--- title: "Privacy Policy | Minecraft Sync" description: "What data Minecraft Sync processes, what for, and how long it is kept." url: https://mc-sync.eu/en/privacy-policy/ language: en --- # Privacy Policy | Minecraft Sync ## Controller The controller for the processing described here within the meaning of Article 4 (7) GDPR is: Provider L‍e‍o‍n‍ ‍J‍a‍n‍z Address F‍r‍ö‍s‍c‍h‍e‍n‍b‍ü‍n‍d‍t‍,‍ ‍8 7‍7‍7‍6‍7‍,‍ ‍A‍p‍p‍e‍n‍w‍e‍i‍e‍r D‍e‍u‍t‍s‍c‍h‍l‍a‍n‍d Phone +‍4‍9‍ ‍1‍5‍7‍ ‍5‍0‍1‍3‍6‍5‍0‍9 Email [s‍u‍p‍p‍o‍r‍t‍@‍m‍c‍-‍s‍y‍n‍c‍.‍e‍u](mailto:support@mc-sync.eu) No data protection officer has been appointed; the conditions of Article 37 GDPR and § 38 BDSG are not met. An email to the address above is enough for any question about data protection and for exercising your rights. No particular form is required. ## Overview We process as little data as possible. There are no advertising or fingerprinting tools, no profiling, no trade in data, and your data is never used to train AI models. We learn how the website is used only from a Cloudflare statistic that works without cookies and without recognising individual visitors, and only runs with your consent (see “Website and hosting”). What is stored serves the purpose the service was set up for: server status, chat relay, whitelist, roles, alerts. We keep a statistic of how often each command is used without any reference to a person, and reset it daily. “Personal data” means any information relating to an identified or identifiable natural person (Article 4 (1) GDPR). Here that is primarily your Discord user ID, your Minecraft UUID and Minecraft name and your email address (if you provide it for monitoring or sign in to the dashboard). On a Minecraft server whose staff connect the console to Discord, entries from the server log can additionally pass through the service (see “Live console”). ## Website and hosting This website ([mc-sync.eu](https://mc-sync.eu)) is hosted by Netlify. Netlify automatically records access data such as IP address, time and browser type, which is necessary to deliver the site and to fend off attacks. We do not access that data. The legal basis is Article 6 (1) (f) GDPR; our legitimate interest lies in the secure and reliable operation of the website. We do not use tools for advertising or recognition, and we do not evaluate IP addresses. No fonts or maps are loaded from third-party servers; the only third-party script is the measurement script of Cloudflare's web analytics, and only with your consent (see below). Everything stored on your device is listed in the next section. The pages are available exclusively over an encrypted connection (HTTPS). The website sits behind Cloudflare's network (Cloudflare, Inc., USA): every request to mc-sync.eu, including those of the dashboard, passes through Cloudflare's servers before it reaches Netlify. Cloudflare processes the IP address, time, requested address, browser type and other technical details of the request in order to deliver the page and to fend off automated access and attacks (bot protection “Bot Fight Mode”). For this, Cloudflare may set the cookies \_\_cf\_bm and cf\_clearance and run a brief automatic check in the browser. The legal basis is Article 6 (1) (f) GDPR; our legitimate interest lies in the secure and reliable operation of the website and in protection against abusive access. With your consent we use Cloudflare Web Analytics to see which pages are used and where the website is too slow. Only if you choose “Accept all” in the cookie notice does the page load a Cloudflare measurement script (static.cloudflareinsights.com). When a page loads, it reads technical measurements from your browser — the requested address, the referring page, browser and device type, and the page's load and response times — and sends them to Cloudflare (cloudflareinsights.com). It sets no cookies, stores nothing in your browser's storage and does not recognise you on a later visit; according to Cloudflare, it does not identify visitors by IP address or browser fingerprint. We only see aggregated figures. Without your consent the script is not loaded and nothing is measured. The legal basis is your consent under § 25 (1) TDDDG and Article 6 (1) (a) GDPR. You can withdraw it at any time with effect for the future — via “Cookie settings” at the bottom of every page; processing carried out before the withdrawal remains unaffected. ## Cookies and storage on your device This overview lists everything this website stores on your device or reads from it — within the meaning of § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). All entries listed are strictly necessary for operation (§ 25 (2) no. 2 TDDDG) and therefore do not require consent. Accordingly, there is no way to refuse them individually without giving up the function concerned. We do not use analytics, advertising or recognition cookies. ### mcsync\_session Purpose Keeps you signed in to the dashboard. Without this cookie you would have to sign in again on every page. It cannot be read by scripts (HttpOnly) and