Legal
Everything about what this service does with your data, what it promises, and what it does not. Written to be read rather than clicked past.
Last updated 9 September 2026 · applies to the private beta
This service is not yet a legal entity.
Staex Hosting is currently operated by an individual as a private beta. There is no registered company, no VAT registration, and no payment processing. Nothing is charged, and no card details are collected or stored anywhere.
That means this page is an honest description of current practice, not a contract with a company. Before any money changes hands, these terms have to be replaced by ones written for a real entity and reviewed by a lawyer. Please do not treat anything below as a commercial guarantee.
To be completed before launch.
Swiss and EU law require a service to identify its operator: a legal or natural name, a postal address and a working contact address. That information is deliberately left blank here rather than invented, because publishing plausible-looking business details that are not real is worse than publishing none.
Fill in: operator name · postal address · contact email · company number and VAT number once they exist.
The servers are physically located in Geneva, Switzerland, and are operated directly by the person named above — not by a hosting reseller, and not on infrastructure owned by anyone else.
A virtual machine on hardware in Geneva, with a set amount of processor, memory and disk, its own private network, and a disk encrypted with a key used for nothing else.
What is explicitly not promised during the beta:
The operator can read a running machine.
The browser terminal provides root access inside your virtual machine, and the operator can open it. Disk encryption protects against a stolen or discarded disk; it does not, and cannot, prevent the operator of the hardware from reading a machine that is switched on. Nobody running your workload on ordinary hardware can honestly claim otherwise. Every such access is written to an audit log.
Only what the service cannot work without. There is no profiling, no advertising, and no sale or sharing of data with anyone.
| Data | Why | Kept |
|---|---|---|
| Email address | To identify your account and contact you about your server | Until you close the account |
| Display name | Optional. Labels your server | Until you close the account |
| Password | Stored only as an argon2id hash. The password itself is never written down | Until you close the account |
| SSH public key | Optional. Installed on your server so you can log in | Until you remove it or close the account |
| Your server's size and which machine it runs on | To run and bill it | Until you close the account |
| Audit log of privileged actions | Security. Records what happened, to which server, and whether it worked | Kept after closure — see below |
| Web server access logs | Operating the service and investigating abuse | 7 days, then overwritten |
Not collected: no payment details, no date of birth, no address, no phone number, no identity documents, no marketing profile.
The contents of your virtual machine are yours. The service does not index, scan or analyse them.
Privileged actions are recorded to a log that the application itself has no permission to alter or delete. It records what happened — an account was created, a server was resized, a terminal was opened — against an opaque identifier. It contains no email addresses and no content from inside your machine. It survives account closure, because a security record that can be erased by the person it describes is not a security record.
This site sets no cookies at all, so there is no cookie banner and
nothing to consent to. Your login is held in your browser's
sessionStorage, which is not a cookie, is never transmitted
except when your browser asks this service for something, and is discarded
when you close the tab.
There is no analytics, no tag manager, no pixel, no session recording and no A/B testing. Nothing on this site reports your behaviour anywhere.
The pages of this site load nothing from anyone else — fonts and scripts are served from this server, so no other company sees that you visited. Two third parties are nonetheless involved in delivering the service, and both are named here because omitting them would make the sentence above misleading.
| Who | What they handle | What they can see |
|---|---|---|
| Tailscale (US) | Currently carries public traffic to this service | Connection metadata — that a connection happened, from where, and how large. Traffic is encrypted end to end and decrypts only on hardware in Geneva, so they cannot read its contents. |
| Cloudflare (US) | DNS, and the tunnel that will carry customer web addresses | The same connection metadata, for requests to customer sites. TLS terminates at Cloudflare for those addresses, which means they can in principle see the contents of traffic to a customer's public website — the same arrangement as almost every site behind a CDN. |
Both are being replaced by direct transit into Geneva. Until that exists, the honest statement is that your data is in Switzerland and some connection metadata is not.
Under the revised Swiss Federal Act on Data Protection (nFADP) and, where it applies to you, the GDPR, you may:
The legal basis for holding the data above is performance of the contract you entered into by signing up, and — for the audit log and access logs — the legitimate interest of operating the service securely.
Closing your account, from the button in your own dashboard, does three things in order:
It is immediate and it cannot be undone. There is no recovery period and no backup to restore from.
The machine is yours to use, with a short list of exceptions that exist because everything here shares one internet connection and one reputation:
A server doing any of these may be suspended without notice, because the alternative is every other customer losing their connectivity.
Nothing is charged during the private beta.
Prices are shown so you can see what a plan would cost once billing exists. No payment method is collected, no invoice is issued, and no money is taken. A refund policy for a service that charges nothing would be theatre, so there is not one yet.
Cancellation: close your account whenever you like, from your own dashboard, with no notice period and nothing to ask permission for.
Before charging anyone, this section must say:
the billing period and when payment is taken; the right of withdrawal and how it interacts with a service that starts immediately; what happens to a part-used month on cancellation; whether unused time is refunded; how price changes are notified; and what happens to your data if a payment fails. Under EU distance-selling rules a consumer normally has 14 days to withdraw, and starting the service inside that window requires their explicit acknowledgement — which the signup flow does not currently collect, because it takes no money.
This is a free private beta operated by an individual. It is provided as it is, with the limits above stated plainly rather than buried. Given there are no backups and no uptime guarantee, please do not place anything here that you cannot afford to lose or be without.
Swiss law does not permit liability for gross negligence or intent to be excluded, and nothing here attempts to.
Material changes will be sent to the email address on your account before they take effect, not published quietly on this page. The date at the top is when this was last revised.
Questions about any of this, including a request to see or delete your data, go to the contact address in the operator section above.