Last updated:
Privacy Policy
This Privacy Policy explains how LANBox collects, uses, shares, protects, and retains information when you use varhal.com, the LANBox Dashboard, the LANBox client, tunnel configuration files, APIs, and related services.
1. Who We Are
LANBox provides temporary virtual LAN rooms for Minecraft Bedrock, plus HTTP, TCP, and UDP tunneling. In this policy, "LANBox", "we", "us", and "our" refer to the operator of the LANBox service. You can contact us at [email protected] for privacy requests and data protection questions.
2. Information We Collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email address, password hash, account status, sign-in method, account creation time. | Create accounts, authenticate users, prevent abuse, provide support, and maintain account access. |
| LAN room and tunnel data | Room code, room status, selected region, protocol, subdomain, assigned TCP/UDP port, target host and port, tunnel status, node ID. | Create, route, monitor, troubleshoot, and secure LAN sessions and tunnels. |
| Device and session identifiers | Hashed device identifier, session cookie, login session metadata, client version, coarse device or OS details. | Keep your session active, issue LAN relay tickets, detect duplicate or abusive use, and troubleshoot compatibility problems. |
| Usage and metering data | Daily bytes in/out, tunnel traffic totals, LAN relay traffic totals, quota status, connection status. | Show usage, enforce free limits, detect overload, and operate fair-use and capacity controls. |
| Security and operational logs | IP address, user agent, login events, registration events, error logs, crash or failure events, abuse signals. | Protect the service, investigate abuse, debug outages, prevent duplicate or fraudulent accounts, and keep the network stable. |
| Website analytics | IP address, referral source code, referrer, device category, page views, download clicks, and session duration. | Measure acquisition channels, understand device compatibility, improve the website, and evaluate download conversion. |
| Network content in transit | Traffic passing through LAN relay sessions or HTTP, TCP, or UDP tunnels. | Transmit packets between players, relay nodes, public endpoints, and your local client. We do not use traffic content for advertising. |
| Purchase and billing data | Product and subscription identifiers, purchase tokens, order references, account-binding identifiers, payment and renewal status, subscription expiry, refund records, and entitlement records. | Verify Google Play purchases and subscriptions, prevent duplicate fulfillment, manage public server Slot access, reconcile refunds, provide support, and maintain balances. LANBox does not receive full payment card details from Google Play. |
| Rewarded advertising data | IP address and approximate location, advertising and app-set identifiers, consent choices, app and ad interactions, diagnostics, reward transaction identifiers, and anti-fraud signals processed by Google AdMob. | Show an optional rewarded video, prevent duplicate or fraudulent rewards, and add traffic only after Google verifies completion. |
3. How We Use Information
- Provide LAN rooms, relay tickets, public tunnel endpoints, and route traffic to your authenticated LANBox client.
- Authenticate users, sessions, tunnel tokens, and frp client connections.
- Display Dashboard and app information such as room status, public address, quota, tunnel limits, and traffic usage.
- Operate the Android app's user-initiated Minecraft LAN relay after you explicitly create or join a room.
- Prevent spam, malware, phishing, credential theft, proxy resale, scanning, denial of service, and other abuse.
- Maintain service reliability, debug incidents, measure capacity, and improve product functionality.
- Verify purchases and subscription renewals, grant paid traffic or public listing capacity, and handle billing disputes, cancellation status, or refunds where applicable.
- Show optional rewarded ads and grant traffic after server-side verification when you choose to watch one.
- Comply with applicable law, enforce our Terms, and respond to lawful legal requests.
4. Legal Bases for EEA and UK Users
Where GDPR or UK GDPR applies, we process personal data under these legal bases: performance of a contract to provide the tunnel service; legitimate interests in security, abuse prevention, reliability, and product improvement; legal obligations when we must retain or disclose information; and consent where required for optional communications or non-essential cookies.
5. Cookies and Local Storage
LANBox uses essential cookies for login sessions, account security, and recently generated token display. The language selector may store your preferred language in the browser. We do not need cross-site advertising cookies to operate the service.
6. Android App and Foreground Service
The LANBox Android app can create a temporary virtual LAN connection so players on different networks can join the same Minecraft Bedrock world. Current Android releases do not create a device-wide VPN and do not use Android's VpnService framework. LANBox uses app-scoped network sockets and a foreground service notification while a room connection is active. The relay starts only after user action, such as creating or joining a room, and can be stopped by the user at any time.