contains only a random identifier that reveals nothing about you. Duration 30 days; extended each time you use it ### mcsync\_oauth\_state Purpose Secures the sign-in process: it ties the return trip from Discord to the browser that started it. Duration 10 minutes ### mcsync\_signed\_in Purpose Notes that a session exists in this browser so the navigation bar can show it without asking the server on every page load. Contains only the value “1” and no identifier. Duration 30 days; extended with the sign-in ### \_\_cf\_bm (Cloudflare) Purpose Set by Cloudflare to tell human visitors apart from automated access (bot protection). Cloudflare evaluates it for this purpose only; we have no access to it. Duration 30 minutes ### cf\_clearance (Cloudflare) Purpose Set by Cloudflare when your browser has passed a bot-protection check, so the check is not repeated on every request. We have no access to it. Duration depending on the bot-protection settings, usually 30 minutes ### i18next Purpose Remembers the language you chose. Duration until deleted in the browser ### mcsync\_consent (local storage) Purpose Stores your choice in the cookie notice — whether or not you agreed to statistics — and when you chose, so the notice does not appear on every visit and the measurement script is only loaded after a yes. It is never sent to the server. Duration until you change your choice or delete it in the browser ### mcsync.languageSynced (session storage) Purpose After you sign in, notes your Discord user ID so that the language of the website and that of the bot are matched only once per browser session. It is never sent to the server. Duration until the tab is closed ### mcsync\_assistant (session storage) Purpose Keeps a copy of the current AI chat in this tab so it is back instantly when you switch pages. The chat history itself is stored by the bot (see “AI chat”); this copy is never sent to the server. Duration until the tab is closed ### mcsync\_assistant\_greeted (session storage) Purpose Notes that Pixi has already waved in this tab so the greeting does not appear on every page change. Contains only the value “1” and is never sent to the server. Duration until the tab is closed ### mcsync\_assistant\_size (local storage) Purpose Remembers how large you dragged the AI chat window — only width, height and whether it is enlarged. It is never sent to the server. Duration until deleted in the browser ### mcsync.dashboard.recentGuilds (local storage) Purpose Remembers the IDs of up to eight Discord servers you last opened in the dashboard so they appear at the top of the selection — no names and no timestamps. It is never sent to the server. Duration until deleted in the browser ### mcsync.server-scope.‹Discord server ID› (local storage) Purpose Remembers, per Discord server, which connected Minecraft server you last selected in the dashboard. It is never sent to the server. Duration until you clear the selection or delete it in the browser ### mcsync.files.view (local storage) Purpose Remembers whether you view configs in the dashboard's file manager as a form or as text. It is never sent to the server. Duration until deleted in the browser ### mcsync.files.updates (session storage) Purpose Remembers the result of the update check in the file manager (plugin and mod names, versions) so it does not ask Modrinth again every time you open it. It is never sent to the server. Duration until the tab is closed, used for at most 30 minutes ### Service worker /sw.js and push subscription Purpose Only if you turn on browser notifications in monitoring: the browser registers a service worker of this website and a push subscription so that alerts arrive even when the page is closed. The service worker caches no files. The push endpoint is sent to the bot (see “Monitoring and delivery channels”). Duration until you turn off the notification or delete the site data in the browser Not in the list because it stores nothing: the measurement script of Cloudflare's web analytics. It is only loaded with your consent and then reads technical measurements from your browser when a page loads (see “Website and hosting”). This reading is subject to § 25 (1) TDDDG — it requires your consent. You can change or withdraw your choice about statistics at any time: ### Images from Discord in the dashboard Inside the signed-in dashboard, server and profile pictures are loaded directly from Discord’s image server (cdn.discordapp.com). Discord sets its own cookies in the process (among them \_\_dcfduid and \_\_cf\_bm) and learns your IP address. This happens only in the dashboard, not on the other pages. If you want to avoid it, block content from cdn.discordapp.com in your browser — the dashboard then shows initials instead. ## Dashboard and signing in with Discord The dashboard at [mc-sync.eu/dashboard](https://mc-sync.eu/dashboard) is aimed at people who manage a Discord server. Signing in works exclusively through Discord (OAuth 2.0). There is no password of our own, and we store none. When you sign in we request the “identify”, “guilds” and “email” permissions from Discord. This gives us your Discord user ID, your display name, your avatar, the list of your Discord servers with the permissions you hold there and the email address stored with Discord. This information is kept in memory for the duration of your session. Only the email address is stored permanently, and only if Discord reports it as verified: we use it exclusively for notices about the usage agreement to the managers of a Discord server, such as new terms of service — not for advertising and not for notices about servers. Each sign-in updates it; if Discord no longer reports a verified address, it is deleted. The access token Discord issues is held only in the bot's memory and is revoked with Discord when you sign out. A session lasts 30 days and is extended as long as you use it; under “Signed-in devices” you can see every sign-in of your account and end them individually. During an orderly restart of the bot, existing sessions are written to an encrypted file, read back on start-up and the file is deleted afterwards — so a restart does not sign you out. Changes you make in the dashboard are recorded in an activity log of the respective Discord server with your Discord user ID, your display name, the time and the kind of change, and are deleted after 90 days. This keeps changes traceable for the other administrators of the same server. If you delete your data, these entries remain without your name and ID. The legal basis is Article 6 (1) (b) GDPR for signing in and for the administration itself, and Article 6 (1) (f) GDPR for the log — our legitimate interest is keeping changes to a jointly managed server traceable. We process the email address under Article 6 (1) (b) GDPR to inform you about changes to your usage agreement. If no address is known, such a notice is sent as a Discord direct message to the owner of the Discord server, and otherwise to its notice or chat channel. Under “My data” ([mc-sync.eu/dashboard/account/data](https://mc-sync.eu/dashboard/account/data)) the dashboard shows you everything stored under your Discord ID — across all Discord servers. There you can download it as a file and have it deleted completely with one click. ## Data from Discord and access to message content From Discord the bot receives the IDs of servers, channels, roles and users, display names and the roles of members (the “Server Members Intent” — required for role synchronisation and for removing whitelist entries when someone leaves a server), as well as message content (the privileged “Message Content Intent”). Message content is only evaluated in channels that the server staff have explicitly set up for it: as a chat-sync channel (relayed to the Minecraft server, cached for at most two days) or as a whitelist channel (interpreted as a Minecraft name). In every other channel the bot checks each message automatically and solely for whether it contains a valid connection token. If it does, the token is blocked immediately and the affected chat-sync channel is notified; the message content is neither stored nor passed on. The legal basis is Article 6 (1) (b) GDPR for the configured channels and Article 6 (1) (f) GDPR for the protection against leaked tokens (legitimate interest in the security of the connected Minecraft servers). We use data from Discord exclusively for the functions described here. It is not sold, not passed on to advertising networks and not used to train AI models. We comply with the Discord Developer Terms of Service and the Discord Developer Policy; if Discord requires data to be deleted, we do so. If you remove the bot from a Discord server, all data of that server is deleted automatically after 30 days. ## Data in the bot, the plugin and the monitoring feature The following list names, for each feature, the data processed, the legal basis and the purpose. Data is only stored once the feature is set up or used — anyone who merely has the bot on their server without setting anything up leaves none of it behind. Everything that belongs to a Discord server is deleted 30 days after the bot is removed. ### User data Data Discord user ID, chosen language (set with /language or, when you are signed in, through the website's language picker — both are the same setting), time of last use, status and timestamp of the vote reminder, whether you voted for the bot Legal basis Article 6 (1) (b) GDPR (performance of the usage contract); for the vote reminder additionally Article 6 (1) (a) GDPR (consent), which you can withdraw at any time Purpose Recognising your settings, replying in your language, sending reminders you asked for ### AI chat (“McAsk”) Data Discord user ID, internal identifier, time of the last request, used and remaining daily budget of AI tokens, your stored chats (title, origin Discord or website, timestamps and the content of your questions and the answers) and the identifier of the associated conversation at OpenAI Legal basis Article 6 (1) (b) GDPR (providing the function you called up); Article 6 (1) (f) GDPR for the