Privacy policy

Updated 11 October 2026 · Version 2026-10-11

This policy covers the EUBedWars Minecraft network, website, store and optional Discord account link. We operate from Lithuania. The EU General Data Protection Regulation (GDPR) and Lithuanian data protection law apply.

Contact

EUBedWars handles the data described here. Send privacy questions, objections and requests to [email protected].

What we need and why

To let you play, we need your Minecraft UUID, name, login information, skin, client version, IP address and connection times. Without account and connection data we cannot admit you to the network. We obtain account details from you and, where applicable, Mojang/Microsoft; your client supplies connection and gameplay data. Providing an email address and password is necessary for a website account, but a website account is not required just to browse or play. Passwords are stored as hashes.

We process account links, sessions, settings, game statistics, match results, ranks, purchases and support messages to provide the service you request (GDPR Article 6(1)(b)). A purchase needs the recipient's Minecraft identity and payment information; Stripe collects the payment details. Gift orders also record the buyer, recipient and announcement choice. We store payment references, items, prices, delivery and refund status, and the time, language, exact checkout statement and terms accepted. Accepting store terms is not consent to advertising or a waiver of privacy rights.

We process IP history, reports, chat and command records, punishments, disguise-to-player links, staff actions and anticheat evidence to protect players, investigate abuse and prevent cheating, bots and ban evasion. These are our legitimate interests under Article 6(1)(f); we consider the effects on players, especially children, and restrict staff access by permission. An IP address can be shared by a family, school or VPN and is not by itself proof that two accounts belong to one person. You may object to this processing.

We keep accounting and payment records to meet legal obligations (Article 6(1)(c)). Optional Discord linking records your Discord user ID, display name, linked Minecraft UUID, link/unlink times and rank synchronisation. We use this to provide the linking and role features you request. We do not sell personal data or use it for advertising.

Automated checks and human review

Our anticheat compares movement, timing, attacks and other client actions with the game state and permitted behaviour. Repeated or sufficiently serious detections can trigger alerts, movement corrections, kicks or automatic bans, depending on the check and configuration. Connection checks compare IP history and existing restrictions and use cached Proxycheck network/risk information to assess suspected proxies, bots or evasion. Automated checks can delay or refuse a connection. These checks can profile gameplay or connection behaviour; they can make mistakes.

A restriction may prevent access to the server and paid rank features while it is active. Request a human review, explain your circumstances or challenge a decision through appeals. If a blacklist or account problem prevents use of that page, email [email protected]. This contact remains available even when access to the game or website account is blocked. Purchasing a rank does not exempt an account from checks. These explanations do not remove your rights concerning solely automated decisions under Article 22 GDPR where it applies.

What other people can see

Minecraft names, displayed ranks, levels, statistics and match results are public in game and on the website. Public disguise views use the disguise identity; authorised staff can connect it to the real player. Other players see chat and gameplay they take part in. Gift announcements are public when selected. Website appeals, IP history, reports, anticheat evidence and the staff punishment history are restricted to the account concerned and/or authorised staff; the website does not publish a general public punishment list. Punishment announcements may also be shown in game according to the server's moderation settings.

Providers and international transfers

OVHcloud hosts our infrastructure. Cloudflare carries website traffic and helps protect it from attacks. Stripe handles payments, billing details and payment fraud checks under its own policy. We receive payment references and the checkout email for an order confirmation; we do not receive full card numbers or security codes.

Proxycheck receives connection IP addresses when the network requests a risk lookup. The website reads the network's cached result instead of making a fresh lookup for each staff page. Mojang/Microsoft handles Minecraft authentication and skin services. Discord handles Discord activity and the optional account link under its own policy.

Resend is the website's email delivery integration when configured. Confirmation messages may instead be retained in the restricted server mail folder while external email delivery is unavailable. The order page provides the saved checkout agreement for download; a locally saved message is not proof that an email reached you.

Providers may process data outside the European Economic Area. The applicable provider arrangements must supply an appropriate transfer basis, such as an adequacy decision for the receiving organisation or the European Commission's standard contractual clauses. A provider's US location alone does not establish Data Privacy Framework coverage. Ask us for the applicable transfer information and a copy of the relevant safeguards, with confidential details redacted where necessary.

How long data is kept

Website account details, including the email address and password hash, remain until the account is deleted or unlinked. Deletion also removes the website's linked game email, website sessions, registration links, appeals and their messages. It does not erase independent purchase records, game statistics or moderation records. Temporary link records expire within 15 minutes and registration links within 30 minutes; expired records are removed by periodic cleanup after at most another day. Player sessions expire after 14 days without use or 60 days overall; staff sessions after 12 hours without use or seven days overall.

