Who Is Responsible
TopServer.Network (topserver.network) is operated independently in the United Kingdom. The operator of TopServer.Network is the controller responsible for personal data processed through this website, its free ARK tools, the Server Lists, the server owner area and the Provider Portal.
Privacy and data-rights enquiries: please use our contact form and choose the privacy topic.
What We Collect, By Activity
Everyone who visits
- Server and security logs: IP address, browser/user-agent, time and requested page, used to run and protect the site.
- Essential cookies for session security and to remember your cookie choice (see the Cookie Policy).
- Anonymous click counts kept by our own server: which provider, deal, advert or server-list button was used, when, and from which page. No cookies, and not linked to you.
- Anonymous daily page-view totals for this site and our free ARK tools: the page opened and the website the visit came from. No cookies, no IP address and no visitor ID are stored with them.
- Only if you allow analytics: Google Analytics usage data (see section 05).
If you contact us
- Your name, email address, the topic, any reference and your message, plus a one-way hash of your IP address used to stop spam.
If you vote for a server
- Which server you voted for and when. To allow one vote per server per day we store one-way hashes of your IP address and of a random browser cookie (
tsn_voter). We cannot turn these back into your IP address. They are deleted after 30 days; the vote itself still counts.
If you run a server (server owner area)
- Your email address, used for one-time sign-in links. The links are stored only as hashes and expire after 20 minutes.
- The listing you submit: community name, description, rules, rates, mods, platform, links, server addresses and any banner image. Approved listing content is published publicly.
- Ownership claims: the verification code, the evidence you give us and the reviewer's decision.
- Sponsorship bookings: dates, agreed price and the payment reference.
If you are a hosting provider
- Listing applications: company name, website, contact name, contact email and the application details.
- Provider Portal accounts: username, email address, a secure password hash, optional two-factor authentication settings, and sign-in attempts and account actions with their IP address, kept for security.
- Memberships and advertising orders: order status and Stripe customer, subscription and invoice references. Card details are entered on Stripe's pages and never reach our servers.
Public game server information
- For the Server Lists we read information that game servers publish to Steam's public server list and through the servers' own public query: server name, map, IP address and ports, player counts and capacity, version and settings such as PvE/PvP, mods and cluster. We keep hourly history for 30 days. We never collect player names or player identities. If you run a server from a home connection and don't want it listed, contact us and we'll remove and block it.
What We Use It For
- Run, secure and troubleshoot the website, tools and accounts.
- Publish hosting comparisons and the Server Lists, including live status, statistics and votes.
- Sign you in, review listings and claims, and prevent fake or duplicate listings.
- Process memberships, advertising and sponsorship bookings, and send the related emails.
- Reply to enquiries and applications.
- Measure outbound provider activity and report on advertising.
- Understand which pages are useful, only where you allowed analytics.
- Detect spam, vote manipulation, abuse, fraud and security incidents.
Why Processing Is Allowed
- Consent: optional Google Analytics. You can withdraw it at any time.
- Contract: server owner and Provider Portal accounts, memberships, advertising and sponsorship bookings you ask us to provide.
- Legitimate interests: security logs, spam and vote-abuse prevention, anonymous click and page-view counts, publishing public game server information and replying to enquiries. We balance these against your rights and keep them to what is needed.
- Legal obligation: keeping payment and tax records.
Only After You Say Yes
If you click Allow Analytics, we load Google Tag Manager, which runs Google Analytics 4. Google sets the cookies _ga and _ga_* and receives your page views, the links you click to providers and deals, and technical details such as your browser and approximate location. We use this to see which pages and providers are useful.
We do not use it for advertising: advertising storage, ad personalisation and ad user data stay switched off. Google Analytics data is kept for 14 months, and Google may process it outside the UK. Nothing is sent to Google until you allow it. Your choice is shared with our free ARK tools, so you are only asked once.
Who Else Handles Data
We use a small number of service providers, each only for the job described:
- Our hosting provider: runs the servers and database that store the site's data.
- Google: Tag Manager and Analytics, only with your consent.
- Stripe: payment processing for memberships, advertising and sponsorships, under Stripe's own privacy policy.
- Cloudflare Turnstile: spam checks on forms and votes, where enabled.
- Our email delivery provider: sends sign-in links, notifications and replies.
- Valve / Steam: we request Steam's public server list and Workshop mod names. No visitor data is sent.
Hosting providers you visit through our links, and game servers you join, operate under their own privacy notices. We may disclose information if the law requires it, or to protect the site and its users. We do not sell personal information.
Outside The UK
Google, Stripe and Cloudflare may process data outside the UK, including in the United States. Where they do, they rely on legal safeguards recognised under UK law, such as adequacy regulations or the UK International Data Transfer Agreement or Addendum.
How Long We Keep It
| Data | Kept for |
|---|---|
| Sign-in links (server owners) | 20 minutes, stored as a hash, used once |
| Vote hashes (IP and browser) | 30 days, then deleted; the vote count remains |
| Game server history | 30 days of hourly observations; no player identities |
| Application error logs | 30 days |
| Database backups | 14 days, then overwritten |
| Lapsed provider memberships | Listing profile kept 90 days so you can return |
| Google Analytics | 14 months |
| Accounts, listings and claims | While the account or listing is active; deleted on request unless we must keep records |
| Contact messages and applications | As long as needed to handle them and any follow-up |
| Payment and invoice records | As required for tax and accounting (usually six years) |
You Stay In Control
Under UK data-protection law you may have the right to access your data, correct it, erase it, restrict or object to its use, move it to another service, and withdraw consent at any time. To use a right, contact us as shown in section 01. We will respond within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office. We'd appreciate the chance to put it right first.
Children
Browsing and voting need no personal details. Server owner accounts, Provider Portal accounts and anything paid are intended for adults (18 or over). We do not knowingly collect personal information from children under 13; if you think we have, contact us and we'll delete it.
Keeping It Safe
Traffic is encrypted over HTTPS. Passwords and sign-in links are stored only as hashes, provider accounts can use two-factor authentication, forms are protected against cross-site request forgery, and administration is restricted. No system is perfectly secure, but we act quickly on any incident and will tell you when the law requires it.
When This Policy Changes
We update this policy when features, service providers or the law change. The date at the top shows the latest version. We'll update it before we start any materially new use of personal data.