request limits (legitimate interest in preventing abuse) Purpose Holding the conversation, showing your previous chats, limiting use, protection against abuse. Use is limited by a daily budget of AI tokens that is reset every day. Questions and answers are stored as chat history for 30 days; you can view them in the chat window and delete individual chats at any time. After that they are deleted automatically, and also when you delete your account. ### Server status cache Data Discord user ID, queried server addresses, edition, time of the last query Legal basis Article 6 (1) (b) GDPR (technical provision); Article 6 (1) (f) GDPR (legitimate interest in short response times and low load on third-party interfaces) Purpose Faster answers, fewer calls to external services ### Notifications in Discord Data Discord user ID, active status, monitored server addresses, edition, last known online state Legal basis Article 6 (1) (a) GDPR (consent given by setting the notification up) and Article 6 (1) (b) GDPR Purpose Delivering the alerts you asked for ### Monitoring and delivery channels Data Discord user ID of the watcher, monitored server addresses with label and grace period, delivery channels (Discord direct message, email address, your browser's push endpoint or a webhook address) including confirmation status, quiet hours and time zone, and a log of the alerts sent with time and result Legal basis Article 6 (1) (b) GDPR (delivering what you requested); confirming a delivery channel rests on Article 6 (1) (f) GDPR (legitimate interest in not sending alerts to someone else’s address) Purpose Reporting outages and other events over the channel you chose, with or without a Discord server. Every email carries an unsubscribe link that deletes the channel. The confirmation link is valid for three days; a delivery channel that is not confirmed is deleted after 14 days, the delivery log after 30 days. ### Server list Data Discord server ID, server name, address, edition, linked chat-sync connection; at the server staff's request additionally a public short name for the status page and a description and tags for the server directory Legal basis Article 6 (1) (b) GDPR Purpose A central server list for the other commands (status, displays, voice channels, whitelist) ### Whitelist Data Discord server ID, Minecraft name, Discord user ID of the person who submitted it, channel ID or identifier of the server connection, time of entry Legal basis Article 6 (1) (b) GDPR; Article 6 (1) (f) GDPR for attributing the entry to the person submitting it (legitimate interest in traceability for the server staff) Purpose Managing a Minecraft server’s whitelist from Discord and from the dashboard, keeping entries traceable and removing them automatically when someone leaves the Discord server ### Whitelist applications Data Discord server ID, Discord user ID of the applicant, Minecraft name and UUID, the time since which the name has been known (information from mc-api), note, decision, Discord user ID of the deciding person, time and reason of the decision Legal basis Article 6 (1) (b) GDPR; Article 6 (1) (f) GDPR for the attribution to the deciding person (legitimate interest in traceability within the server staff) Purpose Application for admission to the whitelist of a Minecraft server with review by the server staff; accepted names are entered ### Account link Data Discord server ID, Discord user ID, Minecraft UUID and name, one-time linking code Legal basis Article 6 (1) (b) GDPR Purpose Connecting a Discord account with a Minecraft account as the basis for role synchronisation and real mentions from in-game ### Role and rank synchronisation Data Discord server ID, role ID, command on grant, command on revoke, time of execution; for the reverse direction the rank names of the Minecraft server with the assigned role ID and the most recently reported ranks (180 days) Legal basis Article 6 (1) (b) GDPR Purpose Automatic execution of a Minecraft command as soon as a role is granted or revoked — and conversely assignment of a Discord role when a linked player receives a rank in the game ### Alerts and log Data Discord server ID, alert role ID, log channel ID, console channel ID, switches for the individual notifications, role IDs with access to individual areas of the dashboard Legal basis Article 6 (1) (b) GDPR Purpose Outage alerts, logging of executed server commands, forwarding of warnings from the Minecraft console ### Chat synchronisation Data Discord channel ID, Minecraft address and port, connection token as a hash, time and IP address of the Minecraft server's last request with this token, expiry date of the token, switches for the relay directions, language, chat format and word filter, error counter; in addition the software, Minecraft and plugin version of the server (install base) and performance readings of the server (TPS, tick time, memory; 35 days); version and time of the terms of service accepted when connecting in the dashboard; the server's self-description (loader, Java version, which features