Privacy policy
Effective and last updated: October 27, 2026 · Crucible Hosting · cruciblehosting.com · Contact · cruciblehosting@gmail.com
We do not publish a physical mailing address on this site.
Who we are
Crucible Hosting operates cruciblehosting.com and hosts customer Minecraft Java servers on Oracle Cloud Infrastructure, as a sole proprietorship in Utah, United States.
Information we collect
- Account data: email address, display name, password hash (if you set a password), and OAuth identifiers from Google when you use Google sign-in.
- Server and gameplay data: world files, server configuration, plugins/mods you install, join addresses/slugs, usage metering (awake time, storage), and operational metadata needed to run your tenant.
- Payment data: Stripe processes card payments. We receive payment status, amounts, tax lines, and Stripe customer identifiers—not full card numbers.
- Communications: messages you send via our contact form and email threads with support.
- Logs: HTTP access logs, API request metadata, authentication events, velocity/rate-limit records (for example hashed client IP for signup and top-up limits), and operational logs for security, abuse prevention, and debugging.
- World backups: hibernation bundles and preserved boot volumes in Oracle Cloud Object Storage and block storage.
- Platform database replication: we replicate the edge identity database to Oracle object storage using Litestream (open-source software we operate)—not your full world files.
Legal bases (EEA/UK note)
Where privacy laws require a “legal basis,” we process data to perform our contract with you (hosting and billing), for legitimate interests (security, abuse prevention, improving reliability), and to comply with law. Marketing is not a focus of this service; operational email is sent when needed for your account.
How we use information
To provide hosting and billing; to operate wallet metering, idle sleep, and zero-balance actions; to send transactional email (such as low-balance, wallet-empty, receipt, or account-deletion codes) when delivery is configured; to enforce velocity limits; to prevent fraud and abuse (including CPU abuse monitoring); to improve reliability; and to meet legal obligations.
Processors and infrastructure
We use trusted providers to run the service. They process data on our behalf under their terms and privacy policies:
- Stripe — payments and Stripe Tax on wallet top-ups.
- Resend — transactional email delivery when configured.
- Oracle Cloud Infrastructure (OCI) — compute, networking, block storage, and object storage for hosting, hibernation backups, and identity-database replicas.
We do not sell your personal information. We may disclose information if required by law, to protect rights and safety, or in connection with a merger or sale of the business.
Retention
We retain account and server data while your account is active and for a reasonable period afterward. We generally retain security and access logs for about 90 days, unless a longer period is needed for security investigations or legal requirements.
Account deletion: When you delete your account from the Account page, we stop services tied to your account, remove or pseudonymize portal identity data as implemented, and schedule world backup cleanup. If you choose delete backups immediately, removal is queued and our sweeper (about every 10 minutes) works through eligible backup data—we aim to delete it soon after it is due, but do not guarantee an exact minute. Otherwise, backup data is scheduled for deletion after 30 days; we delete eligible backup data when due.
Your choices and privacy rights
- Export: on the Account page, download a JSON export of account-related data we associate with you.
- Deletion: on the Account page, follow the guided deletion flow (confirmation phrase, email code or password, and wallet acknowledgement if applicable).
- Access and correction: contact us via Contact or cruciblehosting@gmail.com to request access to or correction of personal information, subject to verification.
- California (CCPA/CPRA) and similar state laws: residents may have rights to know, delete, and correct personal information, and to opt out of “sale” or “sharing” (we do not sell personal information). Submit requests through Contact; we will verify your identity before responding.
Cookies and sessions
We use an HttpOnly session cookie for sign-in (crucible_session) and a short-lived OAuth state cookie during Google login (crucible_oauth).
They are scoped to our site host with SameSite=Lax (and Secure on HTTPS).
Security
We use practices appropriate to a small hosting platform (TLS, access controls, secrets outside git). No method of transmission or storage is 100% secure. Report security issues via Contact.
Children (COPPA)
The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact us and we will delete it as required by law.
International users
Our infrastructure is primarily in the United States. If you access the service from other regions, you consent to processing in the U.S.
Changes
We may update this policy. The revised version will be posted here with an updated date. For material changes, we will notify you by email and a site notice at least 14 days before the change takes effect.