PRIVACY · POLICY

Privacy Policy

Last updated: 14 June 2026

This Privacy Policy describes what data the CastShield service (protection of Minecraft servers against DDoS attacks, bots and cheaters — an edge filter, a control panel, anti-cheat and a captcha; hereinafter the "Service") collects, and how it uses, stores and protects it. By using the Service, you agree to the terms of this Policy. If you do not agree, do not use the Service.

⚠ Attack countermeasures

Any attack on the Service and Protected servers (DDoS, bot floods, brute-force, exploitation of vulnerabilities) is unlawful and pointless: traffic is dropped at the kernel level, while the source of the attack remains fully recorded. Here is what happens to those who launch an attack:

All IP addresses involved in the attack (the entire pool or the whole botnet) are blocked immediately and indefinitely — including at the kernel level (XDP) — and added to our permanent blocklists.
Attack sources (IP addresses, ASNs, network and behavioral signatures, timestamps, node pools) are recorded and forwarded to public abuse and IP-reputation databases (AbuseIPDB and similar), as well as to the abuse contacts of the hosting providers and autonomous-system operators from which the attack originates.
This damages the reputation of your IPs in the reputation feeds relied upon by operators and protection networks worldwide (including providers such as Cloudflare and Akamai) and, as a rule, results in complaints to your hosting provider and the suspension or termination of your servers and VPS on their side.
Attack data is retained and, upon official request, disclosed to law-enforcement agencies and specialized cybercrime units in order to identify the organizers of attacks and the owners of botnets.
The longer and larger the attack, the more traces you leave, and the higher the likelihood of deanonymization and being held liable.

01General provisions

Operator: the administration of the CastShield project (hereinafter the "Operator", "we"). The Operator determines the purposes and means of processing Personal Data within the Service. The contact for enquiries is provided in the "Contacts" section.

In these Terms: "Personal Data" (PD) means any information relating to a directly or indirectly identified natural person; "Client" means a person who registers an Account in the panel and connects their Minecraft servers to the Service; "Player" means an end user who connects to a Protected server through the Service network.

Personal Data is processed in accordance with applicable law, including Federal Law No. 152-FZ "On Personal Data".

02Who this Policy applies to

The Service processes data of two categories of persons, and the scope of data differs between them:

Clients — owners and administrators of Minecraft servers: Account, billing and panel-usage data.
Players — persons connecting to Protected servers: technical connection data required to filter traffic and protect against attacks, bots and cheats.

The relationship between a Client and their Players (server rules, processing of in-game data on the Client's side) is governed by the Client and is not the subject of this Policy, except for the processing carried out by the Service.

03What data we collect

3.1. Client Account data. Email address, login, password hash (the password is stored only as an irreversible Argon2id hash — we neither store nor see it in plaintext), two-factor authentication settings, API keys, the panel action log (audit log), as well as the IP address and device/browser parameters of your sessions.

3.2. Payment data. Plans are paid for through the payment provider FreeKassa. We neither receive nor store bank-card details — they are processed by the provider. We store the fact, amount and status of a payment, and the Account balance state.

3.3. Technical data of Player connections. The IP address, autonomous system number (ASN) and country derived from a geolocation database, connection metadata (protocol version, handshake parameters, frequency and pattern of connections), statistics required for protection against DDoS and bots, and the attack log. The content of game traffic is not analyzed beyond what is necessary to provide protection.

3.4. Anti-cheat behavioral telemetry. When anti-cheat is enabled, the Service captures anonymized behavioral features (for example, aiming kinematics and action frequency) tied to an identifier of the form "server|nickname", in order to detect cheats and train models. This data contains no correspondence or payment information.

3.5. Captcha data. During the "human/bot" check, a temporary verification token and the IP address are processed.

3.6. Cookies and sessions. A session cookie (HttpOnly) is used for authorization in the panel. See section 9 for details.

04Purposes and legal bases of processing

We process data for the following purposes:

providing the Service and performing the contract/offer with the Client, including billing;
protecting the Service and Protected servers against DDoS attacks, bots, spam and cheats (ensuring security and availability is our legitimate interest);
ensuring quality, diagnosing incidents and preventing abuse;
complying with the requirements of the law;
other purposes — on the basis of your consent, where such consent is required.

Technical data of Player connections is processed to the minimum extent necessary to protect the network infrastructure and Protected servers.

05Retention periods

Account and billing data — for the term of the Account and thereafter within the periods established by law (including for accounting and tax purposes).
Technical connection data and attack logs — 30 days, after which they are deleted or anonymized.
Operational protection records (bans, rate-limit counters) — short-term (from several minutes to several hours).
Anti-cheat telemetry (anonymized) — up to 90 days.

Upon a justified request from a Personal Data subject, their data is deleted from our systems within 30 days, except for data we are required to retain by law.

06Transfer to third parties

We do not sell Personal Data. To operate the Service, we engage suppliers and partners that process data on our behalf or as part of their own services:

FreeKassa — payment processing;
the geolocation-database provider (MaxMind GeoLite2) — the database is used locally and no Personal Data is transferred to it;
an external DDoS-protection and TLS-termination provider positioned in front of the Service web gateway;
the hosting provider / data center where the infrastructure is located;
when Minecraft online mode is used — the Mojang / Microsoft authentication servers.

Certain suppliers and servers may be located outside the Russian Federation, which may constitute a cross-border data transfer; any such transfer is carried out in compliance with the requirements of the law. Personal Data is disclosed to state authorities solely upon their official (lawful) request; we do not disclose Personal Data to third parties on our own initiative.

07Data storage and protection

We apply technical and organizational protective measures, including: password hashing (Argon2id), transmission of data over a secure connection (HTTPS/TLS), signing of service channels (HMAC), access control, and measures against brute-force and automated abuse.

Despite the measures taken, no method of transmitting or storing data can guarantee absolute security.

08Rights of the Personal Data subject

You have the right to:

obtain information about the processing of your Personal Data and access to it;
request the clarification, correction, blocking or deletion of your Personal Data;
withdraw consent to processing previously given;
object to processing and appeal the Operator's actions, including by lodging a complaint with the authority responsible for protecting the rights of Personal Data subjects (in Russia — Roskomnadzor, the Russian data-protection authority).

To exercise these rights, send a request to abuse@castgame.net. You can delete your Account in the panel settings or upon request.

09Cookies

We use strictly necessary cookies: the authorization session cookie (HttpOnly) and technical cookies that keep the panel working. We do not use third-party advertising or tracking cookies.

You can manage cookies in your browser settings; disabling necessary cookies may make it impossible to sign in to the panel.

10Minors

The control panel is intended for server administrators and is not directed at children. We do not knowingly collect data of persons under 14 years of age. If you become aware that such data has been provided, please notify us and we will delete it.

11Changes to the Policy

We may update this Policy from time to time. The current version and the date of the last update are shown on this page. We may additionally notify you of material changes. Continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.

12Contacts

Operator: the administration of the CastShield project.

Email for Personal Data requests: abuse@castgame.net.