it offers and why one is missing); the transport currently in use (stream or regular polling, in memory only). Details the plugin sends about a player (UUID, world, coordinates, game mode, health, level) are only used to fill in the chat format and are not stored Legal basis Article 6 (1) (b) GDPR; for the individually selectable events additionally Article 6 (1) (a) GDPR Purpose Relaying chat, joins, quits, deaths and advancements between Minecraft and Discord; detecting whether a token is still in use; performance chart and overload warning in the dashboard; proof of consent; notice of a newer plugin version and detecting when a promised feature is missing ### Chat message buffer Data Discord server ID, channel ID, message text, author, time; for messages from Discord additionally username, server nickname, highest role and channel name (for the placeholders in the chat format) Legal basis Article 6 (1) (b) GDPR; Article 6 (1) (f) GDPR (legitimate interest in delivery without duplicates) Purpose A short-lived buffer so that no message is relayed twice or not at all ### Plugin error reports and operational monitoring Data Error reports from the plugin: type of error, error message (cleaned of IP addresses, e-mail addresses and anything token-like before sending), a limited number of code locations, cause, loader, Minecraft, Java and plugin version, frequency and first and last occurrence; in addition, periods in which a server did not deliver promised data (such as TPS or performance readings). No chat content, no player names, no configuration Legal basis Art. 6(1)(f) GDPR (legitimate interest in stable, secure operation and in fixing errors in the plugin and the bot) Purpose Detecting and fixing errors in the plugin and the bot, filtering out false alarms, operational diagnostics. Sending error reports is enabled by default and can be switched off at any time in the plugin configuration with error.report: false (objection under Art. 21 GDPR) ### Player presence Data Minecraft name, first and last appearance, last event (join, quit, chat, death, advancement), number of joins — per connected Minecraft server Legal basis Article 6 (1) (f) GDPR (legitimate interest of the server staff in recognising inactive players and outdated whitelist entries) Purpose Showing in the dashboard who was last on the server and when. Only what the plugin reports anyway for the chat relay is stored; it is deleted together with the connection. ### Server commands, buttons and schedules Data Discord server ID, command text, Discord user ID and name of the person who triggered it, state and output of the command (2 days), role IDs with permission for certain commands, saved buttons (macros) and schedules including the person who created them Legal basis Article 6 (1) (b) GDPR; Article 6 (1) (f) GDPR for the attribution to the triggering person (legitimate interest in traceability towards the server staff) Purpose Running Minecraft commands from Discord and from the dashboard, showing the result, recurring commands at fixed times ### Live console and console channel Data Lines from the Minecraft server's log, for as long as someone has the console open in the dashboard or the server staff have set up a console channel in Discord. These lines can contain names, IP addresses and chat messages of players of the Minecraft server. Legal basis Article 6 (1) (b) GDPR (provision to the server staff). The staff of the Minecraft server are responsible for the content of the server log; they decide who may see the console channel. Purpose Showing the running server log to the server staff. The live console is held in memory only and not stored in the database; messages in the console channel remain for as long as Discord keeps them. ### Public status page and server directory Data Short name, server name, address, edition, online state, player count and version; in the directory additionally description and tags — in each case only if the server staff have explicitly released the server Legal basis Article 6 (1) (b) GDPR Purpose Publicly accessible status page at mc-sync.eu/s/‹name› and entry in the directory. The player list and the Discord server ID are not published. The release can be withdrawn at any time. ### Voice channel updates Data Channel ID, server address and edition, Discord server ID, type of update, time, error counter Legal basis Article 6 (1) (b) GDPR Purpose Keeping channel names up to date with player count or server state ### Default server addresses Data Discord server ID, stored address, edition Legal basis Article 6 (1) (b) GDPR Purpose Queries without typing the address every time ### Button interactions Data Button identifier, Discord user ID, type, state, time Legal basis Article 6 (1) (b) GDPR Purpose Handling clicks in Discord messages (refresh or vote buttons, for example) ## Artificial intelligence (“McAsk”) **Notice under Article 50 of the AI Act** “McAsk” is an AI system. You are talking to a machine there, not to a human being. The answers are generated automatically, can be factually