LANBox processes the Minecraft discovery, connection, and gameplay packets needed to connect room participants. The selected relay server processes those packets transiently to deliver them to the other participants; packet contents are not retained. Because LANBox does not create a device-wide VPN, unrelated application traffic and general web browsing are not routed through LANBox. We do not inspect unrelated browsing, inject ads, sell browsing behavior, or redirect unrelated traffic for monetization.
7. Sharing and Subprocessors
We do not sell personal information. We may share information with infrastructure, hosting, DNS, security, analytics, email, storage, payment, authentication, and support providers when needed to operate LANBox. This may include providers that help us process Google sign-in, email delivery, hosting, Google Play purchases and subscriptions, and Google AdMob advertising. Their processing is also subject to their applicable terms and privacy notices. We may disclose information if required by law, to protect users or the service, or in connection with a merger, acquisition, financing, or sale of assets.
8. International Transfers
LANBox is a global service. Your information may be processed in countries other than where you live. When legally required, we use appropriate safeguards such as contractual protections, security controls, and transfer assessments for international processing.
9. Data Retention
| Data | Typical retention |
|---|---|
| Account, LAN room, and tunnel records | For the life of the account, then deleted or anonymized unless needed for legal, security, abuse, or fraud prevention reasons. |
| Usage counters | Retained while needed for quota enforcement, billing readiness, abuse prevention, and operational reporting. |
| Purchase records | Retained while needed to support purchased balances, accounting, dispute handling, fraud prevention, and legal compliance. |
| Security logs and audit events | Retained as long as reasonably needed to protect the service, investigate abuse, and meet legal obligations. |
| Website analytics | Retained while reasonably needed for product analysis, security, and acquisition reporting, then deleted or aggregated. |
| Temporary plain tokens or room join secrets | Shown only for a short setup window where possible. Users should rotate keys or recreate rooms if credentials leak. |
10. Security
We use access controls, hashed passwords, token-based client authentication, operational monitoring, rate limits, and abuse controls. No internet service can guarantee perfect security. You should avoid sending secrets, regulated production data, or highly sensitive content through free tunnels or game relay sessions unless you have independently assessed the risk and protected the traffic end to end where appropriate.
11. Your Privacy Rights
Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal information. EEA and UK users may also lodge a complaint with a data protection authority. California and other US state privacy laws may provide rights to know, delete, correct, access, portability, opt out of certain sharing or targeted advertising, limit use of sensitive information, and not be discriminated against for exercising privacy rights.
To exercise rights, contact [email protected] or follow the account deletion instructions:https://varhal.com/account-deletion. We may need to verify your identity and account ownership before fulfilling a request. We will respond within the time required by applicable law.
12. California Notice
In the last 12 months, LANBox may have collected identifiers, internet or network activity, commercial or account activity, approximate location derived from IP address, and inferences related to service security, abuse prevention, or capacity management. We collect this information for the business purposes described in this policy. We do not sell personal information for money. If we ever introduce activity that qualifies as "sale" or "sharing" under California law, we will provide the required notice and opt-out mechanism.
13. Children
LANBox is not intended for children under 13, and it is not directed to children under 16 in the EEA or UK. If you believe a child provided personal information to LANBox, contact [email protected] so we can review and delete it where required.
14. Abuse, Law Enforcement, and Emergency Requests
Tunnels can expose public endpoints. We may suspend tunnels, preserve relevant records, or disclose limited information when we believe it is necessary to prevent abuse, protect users, secure the service, comply with legal process, or respond to emergencies involving risk of harm.
15. Changes
We may update this policy as LANBox changes. Material changes will be reflected by updating the effective date and, when appropriate, by providing additional notice in the Dashboard or on varhal.com.
16. Public Listings and Advertising Choices
When you publish a public listing, its name, host address, and port are visible to other users. Do not include private information you do not want to make public. Third-party server operators may separately process connection information under their own policies.
Rewarded advertising is optional. Where applicable, the app presents Google's privacy message and provides advertising privacy options so you can review your choices. AdMob may process data for personalized or non-personalized advertising, measurement, fraud prevention, and security, subject to applicable settings and requirements. Verified reward callbacks determine whether to credit your account.
Account deletion does not itself cancel a Google Play subscription. Some billing, refund, fraud-prevention, or legally required records may need to be retained after deletion. See the account deletion page for instructions and retention information.
17. Contact
Support: [email protected]. Privacy requests: [email protected]. Security reports: [email protected]. Abuse reports: [email protected].