Trust & Security

This page is maintained by FreeMCHost to answer common security and privacy questions about the FreeMCHost Minecraft hosting service. It describes capabilities enabled in the application today. It is not a certification, audit, or independent verification.

1. Shared responsibility

FreeMCHost runs on the Lovable Cloud platform. The platform provides authentication, managed database with row-level security, file storage, secret management, and the hosting environment for our application code. FreeMCHost is responsible for the application logic, the access rules it configures on each table, the third-party services it integrates with, and how it operates the service. Customers are responsible for keeping their account credentials safe and for the content they put on their servers.

2. Authentication and account access

• Sign-in via email and password, with Google as an optional provider.
• Passwords are hashed and stored by the managed authentication provider — FreeMCHost never sees or stores raw passwords.
• Password reset is performed via a time-limited email link.
• Privileged operations in the admin dashboard require a server-side role check (admin / support / advisor) on every request.

3. Access control on data

• Row-level security is enabled on every application table. Policies scope access by user identity (auth.uid()) or by role.
• User roles are stored in a dedicated table and checked server-side. Roles are never trusted from the client.
• Sensitive infrastructure columns (Stripe price IDs, container/runtime fields, internal node IDs) are not exposed through the public Data API.
• Backend operations that require elevated privileges run from server functions only and verify the caller's role first.

4. Payments

Payments and subscriptions are processed by Stripe. FreeMCHost does not store full card numbers or CVV. The application receives only the tokens and metadata Stripe returns. Stripe webhooks are verified by signature before any state change is applied.

5. Data we collect

See the Privacy Policy for the full list of data we collect, the purposes, the legal bases, and retention durations under GDPR.

6. Subprocessors and integrations

• Lovable Cloud — application hosting, database, authentication, storage.
• Stripe — payment processing and subscription billing.
• Pterodactyl — game-server orchestration on infrastructure operated by FreeMCHost.
• Min3 — optional custom subdomain provisioning when a user requests one.
• Resend — transactional email delivery.

7. Data in transit and at rest

All traffic between users and the application is served over HTTPS. Data at rest in the managed database and storage is encrypted at the platform level. Secrets such as API keys and webhook signing secrets are stored in the platform's secret manager and injected at runtime — they are not committed to source code.

8. File uploads

Chat and ticket attachments are uploaded into a private storage bucket. Read access requires a short-lived signed URL minted on the server, and the server checks that the requesting user is a participant of the conversation before issuing it.

9. Logging and monitoring

Server functions emit application logs that we use to diagnose incidents and to retry transient failures (for example, server provisioning). Logs do not include passwords, payment card data, or message content. We monitor backend node health and notify affected customers when a node we depend on is unavailable.

10. Retention and deletion

Account and server data is retained while the account is active. On account deletion, personal data is removed in line with the schedule in our Privacy Policy. Expired chat attachments are purged automatically by a scheduled job.

11. Reporting a vulnerability

If you believe you have found a security issue in FreeMCHost, please contact us at hello@freemchost.com with a clear description and reproduction steps. Please give us a reasonable window to investigate and fix the issue before any public disclosure.

12. Updates to this page

This page describes practices in effect on the date shown above. It will be updated as the application evolves. For privacy-specific commitments and legal terms, refer to the Privacy Policy, the Terms of Service, and the Legal Notice.