Public website
The public Emberstone Network Hub is designed to collect as little information as practical. This version does not include advertising technology, behavioural tracking or newsletter forms. It does provide optional Emberstone Network accounts.
Standard web-server logs may still record technical information such as IP address, request time, requested page, browser information and error details. Hosts commonly keep these records for security, reliability and troubleshooting. The account service also uses short-lived abuse-prevention records derived from connection information to slow repeated login or registration attempts.
Emberstone Network accounts
If you register, the Hub stores the username, display name, email address, password hash, account role, account status, acceptance timestamps for the Terms and Privacy Policy, account creation time, recent sign-in timestamps and notification preferences needed to operate the account service.
Passwords are stored using one-way password hashing. Staff roles are assigned by authorised Emberstone staff and cannot be selected during public registration. Email verification and automated password recovery are not enabled in this build, so account-recovery requests currently use the Emberstone Support Centre.
The Security area can show your active Emberstone sessions. For this feature the database stores a one-way hash of the web session identifier, a broad device label derived from the browser user-agent, sign-in and last-seen times, and an HMAC-derived connection-address hash used for security. The account portal does not display full IP addresses or infer a precise location.
Live game-server status
Rust, FiveM and supported Minecraft servers can send authenticated heartbeat messages to the Emberstone website. The connection is initiated by the game server and the visitor's browser is never given a private game-server heartbeat key.
The database stores aggregate server information such as online state, player count, capacity, heartbeat latency and selected server metadata. The supplied Emberstone agents do not send player names, Steam IDs, Discord IDs, UUIDs or chat through this feature.
Private staff panel
Authorised network staff sign in to the private Staff Panel using the same Emberstone account. A necessary session cookie keeps the authorised account signed in and server-side role permissions control which management tools and API routes are available.
Administrative actions such as account role or status changes are written to an audit log with the acting account, action, target, time and relevant operational metadata. Database credentials and game-server heartbeat secrets are kept in protected server-side configuration or stored as one-way secret hashes and are not included in the public API.
Discord, support and other external services
The Hub links to services that may have their own privacy practices, including Discord and the Emberstone Support Centre. If you follow one of those links, the destination service controls the information it collects there.
If Emberstone later adds analytics, embedded media, payments or another optional third-party service, this notice and the cookie information should be updated before that technology is enabled.
How long information is kept
Normal account sessions are configured to expire after a limited period. If you deliberately choose Remember this device, a separate revocable token can remain for up to 30 days; only a validator hash is stored in the database. Revoked and expired security records are periodically cleaned up.
Account records are retained while the account is active or while they are reasonably needed for security, moderation, support or legal obligations. The latest aggregate heartbeat for each configured game server remains in the database until it is replaced or the server entry is removed. Web-server log retention depends on the hosting environment and should be configured only for as long as it is useful for security and operations.
Your privacy choices
The public website currently uses local browser storage only to remember that the privacy notice has been acknowledged. You can clear that storage through your browser at any time.
You can also open the site's panel to see which categories are in use.
Questions or requests
For a privacy question about an Emberstone service, use the Emberstone Support Centre so the request reaches the appropriate team.