Privacy Policy

DediForge - Game Server Management Tool

Last Updated: August 22, 2026

OffByThree LLC ("Company", "we", "us", or "our") makes DediForge ("Software"). This Privacy Policy explains what information the Software handles, where it goes, and what choices you have. We have tried to describe every network connection the Software makes, because that is what most people actually want to know.

Summary

• No account, no sign-in. You never register with us to use the Software.
• No telemetry or analytics. The Software does not report usage statistics, crash reports, or which games you run.
• Your configuration stays on your computer. Server settings, logs, and backups are stored locally and are not synced anywhere.
• One optional feature sends data to us: Connection Cards. When you create a Connection Card, an encrypted copy of your server's address and password is stored on our service for up to 24 hours so players can redeem the card. We cannot read it; only someone holding the card image can. Details in Section 3.
• The Software downloads tools and game files from third parties (Valve/Steam, Mojang, Eclipse Adoptium, playit.gg, GitHub) and looks up your public IP address using public "what is my IP" services. Details in Section 4.

1. Information We Do Not Collect

The Software does not:

• Ask for or collect your name, email address, or other personal details
• Send usage statistics, telemetry, or crash reports to us
• Track which games you install or which servers you run
• Monitor your server activity or which players connect
• Use cookies, advertising identifiers, or tracking technologies
• Sell or rent any information to anyone

2. Information Stored on Your Device

The Software stores the following locally, in your user profile's application-data folders:

• Server configurations — names, settings, install locations, port numbers, and any server or admin passwords you enter. Passwords are stored in plain text in the local database so the Software can pass them to the game server; protect access to your computer accordingly.
• Application preferences — theme, window layout, feature toggles.
• Server logs — game server console output, kept locally for troubleshooting.
• Backups and bundles — ZIP archives of your server's save data and configuration, created only when you ask for them or enable scheduled backups.
• Steam sign-in session (optional) — if you sign in to Steam to download a game that requires ownership, SteamCMD stores its own session files in the Software's data folder. Your Steam password is passed to SteamCMD for that sign-in and is not saved by the Software.
• playit.gg agent configuration (optional) — if you use playit.gg tunnels, the agent's account secret is stored locally.
• Connection Card records (optional) — for each card you create, the card's retrieval token and a per-card management key so the Software can show the card's status and revoke it.

None of this leaves your device unless you export it (for example, sharing a server bundle) or use a feature described below.

3. Connection Cards (Optional Feature Operated by Us)

Connection Cards let you share a PNG image that players can drop onto connect.dediforge.com to get your server's address, port, and password. This is the only feature that stores anything on infrastructure we operate.

What is sent and stored. When you create a card, the Software encrypts your server name, game name, public address, port, and password on your computer with a key generated for that card alone. Only the encrypted blob is uploaded to our service, along with a per-card management key used to check status or revoke the card. The decryption key is embedded in the card image and is never sent to us. We cannot read the contents of a card.

Retention. Encrypted card data is deleted automatically after 24 hours or when its retrieval limit is reached, whichever comes first. You can revoke a card at any time from the Software, which deletes it immediately.

Who can redeem a card. Anyone who has the original PNG file can redeem it, up to the retrieval limit you chose. Treat the image like a password.

Technical logs. Our service provider (Vercel, with data stored in Upstash) may keep standard request logs including IP addresses for a limited period for security and abuse prevention, and we rate-limit requests by IP address. We do not use these logs for any other purpose.

4. Third-Party Connections the Software Makes

The Software does not currently check for application updates over the network. If a future version adds an update check, it will send only the installed version number and this policy will be updated.

5. Security

• Connection Card contents are encrypted with AES-256-GCM using a key that exists only on your computer and inside the card image.
• Downloads from the services above use HTTPS.
• Local configuration, including game server passwords, is stored unencrypted in your user profile. Use unique passwords for game servers and keep your computer's user account protected.
• Running a game server opens network ports on your machine. Keep servers updated and use server passwords where the game supports them.

6. Children's Privacy

The Software is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information through a Connection Card, contact us and we will delete it.

7. Data Retention

• On your device: until you delete it through the Software, uninstall the Software, or remove its data folders.
• On our Connection Card service: encrypted card data for at most 24 hours; service request logs for the limited period kept by our hosting providers.

8. Your Rights and Choices

• You control all local data and can view, export, or delete it through the Software.
• You can revoke any Connection Card from the Software, which deletes its data from our service immediately.
• You can avoid every third-party connection in Section 4 except Steam by not using the corresponding feature (Connection Cards, tunnels, Java-based games, public-IP display).

If you are in the European Economic Area, the United Kingdom, or California, you have rights to access, correct, delete, and port personal data we hold and to object to certain processing. Because we hold only encrypted Connection Card data we cannot decrypt, and short-lived request logs, the practical way to exercise these rights is to revoke your cards in the Software or contact us at the address below. We do not sell personal information.

Legal basis (GDPR): performance of the service you request (Connection Cards) and our legitimate interest in keeping the service secure (rate limiting and request logs).

Data controller: OffByThree LLC, for the Connection Card service only. For everything stored on your device, you are in control.

9. International Transfers

The Connection Card service runs on infrastructure in the United States. By creating a card you are sending encrypted data there. Third-party services listed in Section 4 have their own data locations and policies.

10. Changes to This Policy

We may update this policy as the Software changes. The "Last Updated" date at the top reflects the current version. For significant changes we will note them in release notes and on our website or store page.

11. Open Source Components

The Software is built with open source components listed in THIRD_PARTY_LICENSES.md. Those components do not send data to their authors.

12. Contact

OffByThree LLC Email: privacy@offbythree.com

This Website

This website uses Vercel Web Analytics to count page views. It does not use cookies, and it does not collect personal information or track you across other sites; Vercel reports visits only in aggregate. The Connection Card page decrypts cards in your browser; the card's key is never sent to our server.