Privacy Policy

This policy explains information handled by the GameVerse website, hosting, billing, and support services. GameVerse is presented as a PixlFlip Enterprises brand. It describes current service flows, not a certification of compliance or a promise that all connected providers follow identical policies.

1. Information handled

• Accounts: email address, account identifiers, credentials used for registration and login, optional profile names or nickname, and the hosting-panel account identifier. Registration also supplies account-creation information to the hosting panel.
• Linked Discord accounts: Discord user ID, display name, and avatar. Linking uses Discord authorization, including the requested profile/email scopes, to obtain identity information.
• Orders and billing: selected plan, customer email, Stripe customer and subscription identifiers, payment-event information, and associated hosting-server identifiers. Stripe hosts payment collection; our website does not have a payment-card-number or CVC storage field.
• Hosting: server configurations, game files, worlds, console output, and other information you or your server's players place on the hosted service. What a game records depends on its software and your configuration.
• Support: ticket titles, messages, account/service references, status history, staff replies, timestamps, and external message/thread identifiers. Discord attachment links may be preserved in transcript text.
• Technical and security records: request metadata, IP addresses where recorded, errors, API actions and outcomes, and API-key ownership, scope, expiry, and usage metadata. Some operational logs can contain account or contact information.

2. Why information is used

Information supports authentication, account and server provisioning, billing, subscription management, support, linked Discord features, service announcements, troubleshooting, security, and handling disputes or legal obligations. Authorized operators can access relevant service data for those tasks. We use AI-assisted operational tools, including OpenAI-backed assistants, for administration, diagnostics, and support work; information supplied to those tools is processed by their providers. This is not a promise that provider retention is zero or that no human can access a ticket.

3. Providers and other recipients

• Stripe receives checkout/billing information and processes payments and subscription-management sessions.
• Our hosting panel and infrastructure process account and server information to run hosting. Network, proxy, storage, and backup layers may also process request or service data.
• Discord processes linked-account interactions, support channels/messages, announcements, and direct messages. Configured purchase-notification webhooks can receive customer email, subscription/server/plan references, and payment amount/currency. Linked accounts may receive service-announcement DMs; the website does not currently offer a separate announcement-DM preference.
• Email services process messages sent to our published contact address. Automated ticket email, where enabled, also transmits ticket information and can preserve mailbox copies.
• Browser resource providers include Google Fonts, Discord avatar hosting, and, on relevant pages, jsDelivr or externally hosted imagery. Requests expose connection/request information to those providers. The status and panel links open external services with their own policies.
• Operational tool providers process information provided for AI-assisted work as described above. Information may also be disclosed where needed to respond to a valid legal obligation or address abuse or a security incident.

The website does not contain an advertising-data marketplace or a sale-of-personal-information feature. That observation is not a determination that every third-party practice falls outside every jurisdiction's legal definition of “sale” or “sharing.” We do not claim that external providers are anonymous or collect no data.

4. Cookies and browser storage

The website uses an authentication cookie for login and a short-lived state cookie during Discord linking. Login tokens expire after approximately one hour; the Discord state cookie has a ten-minute lifetime. Logging out clears the browser login cookie but does not revoke an already issued token before its expiry. Browser local storage saves the ID of a dismissed announcement under dismissedRibbon; it has no built-in expiry and can be cleared in your browser.

No advertising or analytics script is implemented in the authored website frontend. This does not describe every infrastructure log or external provider. Blocking cookies can prevent login/linking; blocking external resources can change fonts, images, or other features. There is no site-wide consent-preference manager at present.

5. Support visibility and retention

Website support tickets are account-linked and accessible to authorized staff. Mirrored Discord ticket channels are configured for the ticket owner, bot, and staff; Discord server administrators can also have access. They are not end-to-end encrypted private conversations with a single staff member. Closing a ticket can delete its Discord channel while preserving the website transcript; edits or deletions on Discord are not guaranteed to update that stored copy.

See the Data Retention Policy for records that remain after closure, cancellation, or account deletion. We do not currently enforce a uniform automatic age-based purge across accounts, tickets, logs, and external copies.

6. Choices and requests

You can edit supported profile fields and manage Discord linking in your account. Use billing management for subscriptions. To request access, correction, deletion, or an explanation of data use, use support or the email below. We may need proportionate identity verification; do not send passwords. We will assess applicable rights and what records must remain for billing, disputes, security, or legal obligations. If a request cannot be fulfilled in full, the response should explain the limitation. Account deletion is handled by staff, not a self-service erase-everything button.

Rights and response requirements depend on applicable law. This policy does not waive any access, deletion, correction, portability, objection, opt-out, complaint, or appeal right you may have. Clearing browser storage, unlinking Discord, and canceling billing affect different systems and do not each erase all records.

7. Security, location, and children

We use access controls and authentication mechanisms, but no system is risk-free. Do not put passwords, payment-card information, or unnecessary sensitive information into support messages or server logs. We do not promise universal encryption of stored data, a particular certification, or confinement of all data to one country. External services can process data in other locations.

Registration does not collect a birth date or verify age, and no parental-consent workflow is implemented. Do not submit a child's personal information through an account or ticket. If you believe we hold information from a child requiring special protection, contact us so we can investigate and address the applicable requirements. This statement is not a substitute for parental consent where required.

8. Updates

Changes will be reflected in this page's date. A website update does not remove any legally required notice or consent for a new data use.

Resource-configurator test accounts and records

The isolated test deployment uses separate local accounts and an authentication cookie; it does not copy production customer accounts or require a production password or Discord sign-in. Private invitation hashes, expiry and use records support approved test access. We retain immutable game/resource/price snapshots, order and environment identifiers, sandbox subscription references, event IDs, provisioning-job state, and mapped test-server identifiers. Stripe hosts sandbox checkout. A synthetic non-administrator panel identity is created after confirmed test payment; the test user’s password is not sent to the panel. Test pages do not add advertising or analytics storage. These records support safe provisioning, reconciliation and cleanup.

Where reviewed game variants are enabled, the test order also records the selected profile/version, permitted game settings and explicit requirement acknowledgements. Non-secret selections are kept in the builder URL, including through sign-in, and can appear in browser history or copied links. Do not place credentials in ordinary text settings. Secret-designated settings are entered only in authenticated review and submitted with the quote, not placed in builder URLs or local/session storage by the frontend. They are used by the hosting configuration and may be passed to the hosting panel for setup; they are not your website login password.

Paid capacity waits retain requested resources and queue/notification state. Operator email notifications can carry order references, game/profile and resource needs so staff can review capacity. They do not require game secrets. Mailbox copies and delivery records are separate from the order. An email notification is not confirmation that capacity has become available.

Where the TEST capacity-refund rule applies, records also link the verified original payment/invoice, amount and currency, confirmed-payment time, seven-day deadline, cancellation/refund attempts and provider outcomes. These support accurate refunds and prevent duplicates. The signed-in owner sees a limited refund status, verified deadline and amount when available—not provider payment identifiers or raw responses. Status checks pause while the tab is hidden; refund processing runs independently on the service. Refund data is not added to browser URLs or local/session storage by this interface.