Closed website appeals and their messages are removed one year after the last update, or earlier when the website account is deleted, unless a specific record is needed for an ongoing legal claim and placed on a documented retention hold. Open appeals are retained while staff resolve them. Website staff audit entries are retained for one year. Unlinked Discord records remain in the game account history unless removed through a verified deletion request; unlinking immediately stops the active link but is not an automatic erasure of that history.

Anticheat file logs use a 30-day expiry. Live movement state is needed while a player is connected; saved diagnostic captures and evidence copied into a report or appeal are separate records. Match history, match logs and replays have the game server's configured expiry. A copy retained for an unresolved report, appeal or dispute is kept until that matter is resolved and the applicable claim period ends. We do not treat every movement packet as an accounting record.

Ordinary chat and command entries form part of server logs; excerpts can also form part of reports or replay evidence. Log rotation depends on the service and storage limit. There is currently no verified network-wide 90-day deletion guarantee. Reports, disguise links and historical moderation records do not all have an automatic time limit: their retention is assessed against the unresolved case, active restriction, identity-dispute or repeat-abuse investigation that needs them. You can request erasure or object to continued retention.

For an active blacklist, the identifiers and evidence needed to enforce or review it remain while the restriction applies. A permanent blacklist has no scheduled expiry, but you can request a human review of both the restriction and the need to retain its associated data. It is not a reason to refuse a privacy request. Historic IP information is not covered by a verified automatic 12-month deletion rule.

Paid order and accounting records, including checkout acceptance evidence, are kept for 10 years from the end of the relevant accounting year. A record needed for an active entitlement, unresolved payment dispute, legal hold or longer statutory duty may need to remain beyond that point; only the information necessary for that purpose should be retained. Unpaid, expired checkouts are removed after 90 days. Stripe event deduplication records are removed after 30 days. Restricted local email files are removed after 30 days.

Backups or incident snapshots can contain older copies after live data is deleted. They are restricted to recovery or investigation, and deletions must be applied again before restored data is used. A uniform 30-day backup rotation is not currently verified, so we do not promise that all backup copies disappear within 30 days. Contact us for the status of copies relevant to your request.

Cookies and browser storage

We use functional and security storage, without website advertising or analytics trackers. On HTTPS the cookie names are: __Host-session (sign-in; at most 60 days, or seven days for staff), __Host-csrf (form protection; seven days), __Host-game-link (Minecraft linking; 15 minutes), __Host-store-handoff (store sign-in; 15 minutes), __Host-basket (basket; 30 days) and __Host-shopper (chosen player; 30 days). Session inactivity limits above can end access earlier. The language-hint cookie remembers dismissal of the language suggestion for one year.

Your chosen display currency is stored in your browser until you clear it or change it. Staff console wrapping and unfinished rules-editor drafts are also stored locally on the staff member's device until cleared or, for drafts, saved. Cloudflare may use its own security cookies; its cookie documentation describes their purposes and durations. Stripe's hosted checkout has its own storage and privacy information. You can clear browser storage; doing so may sign you out or empty the basket.

Your rights and identity checks

Subject to the GDPR's conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. If a specific feature relies on consent, you may withdraw that consent without affecting earlier lawful processing. You may request human intervention and challenge a qualifying automated decision. Delete your website account here.

Contact [email protected] from your linked account email. Before disclosing private information or changing records, we verify control of the account through the existing account-link process or an in-game verification challenge, and may request proportionate additional evidence if there is reasonable doubt. A Minecraft name alone is not proof of identity. Do not send passwords or payment-card details. A parent or guardian may act for a child after appropriate verification.

We respond without undue delay and normally within one month. If complexity or the number of requests requires up to two additional months, we explain the reason within the first month. We explain any refusal and the available complaint options. Erasure is not absolute: a current legal obligation or necessary legal claim may justify retaining limited records.

You may complain to Lithuania's State Data Protection Inspectorate — VDAI (Valstybinė duomenų apsaugos inspekcija), or to the competent supervisory authority where you live, work or believe an infringement occurred. You do not have to contact us first.

Children

In Lithuania, the age at which a child can give their own GDPR consent for an information-society service is 14. This rule applies where consent is the legal basis; it does not turn every use of the server into consent or establish legal capacity to buy. Below that age, any such consent must come from or be authorised by a parent or guardian. Children should involve a parent or guardian when creating an account or making a privacy request. Store purchases have the separate parental-authorisation requirements in our terms.

Changes

The date and version at the top identify this policy. We update it when processing changes and provide notice where required. The checkout agreement and terms saved with an earlier order are not rewritten when this page changes.