1. Subject matter and duration
The subject matter is the analytics service described in the Terms. Processing lasts as long as your network is connected, plus the time needed to delete backups on their normal schedule.
2. Nature and purpose
We collect telemetry from your connectors and store it per network so the dashboard can answer where players came from, whether they returned, what they did, and what they spent. We do not process it for any other purpose, we do not sell it, and we do not combine it with another network data.
3. Data subjects and categories of data
| Data subjects | Categories of personal data |
|---|---|
| Players on your network | Username, Minecraft UUID or Floodgate XUID, identity type, connection hostname, join and leave times, session length, backend server name, Minecraft version and client brand, confirmed cheat bans with the check that fired, a two letter country derived from the IP address at ingest, and a keyed hash of that IP address, the last two only when your connector sends an address |
| Players on your network, inside one session | Player events: command labels, chat length buckets and character counts, deaths with the damage cause, kills with the victim UUID and the item held, advancements, world and game mode changes, teleports by destination world, respawns, kicks with the message your server showed, switches between backend servers, the client language tag and view distance read at login, and the counts for the whole session. Chat message text and full command lines only while you switch text collection on |
| Buyers in your Tebex store | Premium UUID, transaction id, amount paid and list price, currency, package names, creator code, and coupon codes |
We receive no special category data, no inventories, no coordinates, and no payment card data from your network.
Chat message text and full command lines are processed only on your documented instruction. That instruction is the Collect chat and command text switch in Settings, which is off until you turn it on. Turn it off and the connector stops sending them within one heartbeat. Whether it is on or off, the connector never sends the arguments of a login, password, or private message command.
Chat text and command lines are erased 30 days after the event. The rest of the player event stays under the retention of the session it belongs to.
4. Your instructions
We process player data only on your documented instructions. What you configure in your connector and in the dashboard is that instruction. We tell you if an instruction looks unlawful to us rather than carrying it out quietly.
5. Confidentiality
Everyone with access to your data is bound to confidentiality and gets access only where the work needs it.
6. Security measures
These are the measures the running system actually applies. We do not list controls we have not built.
- Player IP addresses, when sent at all, are replaced with a keyed HMAC-SHA256 hash under a per-network key before storage. The raw address is discarded and never written.
- The keyed hash is cleared from each session 30 days after the join, by a cleanup that runs once a day.
- The country is derived from that address before it is discarded, and is stored as a two letter ISO 3166-1 code. No region, city, postcode, or coordinate is derived or stored. The lookup reads a DB-IP Country Lite file held on our own server, so no address is sent to DB-IP or to anyone else.
- The connector keeps the address in memory only. The copy of a report it saves to disk while it waits to send has no address.
- Every server-side query derives its network scope from the authenticated request. A network id from the browser is never trusted on its own.
- Connector credentials are per server, are stored as digests, are revocable from the dashboard, and rotate by pairing again. Pairing codes expire after ten minutes and are single use.
- The ingest API refuses any request that did not arrive through the trusted edge proxy, and applies rate limits before and after authentication.
- Tebex deliveries are accepted only on a per-network address and only with a valid signature. Stripe webhooks are verified the same way. The Tebex webhook secret is stored encrypted, under a key kept outside the database.
- Public traffic reaches the service through a Cloudflare Tunnel. The host opens no inbound port to the internet or to the local network, and TLS is terminated before anything reaches the application.
- Database backups run nightly and are deleted after 14 days.
We do not claim disk level encryption, a certified security standard, or a formal penetration test, because we have not done them.
7. Subprocessors
You give general authorisation for the subprocessors below. We give you notice before we add or replace one, and you may object and terminate if you do not accept the replacement.
| Subprocessor | Purpose |
|---|---|
| Cloudflare | Edge network for the site and the ingest API |
| Google sign-in for dashboard users | |
| Discord | Discord sign-in for dashboard users |
| Resend | Magic link email delivery |
| Stripe | Checkout, card handling, and subscription state |
Tebex is not our subprocessor. It is your store provider and a source of purchase events we receive from it under your own arrangement with them.
DB-IP is not our subprocessor either. We download its free country database and read it on our own server. No player data is sent to DB-IP at any point.
8. International transfers
The subprocessors above operate in and outside the European Economic Area. Where they process data outside it, they do so under their own published transfer mechanisms, including the standard contractual clauses.
9. Player requests
Requests from your players come to you, because you are the controller. Tell us and we help you answer them: we export what we hold on a player, and we delete a player or a whole network on request from the owner account. The owner can also export the whole network from Settings, Data and privacy, and delete it from Settings, Danger zone. For a single player there is no button yet: we run it for you and answer within 30 days.
10. Breach notification
If we become aware of a personal data breach affecting your network, we tell you without undue delay and give you what you need for your own notification duties.
11. Deletion and return
When your network is closed, or on request, we delete the network data. The owner can also delete it at any time from Settings, Danger zone. Copies inside existing backups go when those backups reach their 14 day age and are deleted. Ask before deletion if you want an export, because deletion is final.
12. Audit
On reasonable request we answer questions about how we process your data and give you the information you need to show compliance. We are a small team, so this is a conversation and documents, not a site visit.
13. Contact
Data protection questions and requests go to [email protected].