Privacy Policy — Shadow Controller
Last updated: 25 August 2026
Shadow Controller is an Android companion app for Shadow Server Manager, a self-hosted tool for administering ARK: Survival Ascended game servers. It is published by Shadowhunter Systems.
This policy explains what the app collects, where that information goes, and how long it is kept.
The most important thing to understand
Shadow Controller does not send your data to us.
The app talks only to a Shadow Server Manager host that you or your server operator runs. That host is not operated by Shadowhunter Systems. We do not host it, cannot access it, and receive no copy of anything stored in it.
When you pair the app, you choose which host it connects to. Everything the app reads or writes — servers, players, commands, messages — lives on that host, under the control of whoever administers it. If you want to know how your data is handled in practice, ask the operator of the host you paired with.
The single exception is push notifications, described below.
What the app stores on your phone
Held in Android's encrypted storage (expo-secure-store), private to the app:
- The address of the host you paired with
- Your device access token
- Your device identifier
This is removed when you uninstall the app or unpair the device.
What the app sends to the host you paired with
When you pair, and periodically while you use the app:
| Data | Why |
|---|---|
| A device name you choose (e.g. "Kevin's Pixel") | So the operator can tell devices apart and revoke the right one |
| Platform and app version | Compatibility checks and update prompts |
| A push notification token | So the host can send you alerts |
| Last-seen timestamp | So the operator can see which devices are still active |
Your identity on the host is the account you were signed in as when the pairing code was generated. The app does not create a separate account and does not ask for a password.
Access tokens and pairing codes are stored on the host as SHA-256 hashes, never in readable form. They can be checked but not recovered.
Commands you run through the app (such as RCON commands) are recorded in the host's audit log, along with which device issued them. This is a deliberate accountability feature: server administration actions are attributable.
Messages sent through the in-app admin chat are stored on the host and automatically deleted after 30 days.
Push notifications
This is the only part of the app that involves anyone outside you and your operator.
To deliver a notification, the host sends it to the Expo Push Service, which passes it to Google Firebase Cloud Messaging, which delivers it to your phone. Both are third-party services, and the notification's title and body pass through them.
Notifications are short operational messages — for example, "Island is offline" or an admin chat message. Do not treat a push notification as a private channel.
Expo's privacy policy: https://expo.dev/privacy Google's privacy policy: https://policies.google.com/privacy
Camera
The app requests camera access for one purpose: scanning the QR code that pairs your device with a host.
Images are never stored, never saved to your photo library, and never transmitted anywhere. The camera is active only while the pairing screen is open.
What the app does not do
- No analytics or usage tracking
- No advertising, and no advertising identifiers
- No third-party trackers or SDKs
- No location, contacts, microphone, or file access
- Nothing is sold, rented, or shared for marketing
The app requests only these Android permissions: internet and network state, camera (QR pairing), notifications, and the standard permissions needed to receive and display them.
Demo mode
The app includes a demo mode that runs entirely on your device using fictional sample data. In demo mode the app makes no network requests and stores nothing. You can evaluate it without pairing to any host.
Retention and deletion
Data on the host is retained by that host's operator. In the software as shipped:
- Admin chat messages are deleted after 30 days
- Device records persist until revoked, and revoked records are kept as an audit trail
- Audit log entries persist for accountability
To remove your device: unpair it in the app, or ask your operator to revoke it. Revoking a device immediately ends its access.
To delete your data entirely: contact the operator of your host. Because we do not hold your data, we cannot delete it for you.
Children
Shadow Controller is a server administration tool intended for adults. It is not directed at children and we do not knowingly collect information from anyone under 13.
Security
Access tokens and pairing codes are hashed on the host. Pairing codes expire and are single-use. Tokens are stored in Android's encrypted storage. Every request is checked against both the operator's role permissions and per-device limits, and a device can never be granted more access than the account behind it.
Whether traffic between the app and your host is encrypted depends on how your operator has configured it. Shadow Server Manager can be run behind HTTPS, but does not require it. If you are connecting over the public internet, ask your operator whether HTTPS is enabled.
Changes
If this policy changes materially, the "last updated" date above will change and the revised policy will be posted at this URL.
Contact
Questions about this policy: kevin@castlevosloo.co.za
For questions about data held on a specific server, contact that server's operator — we do not have access to it.