honour deletion requests within 30 days, subject to legal retention requirements above.

If you're in the EU/UK you have additional rights under GDPR (access, rectification, portability, objection); the same email is the channel.

7. Security

Sessions use signed HMAC cookies. All traffic is over HTTPS. Stripe handles card data behind PCI-DSS Level 1 controls. Server passwords you set are stored in our database; we recommend they be unique to RGH.

If we discover a security incident affecting your data we'll notify you within 72 hours.

8. Children

The service is not directed at children under 13. We don't knowingly collect data from anyone under 13. If you believe a child has provided data to us, contact us and we'll delete it.

9. Changes

We'll update this policy when our practices change. The "Last updated" date at the top reflects the current version.

10. Contact

Privacy questions: support@refugegaming.org.