Privacy Policy

Last updated 1 October 2026

What NatchGSM collects about you, why, how long it's kept, who else handles it and what you can do about it.

The short version

The app and the service run on your own machines. Your game servers, worlds, backups, logs and settings stay there. We never see them.
On their own they only ask us for updates and for the settings people use most. Those requests carry nothing about you.
An account is an email address and a password we can't read.
Linking a host lets your web dashboard reach it through our servers. What passes through isn't stored.
A linked host tells us which of a game's settings people change or search for, never the values or what was typed.
No ads, no analytics, no tracking. We never sell your data.

1. Who we are

NatchGSM is made by Natchland Studios, a sole trader in the United Kingdom trading as Natchland ("we", "us", "our"). We're the controller of the personal data this policy describes. Write to us at support@natchgsm.com about anything here.

2. What stays on your machine

The app, the background service, the helper and the command line tool run on machines you control. Your game servers, their worlds and saves, their backups, logs and settings are stored there and never sent to us.

A linked host keeps its secret key for natchgsm.com, your account id and your email address in its own data folder, in a file only the service can read.
The app keeps your sign-in in your user settings folder, encrypted on Windows.
When you pair the app with another of your machines, they connect to each other directly. That doesn't go through us.
If you sign in to Hytale for a Hytale server, that sign-in is kept on the host and talks to Hytale's own services, not ours.

3. What the software sends on its own

Update checks. An installed service asks natchland.com for the newest version two minutes after it starts and once a day after that. The request names NatchGSM's version (like NatchGSM/0.2.0) and nothing else. An update is only downloaded when you choose to install it.
Popular settings. Now and then the service asks natchgsm.com which settings people use most for its games, whether or not it's linked to an account. Like an update check, it sends nothing beyond the request itself.

There are no analytics, crash reports, hardware identifiers or IP address lookups. The only id the service has is a random one it makes the first time it runs. Like any request on the internet, these come from your IP address, which Cloudflare sees to deliver them.

When you install or update a game server, your machine downloads what it needs straight from the source: Valve's SteamCMD signed in anonymously, Java from Adoptium on GitHub, Oxide or Carbon from GitHub, plugins from uMod and Hytale's own downloader. Webhooks you set up send what you picked, like server and player names, to the address you gave, like a Discord channel. Those go from your machine to them, under their own privacy policies. We never see them. When NatchGSM installs Carbon for a Rust server, it turns Carbon's own analytics off.

4. Your account

When you make an account we keep:

your email address
your password as a PBKDF2 hash with a salt of its own, so we can't read it or get it back
when the account was made, when you confirmed your email and whether it's an admin account
which version of the Terms of Service and this policy you agreed to and when
for each browser or app you're signed in on, a hash of its session key, whether it's a browser or an app, an app's name with your computer's name in it (like "NatchGSM on Charlie's PC"), when it was made and when it was last used
the six digit codes we email you, only as hashes, with how many wrong tries each has had
a record of each email we send you (the address, what it was for and when), so a retry never sends it twice

5. Device sign-in and linked hosts

When the app, the command line tool or a host asks to be linked, we keep hashes of its codes, what kind of device it is, its name (your computer's name), its operating system, processor type and NatchGSM version, a host's random id, then who approved or refused it and when.
For a linked host we keep its id, name, operating system, processor type, NatchGSM version, a hash of its secret key, when it was linked and when it was last seen.
A linked host keeps a connection to natchgsm.com open. When you open the web dashboard, what it shows passes through our servers between the host and your browser: your servers, their consoles, players, settings and the machine's processor, memory and disk use. None of it is stored. The host is told the email address of the account that opened each dashboard session and writes it to its own log.

6. Settings usage

A linked host tells us which of a game's own settings people change and search for, like decay.scale for Rust. For each one we keep the game, the setting's name, whether it was changed or searched for, the host's account and when that was first and last seen. We never get the value a setting was given or what was typed into a search.

It's counted per account, so it only says how many accounts use a setting. We use it to rank each game's most used settings, which the app shows first for everyone. A setting only appears in that ranking once at least three accounts use it and the ranking only ever shows counts, never who.

A host only sends this while its account has agreed to the current Terms of Service and this policy. The rows are deleted with the account. To stop it, unlink your hosts, or ask us and we'll delete what's been recorded for your account.

7. Game requests and votes

When you ask for a game we keep its name, the Steam app id if you gave one, your note and that you asked. Only we see the note. For each vote we keep which request, your account and when. The public list shows each request's name, status, vote count and any note we've added. It never shows who asked or voted.

