Privacy policy

There is not much being processed here, and this page says exactly what it is. No analytics, no ad networks, no fonts loaded from someone else's server. One third-party embed does run on every page: the status page's incident notice. It has a section of its own further down. Payment happens at Mollie or PayPal on their own pages — card details never reach us.

Controller

The controller under the General Data Protection Regulation is:

Phillipp Jäger
Karl-Liebknecht-Ring 2
06679 Hohenmölsen
Email: info@citexnode.de

Data protection officer: None has been appointed. The conditions in Art. 37 GDPR and § 38 of the Federal Data Protection Act (BDSG) are not met; privacy requests go to the address above

Appointing a data protection officer only becomes mandatory above a certain size or for certain kinds of processing.

What data we collect

All of the following exists because you have an account and run instances. None of it is bought in and none of it comes from third parties.

• Account data: email address, display name, your password as an Argon2id hash, language preference, your referral code and, if you enable it, your two-factor configuration.
• Instance metadata: name, plan, template, node, allocated ports, expiry date and the start and stop times of your servers and bots.
• Usage metrics: CPU share, memory, disk, network traffic and uptime of your instances, stored in time buckets.
• Credit: your credit balance in euros and every transaction with amount, reason and time.
• Support: tickets, messages and attachments you send us.
• Sessions: for every sign-in the IP address, the browser string, the time and when it was last used. You can see them under Account → Signed-in devices and end any of them there.
• Server logs: IP address, timestamp, requested path, status code and user agent.
• Content on your instances: files, worlds, configuration and console output live on our nodes. We only look at them where it is necessary to operate the platform, to deal with abuse, or to answer a support request you opened yourself.

What we use it for

• So you can log in and your account stays yours.
• So instances can be created, started, renewed and deleted.
• So the meters, usage figures and the node list on the home page show real numbers instead of estimates.
• So we can spot abuse: mining, attacks launched from our addresses, multiple accounts routing around the limit.
• So we can plan capacity and know when a node is full.
• So we can answer your support requests.

Legal bases

• Art. 6(1)(b) GDPR: account, instances, credit and support, in other words everything needed to perform the usage contract.
• Art. 6(1)(f) GDPR: server logs, rate limits, abuse and attack prevention, and capacity planning. Our legitimate interest is a stable platform that is not being abused.
• Art. 6(1)(c) GDPR: statutory retention and disclosure obligations.
• Art. 6(1)(a) GDPR: we do not currently ask for consent. There is no newsletter and no marketing mail, and so nothing to consent to. If we ever ask for your consent, you can withdraw it at any time with effect for the future.

How long we keep it

• Account data: for as long as your account exists.
• After account deletion: immediately. Account, instances, databases and tickets go in the same operation. The one exception: payment-related transactions are kept for the statutory retention period as accounting records (commercial and tax law)
• Server logs: rolling, at most around 30 MB per instance. It is a size rather than a period: older lines drop off the end as new ones arrive
• Usage metrics: 8 days. Raw samples are never stored, only 5-minute and hourly averages, and those are deleted afterwards. For CitexNode's own VPS: per-minute values 7 days, hourly values 13 months; they go with the VPS
• Status page subscribers: unconfirmed sign-ups 7 days, after unsubscribing 30 days; otherwise as long as the status page exists
• Tickets: until you delete your account. A closed ticket is not removed automatically, because the history helps the next time something happens on the same server
• Backups: as long as you keep them. Backups live on the node, count against your plan's backup slots and are deleted with the instance
• Backups of own VPS: a disk image every night, kept for 7 days, unencrypted on our backup server (see recipients). Once the VPS is deleted, the nightly backup stops and we delete the existing backups automatically within 4 days
• Deleted instances: the files go with the instance, immediately after the grace period ends. The container, the directory and the backups go together
• Sessions: until they expire or you end them, after which the rows are cleaned up. The keys in the sign-in emails expire after 14 days

Recipients and processors

We do not sell data and we do not pass on anything that is not needed to run the service. Involved are:

