Who is responsible

The data controller is SpacePvP, the operator of the SpacePvP Minecraft network and spacepvp.cc. For any privacy question or request you can open a ticket in our Support center or email us at support@spacepvp.cc.

What we collect

Website account

• Your email address. You enter it in-game with /register and confirm it by clicking the link we email you. You use it to log in.
• Your Minecraft username and UUID. They are linked to your website account when you type /register on our server.
• Your Discord user ID, Discord username and avatar link. Connecting Discord is required to use the website. We receive these from Discord when you connect your Discord account or log in with Discord.
• Your password, stored only as a secure one-way hash. We can never see your actual password.
• One-time links we email you to create your account, confirm your address, reset your password or download your data. Only a one-way hash of each link is stored, and it stops working after use or when it expires.
• If you enable two-factor authentication: the secret key used by your authenticator app.

Things you create on the website

• Your profile status and "About" text, comments you post on profiles, friend requests and friends, and private messages to your friends.
• Support tickets: your answers, replies and, for punishment appeals, a copy of the punishment you appealed.
• Notifications we show you about your tickets.

Game data shown on your profile

• Your rank, first join date, the server you are on or were last seen on, and whether you are online.
• Statistics such as kills, deaths, wins, losses and Elo per season, and badges you received (including which staff member gave a badge).

Our Minecraft servers also process your IP address and gameplay data to run the game, prevent cheating and ban evasion, and handle reports and punishments.

Security and spam protection: to stop password guessing and spam we limit how often some actions can be done: logging in, changing two-factor settings, posting profile comments, sending private messages and creating support tickets. For this we briefly store a SHA-256 hash of your IP address combined with the type of action (and, except for logging in, your account ID), plus the time of the attempt. We do not store your IP address itself here. A hash like this is not anonymous, so we treat it as personal data and delete it automatically after about an hour.

Server logs: our hosting provider keeps standard web server logs (IP address, browser, requested page and time) to keep the website secure and to fix problems. When something goes wrong, our error log can contain technical details such as your username.

Why we use your data

• To provide your account and the website (logging in, your profile, friends, messages, support, and the emails needed for your account: confirming your address, resetting your password and security notices such as "your password was changed", plus one reminder when a private message or friend request is still unread after a day, which you can turn off on the Notifications page). We do not send newsletters or advertising emails. Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR).
• To keep the network safe and fair (2FA, login protection, moderation, punishments and appeals, anti-cheat, preventing ban evasion). Legal basis: our legitimate interest in a safe community (Art. 6(1)(f)).
• To show statistics, leaderboards, badges and online status. Legal basis: our legitimate interest in running a competitive community. You can object at any time (see "Your rights").
• To comply with the law, for example when authorities lawfully request information. Legal basis: legal obligation (Art. 6(1)(c)).

We do not sell your data, we do not use it for advertising and we do not use tracking or analytics cookies.

Who we share data with

• Hosting and database providers that store the website and game data for us, under a data processing agreement.
• Our email server, which delivers account emails from no-reply@spacepvp.cc to your mailbox.
• Discord, when you connect your Discord account (required for a website account), log in with Discord, or when a page shows the Discord widget (your browser then loads it from Discord). Discord is based in the United States and participates in the EU-U.S. Data Privacy Framework.
• Mojang / Microsoft and skin services: to show Minecraft heads our server requests skins by username or UUID. Your own IP address is not sent to these services.
• Tebex, which runs our store (store.spacepvp.cc) as Merchant of Record. Tebex processes your payment details and billing information as an independent controller under its own privacy policy. We only receive what is needed to deliver your purchase: your Minecraft name and UUID, the product, the price and the transaction ID. We never see your full card or bank details.

Public information on your profile (username, rank, statistics, badges, online status, comments) can be seen by every visitor.

How long we keep data

• Account and profile data: as long as your account exists. You can delete your account yourself on the Your data page. It is deleted 28 days after your request; until then you can cancel it, and staff can still look at the account if it is part of an open report or investigation.
• After deletion we remove your email address, password, two-factor settings, Minecraft and Discord links, profile text, comments, friend requests and notifications. Accepted friendships, private messages and support tickets stay for the other people in them, but without your name: you are shown as "Deleted User" with a number. We keep these because they are also the other person's conversation and because tickets can be needed to handle reports and appeals (legitimate interest).
• Private messages, friends and comments: until you or the other person removes them. Comments are removed when your account is deleted.
• Support tickets: up to 2 years after the ticket is closed, so earlier conversations stay available if a problem returns.
• Punishments and appeal records: as long as needed to enforce the rules and prevent ban evasion. When staff close an appeal they can set a waiting time before a new appeal; this is stored with your account and Minecraft UUID until it ends. If staff decide you can no longer appeal, it is kept as long as needed to enforce that.
• Statistics: until a season or map reset, or until you ask us to remove them.
• Login and spam protection data: deleted automatically after about an hour.
• Email links: account creation and confirmation links expire after 24 hours, password reset links after 1 hour and data download links after 48 hours.
• Web server and error logs: kept by our hosting provider for a limited time and then deleted automatically.

Cookies

We only use what the website needs to work, so we do not ask for cookie consent:

• spacepvp_session: a session cookie that keeps you logged in and protects forms. It is removed when you log out or close your browser.

Fonts and icons are hosted on our own server, so loading the website does not send your data to Google or other font services.

Children

Many Minecraft players are young. If you are under 16, please ask a parent or guardian to read this policy with you and to agree before you create a website account. We only collect what is needed to run the network and never ask for your real name, address or phone number. Please do not share personal details such as your real name, address or photos in comments or messages.

Parents or guardians can ask us at any time to see or delete the data of their child: open a ticket in our Support center or email us at support@spacepvp.cc.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy (data portability). You can do this yourself: on the Your data page we email you a download link to a file with all your data;
• correct data that is wrong;
• delete your account and data ("right to be forgotten"), on the Your data page. Some data is kept as explained under How long, for example records of punishments and tickets that other people are part of;
• object to or restrict processing based on our legitimate interests, such as showing your statistics.

How to make a request: use the Your data page, or open a ticket in our Support center or email us at support@spacepvp.cc and tell us what you want. To protect your account we check that the request comes from you, for example through your logged-in account or your linked Discord account. We answer within one month.

Not happy with how we handled your privacy request? Please let us know first so we can fix it together. You always have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority in your own country.

Security and changes

We protect your data with encrypted connections (HTTPS), hashed passwords, optional two-factor authentication (mandatory for staff), login attempt limits and restricted staff access. If we change this policy we update the date at the top of this page; important changes are announced on our Discord.