8. Getting help

The contact form emails us your topic, your message and your email address, or your account's address if you're signed in. It adds your account id when you're signed in and what your browser says it is (its user agent), so we can help with the right thing. It goes to support@natchgsm.com, which Cloudflare forwards to our own inbox. It isn't stored in our database. Emails you send us, through the form or directly, stay in our inbox as long as we need them to help you.

9. Keeping accounts safe

To stop password guessing and spam, we count sign-ins, codes, sign-ups and contact messages per IP address and per email address. Those counters are deleted within about a day.
When something goes wrong, our code writes a short log line that can include an account id, a host id or the email address a message was going to. We read these live to fix problems and don't store them.
Changes our admins make to game requests are logged with the admin's name.

10. Payments

Nothing is paid for yet. When paid plans arrive, payments go through Stripe. Starting a checkout makes a Stripe customer with your email address and account id. We then keep the Stripe customer id, the checkout's id and your subscription's status, plan, whether it's monthly or yearly, when it renews, whether it's set to cancel and when a payment failed. Your card details go straight to Stripe. We never see or store them.

11. Cookies and your browser

One cookie, __Host-ns_session, keeps you signed in. It's only sent to natchgsm.com, scripts can't read it and it runs out 30 days after you last used it. The site needs it to work, so it doesn't ask first.
Your browser's local storage keeps your theme choice under ns-theme. Nothing else is kept there.
The pages load nothing from anyone else. No analytics, ads, tracking pixels or outside scripts, fonts included.

12. Who else handles it

Cloudflare runs natchgsm.com: the website, our database, the connections between linked hosts and the dashboard, the emails we send and the forwarding of email to support@natchgsm.com. Every request to the site passes through Cloudflare, with your IP address. Cloudflare's Privacy Policy
Stripe will handle payments once paid plans exist. Nothing goes to Stripe before you start a checkout. Stripe's Privacy Policy
Google holds the support emails you send us, since our inbox is in Gmail. Google's Privacy Policy
Our own server holds the update files. Update checks reach it through Cloudflare.

We don't sell your data or share it with anyone else. Nothing is ever used for ads.

Our database is in Western Europe. Cloudflare, Stripe and Google are US companies that handle data in data centres around the world. Where your data leaves the UK, it's covered by the safeguards in their own data processing terms.

13. Why we use it

UK data protection law asks for a reason for each use, called a lawful basis.

To give you what you asked for (contract): your account and sign-in, emailed codes, linking devices, the web dashboard, game requests and replies when you ask for help.
Legitimate interests: keeping accounts safe with rate limits, session records and error logs, ranking the settings people use most and keeping a record of admin changes. You can object to these, see your rights below.
Legal obligation: keeping payment records for tax, once there are payments.

14. How long it's kept

Your account: Until you ask us to delete it
Sessions: 30 days after you last used them, or until you sign out
Email codes: 15 minutes to use, deleted a day after that
Device sign-ins: 10 minutes to approve, deleted a day after that
Linked hosts: Until they're unlinked or the account is deleted
Settings usage: Until the account is deleted
Votes: Until you take them back or the account is deleted
Game requests: They stay on the list, with nothing linking them to you once your account is deleted
Emails we sent you: The record of who and when, 30 days
Rate limit counters: About a day
Support emails: As long as we need them to help you
Payment records: As long as UK tax law requires
Database history: Cloudflare keeps a rolling history of our database for restores, so anything deleted is gone from it within 30 days

15. Your rights

Under UK data protection law you can ask us for a copy of what we hold about you, ask us to correct it, delete it, limit what we do with it or give it to you in a form you can take elsewhere. You can also object to anything we do for legitimate interests. It's free.

Email support@natchgsm.com from the address on your account. We may ask you to confirm it's you. We answer within a month.

To delete your account, ask us the same way and we'll do it by hand. Deleting it removes it along with its sessions, codes, device sign-ins, linked hosts (which then stop connecting), votes and settings usage. What stays: a game you asked for stays on the list without your name on it, payment records the law says we keep and emails in our inbox. Our database history rolls off within 30 days.

If you're unhappy with how we've handled your data, tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk.

16. Children

You need to be at least 13 to make an account. We don't knowingly keep data about anyone younger. If you think a child under 13 has made one, tell us and we'll delete it.

17. Changes to this policy

The date at the top says when this policy last changed. When a change matters, you'll be asked to agree to the new version the next time you use your account on natchgsm.com.

18. Contact

Questions about your data go to support@natchgsm.com, or use the contact page.