Voxelius Hosting

Privacy Policy

Last updated: September 2026

Voxelius Hosting ("we," "us," "the app") lets you run a Minecraft server directly in your browser, with your world data stored in your own Google Drive. This page explains what data we access, what we do with it, and what we deliberately do not do.

1. What we access, and why

When you click "Connect Google Drive," we request the drive.file OAuth scope from Google. This is a narrow, Google-defined permission level that only lets an app see or modify:

• Files and folders that our app itself created in your Drive (a top-level "Voxelius" folder, and a subfolder per server you create), and
• Files you explicitly select and grant access to via Google's own file picker dialog (used when you take over hosting a server someone else created, so you can access its folder).

We cannot see, list, read, or modify any other file or folder in your Google Drive. This is a technical limitation of the scope Google grants us, not just a policy promise.

2. What's stored where

• In your Google Drive (under your control, not ours): your Minecraft world files, server configuration, and a hashed copy of your server's passwords.
• In our database (Supabase, used to run this service): your Server ID, a bcrypt-hashed (never plaintext) copy of your boot/admin passwords, your chosen server software/version/memory settings, and short-lived session records used to coordinate who is currently hosting a server (so two people can't host the same world at once). None of this includes your Google account identity, email, or any Drive file contents.
• Never stored by us: your Google OAuth access token (it lives only in your browser's memory for the duration of your session), your Drive file contents, or your Google account information of any kind.

3. How your Google access token is used

After you connect Google Drive, your browser holds a short-lived access token (issued directly by Google, expiring roughly every hour) and uses it to read/write files directly against Google's own Drive API. This token is never sent to or stored on our servers — all Drive reads/writes happen directly between your browser and Google.

4. Sharing your server's folder with other hosts

If you choose to let someone else host your server later, you can share that one server's Drive folder link with them. This sets that specific folder to "Anyone with the link: Editor" — this is an action you take deliberately per-server, visible in your own Google Drive sharing settings, and it never affects your other servers or the rest of your Drive.

5. Third parties

We do not sell, rent, or share your data with advertisers or data brokers. The only third-party services involved in running Voxelius Hosting are:

• Google (Drive storage, OAuth sign-in) — governed by Google's own Privacy Policy.
• Supabase (database + backend functions) — stores only the session/password metadata described in Section 2.
• Mojang/PaperMC — server software is downloaded directly from Mojang's and PaperMC's own public APIs when you create a server.

6. Revoking access

You can revoke Voxelius Hosting's access to your Google Drive at any time, independent of us, via Google Account → Third-party apps & services. Revoking access does not delete your world files — they remain in your Drive, since they were always yours; you just won't be able to host that server through our app anymore unless you reconnect.

7. Children's privacy

Voxelius Hosting is not directed at children under 13, and we do not knowingly collect data from them beyond what's described above (which, per Section 2, excludes any personal identity data in the first place).

8. Changes to this policy

If this policy changes in a way that affects what we access or store, we'll update the date at the top of this page. Continued use of Voxelius Hosting after a change means you accept the updated policy.

9. Contact

Questions about this policy or your data can be sent to the support email listed on our Google OAuth consent screen for this app.