Privacy Policy

1. Who is responsible

apfelmagnet32
Contact: [email protected]
Based in Germany

This is a personal, non-commercial project run by a private individual, not a company. The operator is the data controller for everything described below, and the address above reaches them directly about anything in this policy.

2. What data is collected

That's it. There is no analytics, no advertising, no third-party tracking scripts, and no data is sold or shared with advertisers.

3. Where your data goes

There is no analytics or advertising, and nothing is sold or shared with advertisers. The database (accounts, project metadata, messages) and the uploaded files (mod jars, resource packs, images, etc.) are stored on the operator's own server, not with a third party. Deleting an upload removes the file within about a day.

Two network providers pass traffic through on the operator's behalf, purely to run the Service:

• Cloudflare sits in front of the website (DNS, encryption, protection against attacks). It sees your IP address and the pages you request, but doesn't store your account data.
• TCPShield sits in front of the Minecraft server, if you play on it, and sees your IP address and Minecraft username while you're connected.

Server logs may briefly include IP addresses, used to debug faults and to enforce the rate limits that keep the Service usable. The basis for this is the operator's legitimate interest in a working, non-abused service (Art. 6(1)(f) GDPR). These logs stay on the operator's server and aren't shared.

Bans on the Minecraft servers

If you're banned from a Minecraft server for breaking its rules (see section 11 of the Terms of Service), your Minecraft name, UUID and - for serious cases such as real-money trading - your IP address are kept on a ban list for as long as the ban lasts, to enforce it. The basis is the operator's legitimate interest in fair servers (Art. 6(1)(f) GDPR).

Processing outside the EU

Cloudflare and TCPShield are US-based companies, so the traffic data they see (mainly your IP address) may be processed outside the EU/EEA. Transfers like these are covered by the European Commission's standard contractual clauses and, where the provider is certified, the EU–US Data Privacy Framework. US law gives their authorities access powers that EU law does not. Your account data itself stays on the operator's server.

4. How long data is kept

Your account and content are kept until you delete your account or ask for it to be deleted.

If a registration is rejected, the account and everything stored about it are deleted automatically about ten minutes after that decision - no request needed. Until then you can sign in to read the decision, and delete the account yourself straight away if you prefer.

While a registration is still awaiting a decision, you can sign in and delete the account at any time. An account that was never approved is not held hostage by that: signing in works purely so the account can be identified, and nothing else on the site is reachable until it is approved.

Uploaded files are removed from the app immediately on deletion. Because of how the underlying storage works, the file's raw bytes may continue to exist, inaccessible to the app or anyone else, on the storage provider's infrastructure for a limited additional period (on the order of weeks) until its own routine cleanup reclaims the space - this isn't something the operator can force to happen sooner.

Addresses barred from registering

If an address is barred from signing up again - usually after a registration was refused - it is kept in a separate list, and kept indefinitely, since that is the whole point of it. It is stored as a one-way hash rather than as the address itself: the list can be checked when someone registers, but not read back, and the operator only sees enough of an address (s•••••[email protected]) to tell entries apart. Nothing else about the account is kept. To ask for an entry to be removed, email [email protected].

5. Your rights

Under GDPR, you can ask the operator to:

• Tell you what data is held about you (access)
• Correct inaccurate data (rectification)
• Delete your account and data (erasure) - or delete your own account yourself in Account settings
• Give you a copy of your data in a portable format (portability) - or download it yourself as a JSON file under "Your data" in Account settings
• Stop processing your data in certain cases (restriction/objection)

Erasure and portability are self-serve in Account settings. For anything else, email [email protected]. You also have the right to complain to your local data protection authority.

6. Children

This service isn't directed at children. Under GDPR Art. 8, the age for consenting to data processing on your own in Germany is 16; below that a parent or guardian has to agree. Note that agreeing to the Terms of Service is a separate question with its own age rule - see section 2 of the Terms of Service.

There's no automated age check - registration relies on what you tell the operator. If it turns out an account belongs to someone under 16 without a guardian's agreement, the account and its data are deleted. A parent or guardian who believes their child signed up without their agreement can ask for the same at [email protected], and the account will be removed.

7. Changes to this policy

If what data is collected or how it's used changes, this page will be updated with a new "last updated" date.