PRIVACY POLICY

Summary first, then the details. No ads, no tracking, no analytics, no data sales — we store what the game and your optional web account need, nothing else. GDPR applies: the operator is based in Germany, all data is hosted in the EU (Finland).

1. WHO IS RESPONSIBLE

Controller (Art. 4(7) GDPR): the private individual operating this non-commercial hobby server from Germany.
Contact: deco_breaks.9y@icloud.com

2. WHAT WE STORE, WHY, AND ON WHAT LEGAL BASIS

• Game data — your Minecraft UUID and player name, position of your builds/zones, bank balance and transaction ledger, market and shop activity. Needed to run the game service you're using (Art. 6(1)(b) GDPR).
• Connection data — your IP address appears in server and web logs when you connect. Used for operation, abuse prevention and security (Art. 6(1)(f) GDPR). Logs rotate automatically.
• Integrity data — block changes and interactions are recorded (CoreProtect) so grief damage can be traced and rolled back, and gameplay is monitored by an anti-cheat (GrimAC). Legitimate interest: protecting players' builds and fair play (Art. 6(1)(f) GDPR).
• Web account (optional) — email address (login + important notices such as zone/upkeep warnings), password (stored only as a bcrypt hash — we never see it), phone number (optional, account recovery only), referral relations. Created only if you run /register (Art. 6(1)(b) GDPR).
• Invite records — players can vouch for someone they bring along: we store the proposed Minecraft name, who proposed them, the decision, and publicly available account facts shown to the reviewing admin (e.g. whether the name exists at Mojang). No email or other contact data of the invited person is collected. Legitimate interest: linking a player to whoever vouched for them, so referral bonuses can be paid and repeated bad referrals can be traced (Art. 6(1)(f) GDPR).
• Session cookie — a single cookie ("sid") keeps you logged in for 30 days. It is strictly necessary for the login function; there are no tracking or third-party cookies.

3. WHERE IT LIVES

Everything runs on a rented server hosted by a professional hosting provider on infrastructure located within the EU. Encrypted backups are kept in the EU as well. No data is transferred to third countries, and no third parties process your data beyond that hosting provider (acting as our processor under Art. 28 GDPR).

4. HOW LONG WE KEEP IT

• Registration/reset links: 30 minutes.
• Web sessions: 30 days (or until logout / password reset).
• Server & web logs (incl. IP addresses): rotated automatically, kept days to a few weeks.
• Game data, ledger and block history: for as long as the world exists — the ledger and build history are the fabric of the shared world. On request we anonymize your entries instead (see rights below).
• Backups: rolling retention (hourly/daily/weekly), old snapshots expire automatically.

5. YOUR RIGHTS

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Deleting your web account removes email, phone and password immediately; game data tied to your UUID is anonymized on request (the world and the ledger stay consistent, your name disappears). You can also complain to a supervisory authority (Art. 77) — in Germany, the data protection authority of your federal state.

To exercise any right: contact the operator (above) or ask a staff member in game.