Privacy Notice
Before public launch: confirm the operator identity, legal basis, retention windows and contact details for your jurisdictions. This draft describes current application behavior and must be reviewed against the actual services and provider contracts you use.
1. Who is responsible
Controller/operator: [OPERATOR LEGAL NAME], [BUSINESS ADDRESS]. Contact: support@minecraftafk.de. Privacy requests should be sent from the email address associated with your account when possible.
2. Information we process
- Account data: email address, username/handle, display name, account status, verification state, plan and expiry information.
- Service configuration: Minecraft username/UUID, selected server hostname and port, bot settings, desired/connection status and limited operational logs needed for troubleshooting and alerts.
- Microsoft authentication: if you link a Microsoft Minecraft account, authentication tokens are stored in an application-managed encrypted cache in private Supabase Storage. The service does not ask you to type your Microsoft password into this website.
- Security and trial-abuse signals: IP address and network prefix, email-derived values, and a browser/device fingerprint that may include screen dimensions, timezone, language, platform, hardware-concurrency/device-memory hints, graphics/canvas signals and a random browser identifier. The backend stores keyed hashes of selected signals for trial-abuse prevention.
- Support, alerts and billing: alert webhook URLs/tokens you configure, invoice details and public blockchain transaction data if cryptocurrency billing is enabled, plus security/audit records.
3. Why we use it
We use the information to create and secure accounts, connect the Minecraft account you request, operate bots and live-view features, enforce plan limits, deliver email/Discord/Telegram alerts you enable, process payments if configured, prevent repeated trial abuse, investigate failures and meet legal obligations. We do not need your Microsoft password for the device-code linking flow.
4. Providers and sharing
Information may be processed by providers required to run the service, including Supabase (database, authentication and private storage), Render (hosting), Cloudflare Turnstile (anti-abuse verification), an email provider such as Resend (if configured), public cryptocurrency explorers and rate providers (if crypto payments are enabled), Microsoft/Xbox authentication, and the Minecraft server and proxy that you configure. Your bot’s connection details and in-game activity are visible to the destination server according to that server’s systems and rules. We do not sell personal information as a business model.
5. Retention
We retain account and configuration data while your account is active and for the period needed to provide the service. Billing, security and dispute records may be retained for longer where necessary. Hashed trial-abuse records can remain after account deletion to prevent repeated trial claims. Microsoft cache files should be purged when an account is unlinked or deleted. Final retention periods: [SET RETENTION WINDOWS REQUIRED BY YOUR LAW AND PROVIDER CONTRACTS].
6. Security
The application uses HTTPS, access controls, rate limits and encryption for the Microsoft authentication cache. Access to production secrets is restricted to backend hosting configuration. No system can guarantee absolute security; use a unique password, enable MFA on your email and linked provider accounts, and contact support promptly if you suspect unauthorized access.
7. Cookies and local storage
The site uses browser local storage to keep the application session and a random device identifier used in anti-abuse checks. A first-party cookie may also store that identifier. Authentication tokens stored in local storage can be accessed by malware or browser extensions, so use a trusted device and browser. Cloudflare Turnstile may use its own browser storage or cookies to verify that requests are human-initiated.
8. Your choices and rights
Depending on your location, you may have rights to access, correct, export, restrict or delete personal data, or object to certain processing. You can edit account details and request account deletion through the service, or contact support@minecraftafk.de. We may need to retain records that are legally required or reasonably needed for fraud prevention, security or disputes. You may also complain to your relevant privacy regulator.
9. Children and international processing
The service is not intended for anyone who cannot legally consent to this processing under the laws that apply to them. The hosting and service providers may process information in countries outside your own; add jurisdiction-specific safeguards and disclosures where required. Contact the operator before launch to confirm age requirements and international-transfer arrangements.
10. Changes
We may update this notice when service behavior or providers change. We will revise the date above and give notice where required.