Privacy Policy

The controller responsible for data processing on this website is:

GoodFlare IT, proprietor Arne Heidrich, Huthain 1, 09437 Börnichen, Germany.

Email: hello@goodflare.io. For further details, please see our legal notice (Impressum).

With regard to the personal data we process about you, you have in particular the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw a given consent (Art. 7 (3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR), for example with the authority responsible for us, the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Maternistraße 17, 01067 Dresden

Where we process data on the basis of Art. 6 (1) (f) GDPR (legitimate interests), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can send your objection informally to hello@goodflare.io.

When you open the customer area, our web server logs each request: your IP address in shortened form (for IPv4 without the last number, for IPv6 only the first 48 bits), date and time, the method and the requested address without query parameters, the status code, the amount of data transferred, the processing time and the browser identification. We do not store the referring page (referrer). Requests to this website are answered by Cloudflare and do not reach our web server (see “Hosting and Cloudflare”).

We delete the logs after seven days. They are not merged with other data sources. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the technically error-free, stable and secure operation of the website.

This website (goodflare.io) is delivered for us by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Pages). The customer area (my.goodflare.io) and our servers run on our own hardware in Germany, operated by the proprietor himself; Cloudflare sits in front of them as a network: your requests go to Cloudflare first, which forwards them to our servers and fends off attacks such as overload attacks on the way. A copy of our status page (status.goodflare.io) is also kept at Cloudflare, so that it stays reachable when our own systems are disrupted; it sets no cookies, only reads your language and colour scheme settings, and we keep no logs of our own there.

In doing so Cloudflare processes the data every request brings with it: your IP address, date and time, the requested address, the content transferred, the browser identification and other technical details of your request. Your input in the customer area also passes through Cloudflare; the connection is encrypted all the way, but Cloudflare decrypts it on its servers in order to check and forward it. In our Cloudflare account we see aggregated statistics and, for requests that were fended off, their details including the IP address.

Cloudflare works for us as a processor under Art. 28 GDPR, on the basis of Cloudflare's data processing agreement (Customer Data Processing Addendum), which is part of our contract with Cloudflare. Cloudflare usually answers requests from the data centre closest to you, for visitors from Germany mostly in the EU; data may however also be processed in the USA and other countries. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, the data processing agreement contains the European Commission's Standard Contractual Clauses.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in fast and reliable delivery, in protecting our systems and your data against attacks, and in the status page staying reachable during a disruption. More: https://www.cloudflare.com/privacypolicy/

We protect the contact form, the “Report abuse” form, signing in by e-mail link (including the first one, which creates your customer account) and status page subscriptions against spam and automated attacks with Cloudflare Turnstile. Only when you start filling in one of these forms does your browser load Turnstile from challenges.cloudflare.com. Turnstile then checks, usually without you having to do anything, whether a person is using the form; only in doubtful cases does it ask you to tick a box. For this, Cloudflare processes your IP address, the browser identification, technical characteristics of the connection (such as a TLS fingerprint) and signals from your browser that arise during the check. When you send the form, our server sends the result of the check and your IP address to Cloudflare to have it confirmed; only then do we process the form.

For protecting our forms Cloudflare works as our processor (see “Hosting and Cloudflare”, also on where the processing takes place and the transfer to the USA). According to Cloudflare, it also uses this data to improve its bot detection; for that, Cloudflare is itself the controller (https://www.cloudflare.com/turnstile-privacy-policy/). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the forms and the recipients of our e-mails against abuse in bulk. Where Turnstile reads information from your browser, this is strictly necessary for sending the form you asked to send (Section 25(2) No. 2 TDDDG). If you prefer not to use Turnstile, you can reach us by e-mail at hello@goodflare.io; you can also sign in with a passkey.

When you check on the start page whether a domain is still free, the name you typed goes to our customer area and from there over the RDAP query protocol to the registry of that ending (such as DENIC eG for .de, Verisign for .com or the operators of .io, .ch and .dev). Only the domain name is transmitted, not your IP address. We store neither the name nor the result; your IP address is only counted in memory for a few minutes so that the check is not abused in bulk. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing you, at your request, whether the domain is free.

This website does not use tracking or marketing cookies. Technically necessary cookies are set only in the customer area: a session cookie while you are signed in, and a cookie that recognises your cart (30 days). Legal basis is § 25(2) no. 2 TDDDG together with Art. 6(1)(b) GDPR. On the payment pages Stripe sets its own cookies to prevent fraud (see “Payments”). To protect against attacks Cloudflare may set technically necessary cookies, such as __cf_bm to recognise automated access (30 minutes) or cf_clearance after a passed check (see “Hosting and Cloudflare”); the legal basis is Section 25(2) No. 2 TDDDG.

