Privacy Policy
DRAFT: LEGAL REVIEW REQUIRED. This is an initial draft, not legal advice. It describes what the software does today. Settle every [LEGAL REVIEW] item and
[BRACKETED]placeholder before publication, and update this policy if you add new data uses.
Last updated: [DATE]
1. Who is responsible
Nathan Breeden operates this website and is responsible for your personal data. Contact: [CONTACT EMAIL]. [LEGAL REVIEW: if you serve the EU or UK, consider controller details and whether a representative is needed.]
2. What we collect
| Data | Why | Source |
|---|---|---|
| Username, email address | Run your account, send security and order messages | You |
| Password | Log you in. Stored only as a salted Argon2id hash, never in readable form | You |
| Two-step verification secret | Protect your account. Stored encrypted | Generated |
| Bio | Show on your public profile | You |
| Minecraft username, UUID, ranks, tags, online status | Show public profiles and staff lists, deliver purchases | The server and LuckPerms |
| Orders: product, amount, date, status, payment provider reference numbers | Deliver purchases, keep records, handle refunds and disputes | You and providers |
| IP address, browser type, session times | Keep accounts secure, stop abuse, keep audit records | Your device |
We never receive or store your full card number or CVV. You enter payment details directly on PayPal's or Square's pages.
3. Public information
Your Minecraft username, avatar, ranks, tags, online status, last-seen time, UUID and any bio you write are shown publicly. Your email address is never shown publicly.
4. Legal bases
[LEGAL REVIEW: confirm for GDPR/UK GDPR.] We use your data to perform our contract with you (accounts, purchases), for our legitimate interests (security, fraud prevention, running a community), to meet legal duties (tax and financial records), and with consent where required.
5. Who we share data with
- PayPal and Square, to process payments. They act under their own privacy policies.
- Email provider [PROVIDER NAME], to send account messages.
- mc-heads.net, which our server contacts with a player's UUID to fetch public avatar images. Your browser does not contact it directly.
- Hosting [HOSTING DETAILS, IF ANY THIRD PARTY].
- Authorities or advisers, where the law requires it or to protect rights and safety.
We do not sell your personal data. We do not use advertising or analytics trackers on this website.
6. Cookies
We use only essential cookies: one to keep you logged in, one to protect forms from cross-site attacks, and a short-lived one for on-screen messages. [LEGAL REVIEW: confirm no consent banner is needed in your target regions.]
7. How long we keep data
| Data | Retention |
|---|---|
| Login sessions | Up to 7 days, or 12 hours idle |
| Rate-limit and anti-abuse records | Up to 2 hours |
| Account data | Until you delete your account |
| Order and payment records | [7] years, for tax, accounting and disputes |
| Audit logs (admin actions, security events, may include IP addresses) | [RETENTION PERIOD]. Note: these are append-only and are not currently removed automatically |
| Encrypted backups | Up to [14] copies, then deleted on a rolling basis |
When you delete your account, your login details, email and bio are removed from the live database. Orders stay for record-keeping. Data in backups disappears as those backups age out. Your Minecraft name and ranks may stay visible because they come from the game server. [LEGAL REVIEW: set retention periods and confirm erasure handling for audit logs and player data.]
8. Security
We protect data with measures including password hashing, encryption of sensitive settings, access controls with two-step verification for administrators, audit logging and encrypted backups. No system is perfectly secure.
9. Security incidents
If a breach affects your personal data, we will assess it and notify affected people and regulators within the time the law requires. [LEGAL REVIEW: GDPR expects regulator notice within 72 hours where required; US state laws vary. Prepare a response plan.]
10. Your rights
Depending on where you live, you may have rights to access, correct, delete or export your data, to object to or restrict processing, to withdraw consent, and to complain to a regulator. Email [CONTACT EMAIL]. We will not treat you unfairly for using these rights. [LEGAL REVIEW: add CCPA/CPRA or other state notices if they apply.]
11. Children
The Service is not directed to children under [MINIMUM AGE]. If you believe a child has given us data without required consent, contact us and we will delete it. [LEGAL REVIEW: see Terms section 3. COPPA duties can apply to services with actual knowledge of under-13 users.]
12. International transfers
Our servers are in [COUNTRY]. Payment providers may process data elsewhere. [LEGAL REVIEW: add transfer safeguards if serving the EU/UK.]
13. Changes
We will post updates here and give notice of material changes.