The short version
We hold your Minecraft name and UUID, the figures the game produces about you, and a record that a payment happened. We do not hold your email address, your password or your card details, because none of them ever reach us.
Who is responsible
the operator of LootSMP is the data controller for everything described here. Write to [email protected] about any of it.
What we store, and why
- Your Minecraft UUID and name. It is how the server knows which chest is yours. Everything else hangs off it.
- What you do in the game: balance, playtime, kills and deaths, homes, auctions, buy orders, purchases and sales. This is the game working. Some of it is public — the leaderboards and a player profile — and it is public to anyone.
- Votes. When you vote on a server list, the list sends us the name you typed so we can pay the Grit. We keep the name, the list and the time.
- A website session. Signing in stores a random token in a cookie and only a hash of that token on our side, so a copy of our database does not let anybody sign in as you. It expires. There is no password, because signing in proves you own the Minecraft account rather than asking you for a new secret.
- A purchase record. When you buy a rank, Tebex tells us that a payment completed, which package it was and which player it was for. We keep that so the rank can be granted and so we can answer “what did I pay for”.
- API tokens you create, stored as a hash, with a label and the date.
- Server logs. Connecting to a Minecraft server means your IP address reaches it; there is no way to play without that. Logs are kept for a short period for security and for working out what broke.
There is no advertising, no tracking pixel, no analytics tag and no profiling. Nothing here is sold or shared with anyone for marketing, ever.
Why we are allowed to
Most of it is necessary to provide what you asked for — you cannot have an account on a server that is not allowed to remember your account. The purchase record is necessary for the contract and then kept because tax law says to. The logs are a legitimate interest in keeping the server running and keeping cheats off it.
Who else sees it
- Tebex take the payment and hold everything about it, including your billing details. We never see your card.
- Server lists you vote on send us your name. What they collect from you is theirs to explain.
- mc-heads.net renders the player faces on this site. Your browser fetches those images directly, so that service sees your IP address.
- Cloudflare sits in front of the website and the API, and our host runs the machines.
- Discord, if you join it, is Discord’s to explain, not ours.
How long we keep it
Your account and its figures stay while the server does, because deleting them would delete your things. Sessions expire. Logs are kept for a short period. Purchase records are kept for as long as tax law requires, which is years, and that part we cannot delete on request.
Having it deleted
Ask at [email protected] and we will delete your account and everything attached to it, other than purchase records we are required to keep. You can also ask for a copy of what we hold, ask us to correct it, or object to any of it. We answer within a month, and it is free.
Deleting the account deletes the things in it. There is no way to keep a base and forget who owns it.
If you think we have handled this badly, you can complain to your local data protection authority. We would much rather you told us first.
Children
This server is not aimed at young children. If you are under 16 and in the EU, get a parent’s permission before you sign in or buy anything. Tell us and we will delete an account that should not have been made.
Changes
The date at the top is when this last changed. If we ever start doing something materially different with your data, we will say so rather than edit this quietly.