We store your display preferences (light/dark colour scheme and language selection) in your browser’s local storage ("localStorage") and also in one small cookie each, so that the website and the customer area show the same setting. While you are signed in to the customer area we also set a cookie holding a pseudonymous value (no name, no email address), from which the website can tell that your sign-in has changed. These cookies are sent to our servers with page requests, serve only the display and not tracking, and are not passed on to third parties. You can delete them at any time via your browser settings.

Your browser also keeps in its local storage whether you have already seen the website’s short opening animation and which status notices you have closed, and, while you are signed in, the name, e-mail address and customer number of your account, so that the website can show your account in the header without delay. These details stay in your browser; the account details are removed as soon as the website sees that you are signed out.

To display fonts consistently, this website uses locally hosted fonts. The font files are served with the website itself; no connection to third-party servers (such as Google Fonts) takes place, and no personal data is transmitted to third parties as a result.

If you contact us by email, through the contact form or through a ticket in the customer area, your details, the message and attached files are stored by us to handle the request and any follow-up questions. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual or contractual communication) or Art. 6 (1) (f) GDPR (handling of enquiries). Files uploaded in the contact form that are not sent with an enquiry are deleted after one day at the latest.

How we process notices of illegal content sent through the “Report abuse” form or by e-mail is described below under “Notices of illegal content”.

For orders and managing your servers we create a customer account. We store your e-mail address, your name and, if given, company, VAT ID and billing address, as well as your orders, invoices, servers and tickets. You sign in with a link sent by e-mail or with a passkey; we store no password. If you set up a second factor (authenticator app), we store its secret key encrypted. For security we store the IP address and browser of every sign-in, which you can see and end under “Signed-in devices”; a sign-in stays valid for up to 30 days after it was last used. So that we can warn you by e-mail about a sign-in from a new device, the second factor being turned on or off, new passkeys or API tokens, new team members and a changed e-mail address, we keep for 90 days, for every sign-in, the kind of browser and operating system (such as “Chrome · Linux”) and the network it came from (for IPv4 the first three numbers, for IPv6 the first 48 bits, never the full address). Legal basis is Art. 6(1)(f) GDPR (our and your interest in noticing access to your account by others).

Of passkeys we store only the public key, of SFTP and SSH keys you add only the public part. API keys are stored only as a hash with their last four characters, together with when and from which IP address a key was last used, so that you can spot misuse. You can delete any key in your account at any time.

Where offered and chosen by you, you can also sign in with a Google or Discord account; the provider then learns that you are signing in with us and passes us your e-mail address and name.

Legal basis is Art. 6(1)(b) GDPR (contract) and, for billing data, Art. 6(1)(c) GDPR together with the retention duties under tax law (eight years, see “Storage periods”).

You can give other people access to your account: to your servers, to your invoices, or to both. You enter the person’s e-mail address and we send them an invitation by e-mail. In your account you see the name and e-mail address of the people you invited and a log of who invited, accepted, declined, changed rights or removed whom, and what members did with your billing (such as topping up the balance). What members do on a server is in that server’s activity log under their name. Members with access to billing see your invoices, payment methods and balance.

The legal basis is Art. 6(1)(b) GDPR for you and Art. 6(1)(f) GDPR for the people you invite; the legitimate interest is that you as the account holder can see who changed what in your account. When you remove a member, their access ends at once; the log stays as long as your account exists.

Under “Account” you can delete your customer account once no contracts are running and nothing is outstanding. We then delete everything about you: name, e-mail address, the billing address in the account, the profile picture setting, sessions, passkeys, the second factor, linked Google or Discord accounts, API, SFTP and SSH keys, notifications, your team, your firewalls, address lists and private networks, and orders that were never paid and have no invoice. What we must keep by law stays until the end of its period (see “Storage periods”): invoices, credit notes and payment records with the address printed on them, cancellations, withdrawals and tickets, together with your customer number so that these records can still be found. We confirm the deletion by e-mail.

