Privacy Policy

The short version: an email address is the only identity we ask for, we never see your card, our own analytics never store your IP address, and nothing you give us is sold to anyone. We process personal data in line with the EU General Data Protection Regulation (GDPR / DSGVO).

1. Who is responsible for your data

Neckrez is operated by its owner, who is the controller of the personal data described here. For any privacy question, or to use the rights in section 8, write to support@neckrez.tech.

2. What we collect

Account. Your email address and a hash of your password (never the password itself). If you sign in with Google or GitHub, we store the account identifier they return instead of a password. That is the whole account record — we do not ask for your name, postal address, phone number or any identity document. When you sign up we also note the country your IP address resolves to (the address itself is not stored with your account); it is shown on your profile page and to our support team. The lookup is done offline with the DB-IP.com database, so your address is not sent to anyone.

Payments. Crypto top-ups are handled by our payment processor, NOWPayments, so we never see or store card numbers or wallet credentials. We keep the amount, the coin, the payment status and the processor’s payment reference.

Servers. The label you give a server, its region, plan, operating system and the IPv4 address assigned to it. The platform does not inspect or copy what you run or store on your servers.

Support. The messages you send us and any files you attach, kept with your account so the conversation has history.

Security and abuse. Request logs that include IP addresses, and the same addresses used for rate limiting. They let us block attacks and answer abuse reports that identify a server by its address and a timestamp. On the sign-up form we use Google reCAPTCHA to tell people from bots; Google receives your IP address and interaction data for that.

Analytics. Our own: a random identifier kept in your browser tells one visit from another. For each page view we record the page path and title, the referring site, campaign parameters if the link had any, your browser’s user-agent string, how long the page was open, and a salted hash of your IP address — the address itself is not stored. If you are signed in, a visit can be linked to your account. We also use Yandex.Metrika, a third-party analytics service operated by Yandex: it counts visits, sets its own cookies and records how visitors move through and interact with pages (clicks and scrolling).

3. What we do not collect

No identity documents, no selfies, no phone numbers, no home addresses, no card details. There is no identity verification step in signing up or using the service; see our Terms for the narrow cases where the law or our providers could require one.

No advertising networks, no retargeting, and no data sold or shared with advertisers or data brokers. Ever.

4. Why we are allowed to process it

• To provide the service you signed up for — running your account, deploying your servers, billing your balance. Art. 6(1)(b) GDPR, performance of a contract.
• To meet legal obligations — issuing invoices, keeping accounting records, answering lawful requests. Art. 6(1)(c) GDPR.
• For our legitimate interests — keeping the platform secure, preventing abuse, answering abuse reports from our upstream providers, and understanding how the site is used so we can improve it. Art. 6(1)(f) GDPR.

5. Who else sees it

• The cloud provider your server runs on — Vultr (The Constant Company, LLC), DigitalOcean, LLC or Hetzner Online GmbH, depending on what you chose. They receive what is needed to create and run the instance, and they operate their own infrastructure worldwide.
• NOWPayments, which handles the crypto payment and returns its status to us.
• Our email provider, which delivers transactional messages such as password resets and support replies.
• Google, for reCAPTCHA on the sign-up form and, only if you choose it, for signing in with Google. GitHub, only if you choose to sign in with GitHub.
• Yandex, which provides Yandex.Metrika.
• Law enforcement or an upstream provider, where we are legally required to respond or where an abuse report identifies a specific server. We respond to specific, documented requests — not to blanket ones.

6. International transfers

Because servers and providers are located worldwide, data may be processed outside the European Economic Area, including in the United States. Where that happens we rely on appropriate safeguards such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, as applicable.

7. How long we keep it

• Account data: while your account exists. Ask us to delete it and we remove it, except records we are legally required to keep.
• Analytics events: 90 days, after which they are deleted automatically.
• Unpaid top-up invoices: 7 days, after which they are deleted automatically. Completed payments stay as financial history.
• Request logs, including IP addresses: 14 days, after which they are deleted automatically.
• Servers at a zero balance: the disk is snapshotted and the server deleted; the snapshot is kept 7 days, then deleted.
• Invoices and accounting records: for the period accounting law requires, which is longer than the rest and outside our discretion.

8. Your rights

Under the GDPR you can ask us for a copy of your data (Art. 15), to correct it (Art. 16), to delete it (Art. 17), to restrict processing (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where we rely on your consent you can withdraw it at any time (Art. 7(3)). Write to us and we will act on it.

To exercise these rights, email support@neckrez.tech. Some records may be retained where the law requires it.

If you think we have handled your data badly, you can complain to the data-protection supervisory authority where you live or where the alleged infringement took place.

9. Cookies & local storage

Our own site stores only what it needs in your browser: your session token, your language and theme choice, and the random visitor identifier used by our analytics. There are no advertising cookies and no cross-site tracking by us.

The exceptions are the third-party services above: Yandex.Metrika sets its own cookies, and Google reCAPTCHA loads on the sign-up form. The support chat is ours and runs on our own servers.

10. Security

Passwords are hashed with a strong algorithm, transport is encrypted (HTTPS), and provider API secrets are stored server-side only.

11. Children

The Service is not directed to anyone under 18, and we do not knowingly process their data.

12. Changes

If we change what we collect or who we share it with, we update this page and its date.