Privacy Policy · HaxxOGE

Last updated 2 September 2026

1. Who is responsible for your data

HaxxOGE is operated by Katherine Works, LLC, a Pennsylvania limited liability company, trading as Haxx ("we", "us"). Katherine Works, LLC is the data controller for your account: the party that decides what is collected about you and why, and the party you can hold to this policy.

Anything about this page, and any request under it, goes to [email protected]. There is no data protection officer; the owner reads that address.

2. Your data and your players' data are not the same thing

• Your account is ours to answer for. Your name, your email address, a company name if you gave one, your billing records and your support requests. We decide what is collected and why, so we are the controller of it, and the rest of this page describes what we do with it.
• Your players are yours to answer for. Your game runs on an instance we operate, so your players' data sits on our hardware, but you decide what your game collects and why. You are the controller of it and we are your processor: we hold it and act on it to run, back up, restore and support your instance, on your instructions, and for nothing else.

We do not sell any of it, we do not mine your players' data, and we do not use it to build or train anything of our own. Your players' agreement is with you, and the privacy notice they read is yours to write.

There is no separate data processing agreement today: the Terms and this page are the written instructions we work to. If your own obligations need a standalone one, ask us before you rely on it.

3. What we collect about you

• Account: your email address, your name, and a company name if you gave one. Your password is kept only as a hash, never in a form anybody here can read back.
• Billing: what you subscribed to, what you bought, and Stripe's customer and subscription identifiers. We never see or store your card number. Card details are entered on Stripe's own pages and never reach our servers.
• Your games: the name and hostname of each game, its hosting tier, its license key as a hash, what has been bought for it, and when it last called us.
• Support: the requests and messages you send us, and any files attached to them.
• Technical: ordinary server logs, meaning your IP address, the request and the time, and a count of failed sign-in attempts so the throttle can do its job.

4. Cookies

One first-party session cookie, set when you sign in and used for nothing but keeping you signed in. There is no analytics, no advertising pixel, no session recorder and no cross-site tracker on this site.

One qualification, because a flat claim would be too broad: the icon font used on every page is loaded from cdnjs, Cloudflare's public asset network. Your browser fetches a stylesheet from them, so they see your IP address and your browser's user agent. It sets no cookie, and we send them no referrer.

5. Who else receives it

These, and no others:

• Stripe, for payments. They receive your email address, your name, and the name and hostname of each game so that a subscription line can be identified. They hold your payment method; we hold their identifier for you.
• Amazon Web Services, for transactional email through SES. Every message we send you, meaning password resets, billing notices and support replies, passes through it with its recipient, subject and body.
• Cloudflare, in three separate places: every request to this site reaches us through a Cloudflare tunnel, so all of it transits their network; the icon font in section 4; and mail to our contact address, which arrives through their email routing.
• Backblaze B2, for offsite backups. Backups are encrypted on our own hardware before they are sent, so what B2 holds is ciphertext rather than a readable copy of anything.

Two things that look like they belong on that list and do not. Files you upload are scanned for malware by a scanner running on our own hardware, so an attachment is never handed to an outside scanning service. Monitoring, if you buy it, is provided by Wadjet, which we operate ourselves rather than buy in; it receives your email address, your name and your games' hostnames.

We will disclose data if the law requires it: a subpoena, a court order, or a legal obligation we are subject to. There is no other case in which it leaves.

6. How long we keep it

• Your account: while it exists, and until you ask us to erase it.
• Your instance after a cancellation: 30 days, so you can pull anything you missed. The Terms say the same in section 10.
• Billing and purchase records: kept beyond that, because tax and accounting rules require them, and because a module purchase is a permanent record by design.
• Support requests and their attachments: kept while the account exists. A thread is the record of work billed against a retainer.
• Server logs: rotated on the server. They are not archived.
• Backups: kept for the retention window of your backup add-on, or the platform default if you have not bought one. An erasure request works forward from the day you make it: a backup already taken ages out rather than being rewritten.

7. Your rights

You can ask for a copy of what we hold, ask us to correct it, ask us to erase it, and ask us to stop. Write to [email protected]. We answer within thirty days and we do not charge for it.

You can also ask for a full export of your players, your transactions and your world state at any time, which is the same right the pricing page describes. If you are in the EU or the UK you may complain to your national supervisory authority; we would rather you wrote to us first.

A request that covers your players' data is one we carry out for you rather than judge for ourselves. You are the controller of it, so tell us what to remove and we will remove it.

8. Where your data is held

We operate from the United States, so your data is administered from there and, if you are outside the United States, is transferred there. If you are in the EU, the UK or Switzerland, that transfer relies on the Standard Contractual Clauses, which we will sign on request.

9. Security

Passwords are hashed. A game's license key is hashed and shown to you once. Stored credentials are encrypted at rest. Traffic is encrypted in transit, and nothing here is exposed to the internet except through the tunnel. Uploaded files are scanned before they are stored, and an upload is refused outright rather than stored unscanned if the scanner cannot be reached. No system is perfect, and we would rather tell you what we do than promise you it cannot fail. If you believe you have found a security problem, please write to [email protected] before publishing it.

10. Changes

When this policy changes, the date at the top changes with it. If a change materially affects what we collect or who receives it, we will tell you before it takes effect.