You can download a copy of the data we hold about your customer account (Art. 15 and 20 GDPR) yourself at any time under “Account → My data”: a ZIP file with a machine-readable JSON file (profile, billing address, orders and consents, invoices, servers and services, tickets with their messages, sign-ins and security events, team, API tokens without the token itself, payment methods with their kind and last digits, balance, preferences) and an explanation. Credentials such as sessions, passwords or keys and our staff’s internal notes are not included. Before the download you briefly confirm that it is you; afterwards we send you an e-mail. You download the contents of your game servers with “Export everything”. On request by e-mail to hello@goodflare.io you can also receive the copy from us.

Before paying, you make one declaration by ticking a box, without which an order is not possible: that you agree to the terms and conditions applying, that you expressly request that we begin the service before the withdrawal period ends, that you know you lose your right of withdrawal once the service has been fully performed, and that until then you can withdraw within 14 days and pay only for the time already used. We store the wording of this declaration as you were shown it, the time, and the version of the terms and of the withdrawal policy you accept with it, with every order, so that what you declared, and when, remains provable. This privacy policy is linked next to the box; it is information and not part of the declaration, so you neither agree to it nor confirm having read it.

Legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR; our legitimate interest is being able to prove the content of the contract and the start of the service in a dispute. We keep this record with the order, that is for eight years (see “Storage periods”).

Payments are processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). You enter your payment details (e.g. card number or IBAN) directly into a form provided by Stripe; they never reach our servers. We receive only the type of payment method, its last four digits and expiry date, so you can recognise it in the customer area.

So that renewals of your servers are paid automatically, Stripe stores the payment method with your consent for future payments; you can change or remove it at any time under “Account → Payment method”. Stripe also processes data to prevent fraud and may transfer it to third countries (in particular the USA) on the basis of the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. Legal basis is Art. 6(1)(b) GDPR. More: https://stripe.com/privacy

When you type your billing address, the customer area suggests matching addresses. For this our server, not your browser, asks the Photon service, run by komoot GmbH [address to be checked] on the basis of OpenStreetMap. Only the text you typed is transmitted, neither your IP address nor your name. We do not store the suggestions; only the address you submit becomes part of your account. Legal basis is Art. 6(1)(b) GDPR.

On the “Withdraw from contract” page (goodflare.io/withdraw) you can withdraw from a contract, signed in or not. We process your name, your e-mail address, which contract you are withdrawing from (order or invoice number, server, or the description you enter) and the time your declaration reached us. If you are signed in, we link the declaration to your customer account.

We use this information to handle the withdrawal, unwind the contract and confirm receipt of your declaration to you by e-mail without delay. Legal basis is Art. 6(1)(c) GDPR together with § 356a BGB (the duty to confirm receipt) and Art. 6(1)(b) GDPR (unwinding the contract).

The confirmation of receipt is sent through our e-mail provider (see “E-mail”); any refund goes back through the order's payment method (see “Payments”). There are no other recipients. We keep the declaration for six years (see “Storage periods”).

As your profile picture we show your initials in the customer area and, while you are signed in, in the website’s header. They are made from your name in your browser; nothing is sent to third parties.

Only if you expressly choose “Gravatar” under “Account → Profile picture” does your browser load your picture from Gravatar instead (Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA). On every page that shows the picture, your IP address and a hash of your e-mail address are then transmitted to Automattic in the USA. [Basis of the transfer to the USA to be checked, such as Automattic’s certification under the EU-US Data Privacy Framework.] If there is no picture for your address, we show your initials and do not ask again in that browser tab for up to a day.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by choosing “Initials” again under “Account → Profile picture”; your browser then no longer connects to Gravatar.

When you manage players on one of your servers, the customer area shows their names and pictures. For this our server, not your browser, looks up the players’ public profile data: for Minecraft at Mojang (Mojang AB, Sweden, a Microsoft Corporation company), for Valheim at Steam (Valve Corporation, USA). Only the player ID or profile name you enter or the server reports is transmitted, no data about you. We cache the answers for up to six hours. Legal basis is Art. 6(1)(b) GDPR for your server’s management features and Art. 6(1)(f) GDPR for the players’ profile data; our legitimate interest is showing players recognisably.

So that you, and anyone you share a server with, can see who changed what and when, we log actions on your servers: power, settings, backups, console commands, SFTP logins and files uploaded, changed or deleted. This includes the time, who acted and, for SFTP logins and file changes, the IP address. People you share a server with see no other person's e-mail or IP address. The entries reported by the game server (SFTP, files, console) are deleted after 90 days, and at once when the server is deleted. The legal basis is Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (our and your legitimate interest in tracing changes and detecting misuse).