wrong and are no substitute for expert advice. This disclosure is made under Article 50 (1) of Regulation (EU) 2024/1689 (AI Act), whose transparency obligations have applied since 2 August 2026. For the answers we use a language model of OpenAI Ireland Ltd. (currently GPT-5 mini). The following is transmitted to OpenAI and processed there: your question, the chat so far, an internal identifier and the Minecraft names you have linked to your Discord account. If you ask on mc-sync.eu, the address and title of the page you are on are added, and on guide, command and download pages also their public text. In the dashboard, the address contains the identifiers of the Discord server and the Minecraft server; if you are allowed to manage the Discord server, its name is transmitted as well. The assistant reads data of a Discord server from the dashboard only after you have allowed it in the chat; that data is then transmitted too. According to the provider's assurances, content sent via the API used is not used to train its models. The conversation at OpenAI is deleted together with the associated chat — after 30 days at the latest, and immediately when you delete the chat or your data. If your question requires research on the web, the search term needed for it is additionally transmitted to the search service Tavily. What is transmitted is the search query, not your Discord identifier. The legal basis is Article 6 (1) (b) GDPR — the processing is necessary to provide the function you called up. Do not enter special categories of personal data within the meaning of Article 9 GDPR or any credentials into the chat. ## Recipients and transfers to third countries We pass data on only where that is necessary for operation. The parties involved are: - Cloudflare, Inc. (USA) sits in front of the website as a network: every request to mc-sync.eu, including those of the dashboard, passes through Cloudflare. Cloudflare processes the IP address, time, requested address, browser type and technical details of the request in order to deliver the page and protect it against automated access, and — only with your consent — produces the web analytics statistics for us. - Netlify, Inc. (USA) delivers the website. Server-side access data such as IP address, time and browser type arises in the process; we have no access to it. - Discord inevitably processes everything that runs through Discord — messages, roles, channels — as well as the dashboard sign-in. Discord’s own privacy policy applies to the use of Discord itself. - OpenAI Ireland Ltd. processes the input of the AI chat; for research on the web the search service Tavily is added. Both receive only what the individual request requires. - mc-api.bisai.dev is a separate service operated by the same provider named in the legal notice. The bot retrieves server status, player profiles, heads and recipes there; what is transmitted are server addresses and Minecraft names, never your Discord ID. In the dashboard and on status pages your browser loads images directly from there, so mc-api learns your IP address in the process. mc-api's own terms of service and privacy policy apply to it: [mc-api.bisai.dev](https://mc-api.bisai.dev) - Modrinth (Rinth, Inc., USA) hosts the plugin downloads. The bot asks Modrinth for the latest version and only transmits the loader and Minecraft version — no data about you or your server. The download link in the dashboard and in /mcsync status leads to Modrinth, where its own privacy policy applies. - top.gg runs the voting for the bot. Only if you use /vote or the vote reminder do we transmit your Discord user ID to top.gg to check whether you have voted; top.gg reports votes to us via a signed webhook. top.gg's own privacy policy applies. - Web push runs through your browser's push service (Google, Mozilla or Apple depending on the browser). The content of an alert is end-to-end encrypted (RFC 8291); the service only learns that something is being delivered. Webhooks go to the address you entered yourself (for example Slack, ntfy, Gotify or a Discord webhook); the recipient's privacy policy applies. - The bot, the dashboard, the mail delivery (monitoring and notices about the agreement) and the database run on servers we rent inside the European Union. Where these services process data on our behalf, they do so on the basis of data processing agreements under Article 28 GDPR. Data is never passed on for advertising purposes or sold. Cloudflare, Inc., Discord Inc., Netlify, Inc., Rinth, Inc. (Modrinth), Tavily, Inc. and top.gg, as well as the provider of the push service depending on your browser, are based in the USA or outside the European Economic Area. The transfer is based on an adequacy decision under Article 45 GDPR (EU-US Data Privacy Framework) where the respective provider is certified under it, and otherwise on standard contractual clauses under Article 46 (2) (c) GDPR. Despite these safeguards, access by authorities there cannot be ruled out entirely. ## Retention periods We keep data only for as long as the