Security and player privacy

In short

• The connector sends usernames, UUIDs, join addresses, session times, game events and server stats. It never sends passwords, private messages, coordinates or inventories.
• Chat text and full command lines are off until the network owner turns them on, and are blanked after 30 days.
• A player's IP address is never stored. We keep the country and a keyed hash, and the hash goes after 30 days.
• Lag profiling is off until the network owner turns it on, and it needs the Network plan or up. When it is on, Spark uploads a profiler report to spark.lucko.me as an unlisted link that anyone with the URL can open. We store the link and never receive the report.
• Only the people you add to your network see its data. Nothing is sold, there are no ads, and players are never combined across networks.
• The database disk and its backups are not encrypted today. Secrets and tokens inside it are hashed or encrypted.

What each connector sends

The Velocity connector runs on your proxy and records sessions. The Paper connector runs on each backend and records what players do there. A Paper server with no proxy in front records the session itself.

Lag profiling is a setting only the network owner can change. It is off until they turn it on, and it is locked on the Community and Starter plans. While it is on, a Paper server that stays below the lag thresholds asks Spark to profile itself, and Spark uploads the report to spark.lucko.me as an unlisted link. Anyone who has the link can open the report, and a report can list your plugins and some of your server settings. We store the link and the numbers above. We never receive the report itself.

Player events are held in memory and sent once, when the player leaves the server. Our receiver checks every event against a fixed list of kinds and fields and refuses anything else, so a changed or tampered connector cannot add coordinates or an inventory to a report.

What stays on your server

• Passwords and private messages. The arguments of these commands are dropped inside the connector, whatever the owner switches on: login, l, register, reg, changepassword, changepass, cpw, unregister, 2fa, totp, email, password, pass, msg, tell, w, whisper, r, reply, pm, mail.
• Chat text and full command lines, unless the owner turns on Collect chat and command text in Settings. It is off until they do, and a chat message is otherwise sent as its length alone.
• Spark reports. The connector starts no profile until the owner turns lag profiling on. Once it is on, the report goes from your server to spark.lucko.me, not to us, and only its link reaches us.
• Coordinates. They are never read: a teleport is reported by world name.
• Inventories. A kill names the item in the killer's hand and nothing else.
• The IP address on disk. The connector keeps it in memory only, and the copy of each report it saves to disk has no address.
• Your connector token. It stays in credential.json, which the connector limits to the server's own user where the file system allows it, and so is the file of reports waiting to be sent.

Player IP addresses

The Velocity connector sends each player's IP address with the session. The Paper connector sends it only when track-ip-address is true in its config.yml, and it ships set to false. A Paper server behind Velocity never needs it.

On our server the address is used for two things and then dropped. The country is read from a DB-IP Country Lite file on our own server, with no request to anyone. Then the address is replaced by an HMAC-SHA256 hash under a key that belongs to your network alone. The address itself is never written to the database.

We store the two letter country and nothing finer: no region, no city. A cleanup that runs once a day clears the hash from every session 30 days after the join.

The hash is not anonymous. It is used to spot duplicate sessions and abuse inside your network, and because the key is different for every network, the same player cannot be matched across two networks through it.

Encryption and hashing

In transit: every request between your servers, your browser and MCAnalytics uses HTTPS. The connector only talks to https://mcanalytics.org, and that address cannot be changed in its config. The site tells browsers to use HTTPS only, for a year, subdomains included. Cloudflare ends HTTPS at its edge and carries the request to our server through a Cloudflare Tunnel, so the server opens no inbound port to the internet.

Not encrypted today: the database disk and the nightly backups. They stay on the one server we run. We would rather say that than let the lines above suggest otherwise.

Every connector jar is signed with our release key (Ed25519). From loader 1.0.4, before the loader runs a connector it downloaded, it checks the file's SHA-256 digest and size against the release manifest and checks the signature against the public key built into the loader. It refuses a file that fails any of these, and keeps running the connector it already has.

Who can see the data

• Your dashboard: only the accounts you add to your network, as owner, admin or viewer. Only the owner can export the data or delete the network.
• Other customers: never. Every query checks the network against your signed in session or your token, a network id from the browser is never trusted on its own, and players are never combined across networks.
• People at MCAnalytics: our operator console is not on the public site. It answers only on our private network and shows networks, members, plans and counts, never a list of your players.
• The people who run MCAnalytics can reach the server and its database. They are bound to confidentiality and open your data only when the work needs it, such as an export or a deletion you asked for.
• Nobody else: we do not sell data, show ads, or run a third party tracking script on the site or in the dashboard.

How long we keep it

Export and deletion

• Export: the owner downloads every row the network holds as one JSON file, from Settings, Data and privacy. Secrets, token digests and IP hashes are left out.
• Delete the network: the owner types its name in Settings, Danger zone. The subscription is cancelled first, then every row goes in one step.
• One player: write to [email protected] from the owner account. We replace that player's username with an anonymous label and remove their UUIDs, IP hashes, chat text and command lines, and the UUID on their purchases. The counts stay. We answer within 30 days.
• Stop new data: revoke a server or disconnect Tebex in Settings and nothing new arrives from it.

Hosting and subprocessors

MCAnalytics runs on one server we operate ourselves. These services can see data on its way:

Tebex is your store, not our subprocessor: it sends us your purchase events. DB-IP makes the country file we read on our own server; no player data is sent to DB-IP.

spark.lucko.me is run by the Spark project, not by us, and is not our subprocessor. Your server sends it a report only when the network owner turns lag profiling on.

Report a security problem

Write to [email protected] with what you found, the steps to reproduce it, and which part it affects: the site, the dashboard, the connector or the loader. For the open source loader you can also open a private security advisory on GitHub.

We confirm we got it within 3 working days and update you at least every 7 days until it is closed. Please give us 90 days before you publish.

Test against your own network and account only. Do not read other people's data, slow the service down, or try to trick our staff.

• Loader security advisories
• security.txt

If something goes wrong

If a breach affects your network, we tell the owner without undue delay and give you what you need for your own notices, as the DPA says. Questions go to [email protected].

What we have not done: we have not encrypted the database disk or the backups, we hold no security certification, and no outside firm has run a penetration test on MCAnalytics.