In your server's console you can share the log shown there as a link, for example for a support request. Only when you explicitly confirm this do we store the text and make it readable at a random address to anyone who has the link. Before that we remove IP addresses, passwords, access keys and user names in file paths; other content, such as player names, remains readable. Search engines are excluded. The log is deleted after 90 days, and you can delete it earlier at any time. The legal basis is Art. 6(1)(a) GDPR (your consent by confirming) or Art. 6(1)(b) GDPR.

Data you store on your game servers, VPS or websites, such as data of your players or visitors, is processed by us only on your behalf. You are the controller of that data; the details are set out in our data processing agreement under Art. 28 GDPR (goodflare.io/dpa).

Backups of your game servers, bots and websites, whether you make them, a schedule does or they are a safety copy before a risky change, contain all of the server's files. They are currently kept on the server node your server runs on, that is on our own systems; VPS and containers have snapshots on the server's storage. Where a server's backups are kept is shown in its Backups or Snapshots tab under “Storage”.

We delete safety copies after seven days. Other backups stay until you delete them or a schedule replaces the oldest. When the contract ends we delete all of the server's backups 30 days later, and at once when you delete your customer account. The section on processing on behalf above applies to their contents. The legal basis is Art. 6(1)(b) GDPR (contract).

When you visit a website hosted with us, our front web server logs the request: IP address, time, method and requested address, status code, bytes transferred, processing time, referrer, user agent and the other request headers except cookies and credentials. If the website sits behind Cloudflare, the IP address Cloudflare passes on counts as yours, but only for requests from Cloudflare’s published address ranges. The website’s operator is the controller; we process this data on the operator’s behalf, for delivery, troubleshooting, defence against attacks and the operator’s statistics.

We delete the raw logs after seven days. For the operator’s statistics (“Zugriffe & Fehler”, traffic and errors) we count hourly figures from them: requests, page views, visits, status codes, bytes and response times, the pages requested without query parameters, the referring website only as a name (such as “Google”), the country and the name of known programs such as search engines. The country is derived from the IP address while counting, using a database on our own server (DB-IP); nothing is transmitted to third parties. Visits are counted by a hash of IP address and user agent whose random value changes daily. Hashes and the random value are held in memory only and deleted after two days at the latest, so nobody is recognised across days. The hourly figures contain neither IP addresses nor hashes and are kept as long as the website exists. No cookies or scripts are used for this. How the operator itself handles your data is described in its privacy policy.

When you add a domain, we store its name, its DNS provider, the records you change through us and an activity log of these changes. To check whether records are publicly visible, our server queries the public DNS resolvers of Cloudflare (1.1.1.1) and Quad9 (9.9.9.9); only domain names and record types are sent.

If you connect a domain on Cloudflare, you save an access token from your Cloudflare account. We store it encrypted with AES-256-GCM, show only its last four characters and use it solely to read and write records of that zone at your request. You can remove it at any time; if the domain moves away from Cloudflare, we delete it automatically. Cloudflare processes these requests under your own contract with Cloudflare.

Legal basis is Art. 6(1)(b) GDPR.

If you register a domain through us, we pass the registrant data (name or company, address, e-mail address, phone number) to our registrar INWX GmbH, Berlin, and to the responsible registry, such as DENIC eG in Frankfurt am Main for .de or EURid in Belgium for .eu. The registries are controllers in their own right for this and may verify the data; DENIC publishes data of legal persons in its Whois, not of natural persons.

For extensions whose registry is outside the EU, the data is transferred there on the basis of an adequacy decision of the EU Commission or, where there is none, because the transfer is necessary for the registration you asked for (Art. 49(1)(b) GDPR).

Legal basis is Art. 6(1)(b) GDPR and, where registries are obliged to collect and verify data, Art. 6(1)(c) GDPR together with §§ 49 and 50 BSIG.

If you report content to us under Art. 16 DSA, we process your name, e-mail address, the content of the notice and the addresses given, to assess the notice, confirm receipt, inform you of our decision and document the case. Legal basis is Art. 6(1)(c) GDPR together with Art. 16 and 17 DSA. We share your identity with the affected customer only where strictly necessary for the statement of reasons. If there is a suspicion of a crime against life or safety, we pass the necessary details to law enforcement (Art. 18 DSA). We do not store your IP address in doing so; to keep the form from being abused in bulk, we count requests per address in memory for a few minutes only.

The proprietor, Arne Heidrich, reads and reviews every notice personally. We use no AI services or other automated means for this.

We keep the records of a notice until the case is closed and then as long as needed to establish, exercise or defend legal claims, as a rule until the end of the regular limitation period of three years (§§ 195, 199 BGB).

