Privacy policy

This policy explains what the platform does with your information, why it needs it, how long it keeps it, and what you can ask for.

One thing goes first because it is the most easily misunderstood: the platform does hold the SSH private key and connection key for your instance, and it does see the names of processes running inside it. Neither is an accident — sections 3 and 4 below set out exactly what they are, what they are for, and what they are not for.

1. What this policy covers

It covers the information the Shulan GPU rental platform handles while you use it: accounts, orders, rentals, connections, billing and violation detection. It changes nothing in the terms of service — read the two together.

2. What the platform collects

Category	What it is	What it is for
Account	Username, an irreversible hash of your password (no plain-text password is stored), account role	Signing in, telling users from administrators
Money and orders	Top-ups, orders, rentals and wallet ledger entries (every amount exact to 0.000001)	Billing, settlement, refunds and reconciliation
Connection credentials	The instance's SSH private key, any public key you paste in, the rental's connection key	So you can reach your own instance — see section 3
Instance state	Instance status, system image, CPU and memory size, the progress text of the last operation	Page display, power and reinstall actions, troubleshooting
Violation detection	The command name and full arguments of the 15 processes using most CPU inside the instance, sampled roughly every 60 seconds (only while the instance is running)	Only to identify prohibited conduct such as mining — see section 4
Security and audit	Sign-in times and source IPs, and records of orders, releases, administrative actions and violation findings	Security, evidence in disputes, responding to lawful requests

The platform does not ask for and does not collect your ID number, bank card number, face or contacts. A top-up channel may keep payment details of its own, and that part falls under the channel's own privacy policy.

3. Why the platform holds your private key

The platform generates an SSH key pair for each instance and keeps the private key on the platform, so that these things hold:

You can see and download the private key on the page at any time — change computer or reinstall, and the key is still there.
After a reinstall the platform can put the public key back, and nothing in your local setup has to change.
The page can generate the ssh config snippet for you to paste, instead of you assembling it.

You can turn this convenience down: paste your own public key in the instance details and the platform stops holding a private key for you. The trade-off is that if you lose that key, the platform cannot help you get back in.

4. The process list: only to catch violations

A resident program on the owner's machine runs ps roughly every 60 seconds, takes the 15 highest-CPU lines inside the instance (only while the instance is running), and reports the command name and arguments.
The platform matches that against a list of miner and mining-pool signatures. The list is deliberately narrow — only actual miner program names and pool protocol prefixes, never short words such as “miner” that collide with normal software. Missing a case beats accusing a machine that is doing honest work.
On a hit the platform stops the instance, blocks power-on and records the finding — see section 6 of the terms of service.
This data is used for nothing else: no profiling, no analysis of your business, no handing it to a third party, and no comparing it against anyone else.

5. What the platform does not do

It does not go looking through the business files, training data, models or code inside your instance.
It does not sign into your instance with your private key to see what you are doing — its job is to complete authentication when a connection is started from your side.
It does not sell or rent your personal information, and runs no advertising.
It does not use your process samples for anything beyond violation detection.

6. When information goes to a third party

Delivery and protection: the site is served through Cloudflare, so your source IP and requests pass through it, under its own privacy policy.
Top-up channels: the payment channel you use handles what that payment requires.
Legal compulsion: where public security, a court or another competent authority makes a lawful request, the platform provides what is required within the legal scope and requires the proper legal process.
Beyond that, it goes nowhere.

7. How long it is kept

Account and money records: kept while the account exists. Money-related records have to be kept for a period after an account is closed, as the law requires.
Data inside an instance: destroyed with the instance when the rental ends — no backup, no copy.
Security and audit logs: currently kept indefinitely and not deleted automatically, for investigating security incidents and settling disputes.

8. Cookies

The platform uses only the cookies needed to keep you signed in. No advertising, no cross-site tracking. Your password is never kept in the browser, and signing out clears the session.

9. Your rights

See and correct: your account details are visible on the console pages; contact an administrator for corrections.
Export billing: wallet ledger and rental records are readable on the page at any time.
Close the account: ask an administrator. Release any rental you still hold and clear the balance first.
Appeal a finding: if you believe a violation finding is wrong, ask an administrator to review it.

10. Minors

The platform is not offered to anyone under eighteen. If a minor is found using it, the account is closed.

11. Updates to this policy

Updates are published on this page. For a change that materially widens what is handled, the platform will say so on the site. If you keep using the platform afterwards you are taken to accept the updated version.

12. Contact us

For questions about this policy, to exercise any of the rights above, or to make a complaint, contact a platform administrator from the console. Reporting prohibited content goes the same way, and the platform will check and act on it.

Related: Help centre · Terms of service · Legal notice