Short version: We collect only what is needed to operate ServerCrate. We have no way to read your backup files. We do not sell your data.
#1. What We Collect
- Account information: Email address, optional name, and hashed password
- Usage information: Storage amounts, login times, snapshot counts, device names, and service activity needed to operate your vault
- Phone number (optional): only if you add one for account texts or offers by text
- Billing information: Stripe customer and subscription IDs (for card payments), PayPal order and payer IDs (for PayPal payments), or BTCPay invoice IDs (for Bitcoin payments). We never store raw card data. Bitcoin transactions never touch a third-party processor.
- Technical information: IP addresses for security and rate limiting, session tokens, and basic operational logs
#2. What We Never See
Backup data is encrypted client-side. We do not have your encryption key. The ciphertext stored on our systems is unreadable without it.
#3. How We Use Information
- To provision and operate your backup vault
- To process payments and manage subscriptions
- To send transactional emails such as verification, password reset, billing, and service notices
- To detect abuse, fraud, and unauthorized access
- To monitor service health and reliability
#4. Sharing
We do not sell your data. We share information only with the providers below, only what each one needs, or when legally required to do so.
- Stripe - card payments: billing identity and the payment details you enter with Stripe.
- PayPal - PayPal payments: order and payer identifiers.
- BTCPay Server - Bitcoin payments: self-hosted by us, no third-party processor.
- VoIP.ms - text messages: your phone number and the message, only to deliver texts you asked for.
- Email delivery - transactional email is sent through our own mail servers.
- Infrastructure - customer services run on hardware we operate. Off-site verification systems hold only ServerCrate's own test data, never customer data.
We will update this list before adding a provider that receives personal data.
#5. Retention
Account data is retained while your account is active. Vault data is deleted within 30 days of deprovisioning unless a longer retention period is legally required. Billing records may be retained for up to 7 years for accounting and compliance purposes.
Accounts that never verify their email address, and inactive free accounts that never stored data, are deleted as described in section 7 of the Terms of Service. When an account is deleted, its personal data is removed except billing records we are required to keep.
#6. Cookies
We use HTTP-only session cookies for authentication and security. We do not run third-party advertising trackers. We do not use your data for ads. Our marketing website uses Umami for aggregate traffic statistics. The customer portal does not load third-party analytics.
#7. Security
We use HTTPS, HTTP-only Secure cookies, CSRF protection, password hashing, rate limiting, passkeys, TOTP-based 2FA, and isolated customer environments. No system is perfect, but we design around minimizing exposure and protecting account access.
#8. Your Rights
You may request access to, correction of, or deletion of your personal data, subject to legal and operational requirements. Contact privacy@servercrate.net. We respond within 30 days. You can also delete your account yourself: cancelling all services and asking us to close the account removes your vaults and personal data as described above.
#9. Text Messages, Notifications and Passkeys
A mobile number is optional. If you add one, we use it to send the verification code you ask for and account texts. Promotional texts go only to verified numbers whose owner separately ticked the offers box on the Account page. That box is never pre-ticked and is not a condition of purchase. We record when and how each opt-in and opt-out happened.
- No sharing for marketing: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third party.
- Delivery: texts are sent through VoIP.ms, our telecom carrier, which receives only your number and the message, to deliver it.
- Opting out: reply STOP to any text, or turn texts off on your Account page. Reply HELP for help. Program details: SMS Terms.
- Push notifications: if you turn them on, your browser gives us a device address and encryption keys. Every notification is encrypted on our servers before it leaves, so Apple, Google or Mozilla only relay ciphertext. Turn them off any time on your Account page or in your browser.
- Passkeys: we store only the public key your device creates. Your fingerprint, face and device PIN never leave your device.
#10. Contact
#Changelog
- October 16, 2026 - Added text messages, push notifications and passkeys; named VoIP.ms as our SMS carrier.
- September 27, 2026 - Named our providers, added analytics disclosure, account-deletion retention, and response time for data requests.
- March 15, 2026 - Initial version.