If you switch it on in the customer area, we also send notices about your servers and invoices to a Discord webhook you provide, or via WhatsApp to your verified phone number. Neither happens without your consent.

For WhatsApp we use the WhatsApp Business Platform of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. Your phone number and the content of each message are transmitted. Meta may also transfer data to third countries on the basis of the EU Commission's standard contractual clauses. Discord messages go to Discord Inc., USA.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the customer area or end it by replying "STOP" on WhatsApp; we then delete your number from this service.

If you switch on browser notifications in your account, your browser creates a receiving address at its maker’s push service (such as Google, Mozilla, Apple or Microsoft). We store this address and its keys encrypted, with a name for the device (such as “Chrome on Windows”), and send our notices through that service. The content is end-to-end encrypted; the push service only sees that a message goes to your browser.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in your account or in your browser’s settings. We delete the receiving address when you remove the device in your account or when the push service reports that it no longer exists.

You can subscribe to the status page without a customer account. By e-mail we store your e-mail address; the subscription only takes effect once you click the link in our confirmation e-mail, and we delete unconfirmed sign-ups after 48 hours. For Discord or Slack we store the webhook address you give; the messages are then processed by Discord or Slack as the operator of your channel. We do not store your IP address.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time through the link in every message; we then delete the subscription and its delivery log.

Our mailboxes (such as hello@goodflare.io) are run for us by Zoho Mail of Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, as a processor under Art. 28 GDPR. When you e-mail us or we answer you, the messages with your details are stored there, in data centres in the EU. According to Zoho’s privacy policy, data may also be transferred within the Zoho group to countries outside the EU, for example for operation and support, on the basis of the EU Commission’s standard contractual clauses. The legal basis is Art. 6(1)(b) GDPR (pre-contractual and contractual communication) or Art. 6(1)(f) GDPR (handling of enquiries).

Sign-in links, order confirmations, confirmations of receipt for withdrawals and invoice and ticket notifications are sent automatically by the customer area through our e-mail provider. [Provider for sending the automatic e-mails still to be chosen and named here with its address and the data processing agreement under Art. 28 GDPR.] Legal basis is Art. 6(1)(b) GDPR.

So that nothing is lost in an outage, we back up the customer area’s database every hour, with all data stored in it, and the uploaded files (such as ticket attachments) once a day. The backups are kept on our own systems; we use no external storage service for them.

We keep the hourly backups for 48 hours, the daily ones for 14 days and the weekly ones for eight weeks. Data we delete therefore also disappears from the backups after nine weeks at the latest. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure operation without data loss (Art. 32 GDPR).

We make no automated individual decisions, including profiling (Art. 22 GDPR). Stripe checks payments automatically for fraud risks and may decline a payment in doing so (see “Payments”); you can then repeat the payment with another payment method or contact us. [For a lawyer to confirm: whether Stripe’s fraud screening needs to be described in more detail here.]

We store data only as long as its purpose requires or the law demands. Periods in years run from the end of the calendar year in which the record was made; after that we delete it.

• Invoices, credit notes, payment records and the orders an invoice was written for, with your declarations at checkout and the version of the terms and of the withdrawal policy: eight years (§ 147 AO, § 14b UStG). Orders that were never paid and have no invoice are deleted with your customer account.
• Cancellations and withdrawals: six years (§ 147 AO, business letters).
• Tickets: three years after the end of the year of their last message, the regular limitation period (§§ 195, 199 BGB). [For a lawyer to confirm: whether tickets that prepare or perform a contract must be kept for six years as business letters.]
• Notices of illegal content: until the case is closed and then as a rule three years (see there).
• Your customer account: until you delete it; after that only the records listed above remain.
• Data of an ended server, including its backups: 30 days after the end of the contract.
• Safety copies before risky changes to a server: seven days.
• Sign-ins: up to 30 days after they were last used; the browser kind and network of sign-ins for the warnings 90 days. The record of sign-ins and your servers’ activity log in the customer area: [period to be set]; the entries reported by the game server 90 days.
• Server log files of our website and the customer area: seven days; raw logs of our customers’ websites: seven days.
• Shared server logs: 90 days, unless you delete them sooner.
• Status page subscriptions and browser notifications: until you end them; unconfirmed status page sign-ups 48 hours.
• Backups of our database: nine weeks at most.

For security reasons and to protect the transmission of confidential content, this site uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser’s address bar.

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The new privacy policy will then apply to your next visit.