Privacy Policy

Iron Balkans is the data controller for the limited information processed through the Services. You can contact us about privacy matters at [email protected] or Telegram (@ironbalkansnews).

We do not encrypt your VM disks. You are free, and encouraged, to encrypt sensitive data yourself.

We do not inspect or modify the data on your server's disk without your explicit permission, unless we are legally compelled to. When alerted by a complaint, we may, however, check public services you expose from your Service, such as an FTP or HTTP server, in order to investigate the report.

The strongest protection for data is never to have it. To open and use an account, none of the following is required, requested or stored:

• No email, name, postal address or phone number at sign-up — the account is created from a password alone.
• No government-issued ID, KYC or identity verification of any kind.
• No advertising identifiers, no third-party analytics, and no fingerprinting or tracking scripts. Fonts are self-hosted, so your browser never calls out to a CDN.
• No record of what happens inside your VPS: we do not monitor, log or inspect the network traffic it sends, the DNS queries it makes, or the files on its disk.
• No customer IP address in plaintext. Where a connection IP is retained at all, it is only ever a salted, one-way hash, kept briefly, and it can be switched off entirely.

Because this information is never gathered in the first place, it cannot later be leaked, sold, or handed to anyone — not even to us.

We only store data that is essential to provide the Services, keep them secure, process payments and meet our legal obligations. Rather than describe this in vague terms, the tables below show exactly what is recorded for each action. Field names are simplified for readability and the values shown are illustrative and masked — real hashes, secrets and keys are never displayed anywhere.

What is recorded when you create an account?

Sign-up stores only a random account ID and one-way hashes of your password and recovery key — never the password or key themselves, and the hashes cannot be reversed. No email, name, phone number or identity document is requested or kept.

Two more fields exist only if you choose to add them, and are always encrypted at rest (AES-256-GCM), never in plaintext: a contact method so we can reach you with service or abuse notices, and a two-factor secret. Both are optional and can be removed at any time.

What is recorded when you add funds or pay?

Topping up your balance with cryptocurrency stores what is needed to confirm the payment and keep your billing history consistent — including the payment address issued for the invoice and a reference from the payment processor. Bitcoin and Litecoin are public blockchains outside our control; Monero (XMR) is recommended where on-chain privacy matters to you.

What is recorded when you deploy a service?

For each VPS, we store the information needed to run and manage it. We also keep a history of VPS IP addresses, so we can reuse them fairly and deal with abuse. We also store its internal location and any SSH key you add. The data on your VPS stays yours — we do not read or encrypt it.

What is recorded when you sign in?

A session keeps you signed in to the control panel. It is stored only as a hash of the session token — never in a form that could be used to sign in as you. Any connection IP is kept only as a salted, one-way hash, for a limited period, and can be switched off entirely.

What is recorded when you contact support?

Only what you voluntarily send us by email or Telegram, kept so we can help you. Please do not send passwords, recovery keys, cryptocurrency seed phrases or unnecessary personal data.

We use only the minimal browser storage (such as localStorage) required for essential functionality, for example to keep you signed in to the control panel. We do not use cookies for tracking or analytics, and fonts are self-hosted so your browser does not make requests to third-party font or CDN providers.

• To provide, maintain and provision your Services.
• To process cryptocurrency payments and manage your account balance.
• To secure our network and to prevent, detect and investigate abuse and fraud.
• To respond to your support requests.
• To comply with legal obligations that apply to us under Romanian and EU law.

Where the General Data Protection Regulation applies, we rely on performance of our contract with you (to deliver the Services), our legitimate interests (to secure our network and prevent abuse), and compliance with a legal obligation.

We do not sell your data and do not disclose customer information outside IronBalkans unless required by law or approved by you beforehand. Limited sharing occurs only where necessary:

• With infrastructure and data-centre providers, strictly to the extent necessary to operate the Services.
• With authorities, only in response to valid legal process under Romanian law. We do not automatically comply with foreign requests.

Our infrastructure is located in Romania, within the European Union, and data is primarily processed within the EU.

We keep account and service data while your account is active and for a limited period afterwards, as necessary to meet legal, accounting and abuse-prevention obligations. Security and connection logs are retained for a limited period and then deleted or anonymised.

We apply technical and organisational measures to protect information, including encryption of traffic in transit and hashing of authentication credentials. Our servers use disk redundancy (such as RAID6 or RAID10), which reduces the risk of hardware-related loss but is not a backup. No system is perfectly secure, and you remain responsible for safeguarding your password and recovery key, which are essential to protecting your account.

Where the GDPR applies, you have rights to access, rectification, erasure, restriction, objection and portability regarding your personal data.

Please note a practical limitation that follows from our privacy-first design: because accounts are anonymous, we often cannot identify you or link data to a real-world identity, and we cannot verify who you are without your account credentials. Exercising certain rights may therefore require you to authenticate with your account.

The Services are intended for adults and are not directed to children. We do not knowingly provide services to minors.

We may update this Privacy Policy from time to time. Active customers will receive at least 7 days of notice before any significant change takes effect. The date of the latest revision is shown at the top of this page.

For any privacy question or request, contact us at [email protected] or Telegram (@ironbalkansnews).