• Data centre and server provider: Tausio Cloud (Kevin Feiler, Stuttgart), Firstcolo data centre in Frankfurt am Main, Germany. The platform (dashboard, API, mail) and your services run here. Which node carries your instance is shown in the dashboard next to its name.
• Further servers: IONOS SE, Montabaur, data centre in Frankfurt am Main, Germany (reseller portal, status page, secondary nameserver, control of CitexNode's own VPS, backup of the platform database, of CitexNode's own servers and of our customers' VPS)
• VPS of the Ryzen and AMD EPYC lines: Datalix GmbH, Eschborn, Germany
• Email delivery for confirmations and notifications: none. Mail leaves our own server; no sending service is involved
• PayPal payments: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg
• Card and other payments: Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands
• Authorities, where we are legally obliged to disclose.
• Bot protection on sign-in, registration and the two forms that send an email: Cloudflare Turnstile, Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA

There is a processing agreement under Art. 28 GDPR with every processor. The full list with addresses is on the sub-processors page. Data you store on your services is covered by the data processing agreement.

Transfers to third countries: your content and your account stay on servers in Germany. There is one exception. Opening sign-in, registration, forgot password or resend confirmation makes your browser load the Turnstile widget from Cloudflare. Your IP address along with browser and device details then reach a company whose servers are also in the United States. The basis is the standard contractual clauses under Art. 46 GDPR. The incident notice on every page has loaded from status.citexnode.com, which is us, since 10 September 2026.

Cookies, browser storage and tracking

This section is short, and that is the point. The full list with purpose and lifetime is on the Cookies page.

• Strictly necessary cookies from citexnode.com: cx_at and cx_rt for your session. They are set when you log in, deleted when you log out, and they are httpOnly, so JavaScript in the browser cannot read them. Without them there is no login. On top of that there is cx_oauth_lang, but only for 10 minutes when you click a sign-in with another service on the English site: it remembers the language for the way back.
• Entries in your browser's storage: cx:cookie-notice remembers that you acknowledged the cookie notice, cx:onboarding-done remembers that you dismissed the getting-started hint in the dashboard, and while you sign in at git.citexnode.com for Deploy, cx.deploy.gitea.return briefly sits in session storage. The admin area adds two entries for staff. All of them stay on your device and are not sent to us on their own.
• No analytics, no tracking pixels, no ad network, no third-party cookies, no profiling.
• The fonts are served from our own server. No request goes to a font CDN, so no font provider ever sees your IP address.

The legal basis for these cookies and entries is § 25(2) no. 2 of the Telecommunications Digital Services Data Protection Act (TDDDG): they are strictly necessary for the service you want to use. That is why there is no consent banner here, just a notice: there is nothing you could say no to without also logging yourself out. The bot protection on the public forms does not set a cookie on your device. It still has a section of its own further down, because data does reach a third party, and that is the part that matters.

Bot protection on the public forms

Four forms are open without anybody being signed in: sign-in, registration, forgot password and resend confirmation email. Those are precisely the ones a script wants, and a counter per IP address only helps for as long as the script uses one address.

So those four forms run Cloudflare Turnstile. It is a puzzle almost nobody has to solve: the widget decides from browser signals whether to let you through.

What reaches Cloudflare in the process is not ours to decide and not ours to limit. By Cloudflare's own description it is essentially your IP address, browser and device details, and how the page was used during the check.

The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in protecting the public forms from automated abuse. Without it, mass registration and using our form to flood somebody else's inbox would both be possible.

The widget is loaded on those four pages only. On the rest of the site, in the dashboard and on the console, Cloudflare is not involved.

Cloudflare's privacy policy

Status page and incident notice

Whether the platform is up is shown on status.citexnode.com. Since 10 September 2026 we run that page ourselves, on a server of our own at IONOS in Frankfurt am Main. No third party is involved any more.

Two pieces of it are embedded in this site:

• A badge in the footer showing the current state: an image loaded from status.citexnode.com.
• A small script that runs on every page and shows a notice when an incident is open. It loads only after the page has finished, and it shows nothing while nothing is broken.

Your browser fetches both from status.citexnode.com, which is us. The same access data arises as for any request to this site (IP address, browser, time); it goes to nobody else.

Neither sets a cookie. The script stores an entry citexnode-status-dismissed in your browser's local storage so a dismissed notice does not reappear on the next page; the entry stays on your device.

The legal basis is our legitimate interest under Art. 6(1)(f) GDPR: that you learn about an ongoing incident while you are on the site, instead of sitting in front of a server that will not start and looking for the fault on your side.

Paying with PayPal and Mollie

You top up your credit via PayPal or Mollie (card and the other payment methods Mollie shows on its checkout page). Both collect on their own pages: you are redirected there, enter your payment details directly with the provider, and CitexNode never sees card numbers or account details.

What we send the provider is little: a pseudonymous account identifier, the amount and the purpose. What we get back is the payment status and a payment identifier — it appears as the reference on the transaction in your history.

For the data you enter on the providers' pages, they are themselves the controllers. Mollie processes payment data in the EU.

Until 18 October 2026 you could also top up via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland, with processing also by Stripe, Inc., USA, based on the EU standard contractual clauses and the EU-US Data Privacy Framework). The above applies accordingly to payments from that period, including the retention duties.

The legal basis for the transfer is Art. 6(1)(b) GDPR (contract performance). Payment-related transactions are subject to statutory commercial and tax retention duties (Art. 6(1)(c) GDPR) and are therefore kept for the statutory period even after account deletion — as accounting records, not as a usable account.

PayPal's privacy policy

Mollie's privacy policy

Stripe's privacy policy (for payments until 18 October 2026)

Sign-in notification and location lookup

Every sign-in to your account sends you an email. It names the time, the IP address, the device we recognised and, where it could be determined, the location. The point is that a sign-in you did not make is noticed while it can still be undone.

• The location is determined on our own server from a database file stored there. Your IP address does not leave the server, no third-party service is asked, and the location itself is stored nowhere.
• Whether a sign-in comes from a country new to your account is read off the IP addresses of your earlier sessions. It appears in the email as an observation and blocks nothing: travelling, a mobile network or a VPN does this regularly.
• The two sign-out buttons in the email carry a single-use key that expires after 14 days. It signs devices out and can do nothing else — no reading, no changing, no signing in.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest and yours are the same one here: that somebody else reaching your account is noticed.

This email cannot be switched off. It is the only channel through which a warning reaches you if somebody else has your password.

Access by support

Staff with admin rights can open the console and the file manager of somebody else's instance. That is what makes it possible to answer a ticket like "my server will not start" without asking you for your password.

Three rules apply, and the third is the one you can check yourself:

• It only happens for operations, to work on your support request, or to deal with abuse.
• The access reaches as far as that of a person you share your server with: console, files, backups, databases, on and off. Deleting, renaming, reinstalling, renewing and the sharing list stay yours alone.
• Every single one of these accesses is logged and appears in your own activity log under the instance. You can see that somebody from the team was in there, when, and what they opened.

You can generate an eight-digit support PIN in your settings to prove who you are. It is valid for 24 hours, replaces the previous one and can be withdrawn at any time. We store it encrypted rather than in plain text, and staff never see it: they type in what you read out and get back a yes or a no. It is proof that you belong to your account, not a precondition for us being allowed to look into abuse.

We do not go browsing servers without a reason. If you find an access in the log you cannot explain, open a ticket and we will tell you who it was and why.

Your rights

You have the following rights under the GDPR, and we answer requests within the statutory deadline:

• Access to what we have stored about you (Art. 15).
• Rectification of incorrect data (Art. 16).
• Erasure (Art. 17).
• Restriction of processing (Art. 18).
• Data portability, meaning your data in a machine-readable format (Art. 20).
• Objection to processing based on our legitimate interest (Art. 21).
• Withdrawal of consent with effect for the future (Art. 7(3)).

You can also lodge a complaint with a supervisory authority under Art. 77 GDPR. The competent authority is: Landesbeauftragter für den Datenschutz Sachsen-Anhalt (State Commissioner for Data Protection of Saxony-Anhalt), Leiterstraße 9, 39104 Magdeburg

Data export and account deletion

Two of those rights you can exercise yourself, without writing to us and without waiting for a reply.

Export your data or delete your account

The export contains your account, your instances, your transactions and your tickets as JSON. Account deletion removes your account and every instance including files. Both are final, so download the export before deleting.

Security

Access runs over HTTPS. Passwords are stored only as an Argon2id hash, never in clear text, which also means we cannot read them. Session tokens live in httpOnly cookies so a script in the browser cannot take them.

Changes to this policy

If the processing changes, this page changes. For material changes we tell you in the dashboard rather than doing it quietly.