respective purpose requires: - What is set up on a Discord server — server list, chat synchronisation, role synchronisation, commands, alerts, default addresses, whitelist — stays stored for as long as the setup exists. It is deleted as soon as it is removed in the dashboard or by command. If the bot is removed from the Discord server, all data of that server is deleted automatically after 30 days; the period leaves time to invite the bot again after an accidental removal without losing the setup. - Caches are continuously overwritten and discarded after a short time: chat messages and the output of server commands after two days, the server status at the next query. The live console is held in memory only. - A dashboard session lasts 30 days from the last use and can be ended at any time under “Signed-in devices”; the Discord access token is revoked when you sign out. - Watches and their delivery channels exist until you delete them or use the unsubscribe link. The confirmation link is valid for three days; a delivery channel that is not confirmed is deleted after 14 days, the delivery log after 30 days. - Logs are deleted automatically: the dashboard's activity log after 90 days, performance readings after 35 days, most recently reported ranks after 180 days, the command statistic daily. - The AI chat: questions and answers are stored as chat history for 30 days and then deleted together with the conversation at OpenAI; you can delete individual chats yourself before then. The daily budget is reset every day. - Your own data — language, reminders, AI chat, monitoring, account links, submitted whitelist names and applications — you can delete yourself at any time in the dashboard under “My data”. Entries in the logs of a Discord server then remain without your name and ID. - Plugin error reports and the history of missing signals are deleted automatically after 90 days; the transport in use is kept in memory only. If the bot is removed from a Discord server, error reports lose their link to its connections after 30 days. - The email address from the dashboard sign-in is refreshed at each sign-in and deleted if you do not sign in for two years, if Discord no longer reports a verified address or if you delete your data under “My data”. Where statutory retention obligations apply in an individual case, or where storage is necessary to assert or defend legal claims, deletion takes place afterwards; until then, processing is restricted (Article 18 GDPR). ## Legal bases at a glance Depending on the function, the processing rests on one of the following bases: - Article 6 (1) (b) GDPR — performance of the free usage contract covering the bot, the plugin, the dashboard and the monitoring feature. - Article 6 (1) (a) GDPR — consent, for instance for reminders, individually selectable alerts and the website statistics (there also under § 25 (1) TDDDG). It is voluntary and can be withdrawn at any time with effect for the future. - Article 6 (1) (f) GDPR — legitimate interest in operational security, protection against abuse (such as blocking leaked connection tokens), short response times, fending off automated access to the website and the traceability of changes and decisions on jointly administered servers. - Article 6 (1) (c) GDPR — compliance with legal obligations, for example when handling reports of illegal content under Regulation (EU) 2022/2065. Providing this data is neither required by law nor by contract. Without the details named in each case, however, the function concerned cannot run — a whitelist without a Minecraft name is not an entry. ## Minors The service is not directed at children. Discord’s own minimum age applies to the use of Discord. Where processing rests on consent, that consent is valid for people under 16 only with the agreement of their parents or guardians (Article 8 (1) GDPR). If we learn that a child’s data is being processed without the necessary agreement, we delete it. ## No automated decision-making There is no automated decision-making in individual cases, including profiling, within the meaning of Article 22 (1) and (4) GDPR. Automatic processes such as removing someone from the whitelist when they leave a Discord server, or running a command when a role changes, follow only the rules the server staff set themselves; they do not evaluate any person. ## Security of processing We take technical and organisational measures under Article 32 GDPR: transmission exclusively over encrypted connections, storage of connection tokens, session tokens and API tokens only as hashes, encrypted storage of sessions during a restart, database access only from the internal network, dashboard access only via Discord and only with the permission currently held on Discord, which is re-checked on every access. A connection token that appears in a Discord message is blocked automatically. Even so, complete protection of data against access by third parties is not possible when transmitting over the internet — for instance in email correspondence. If a personal data breach is likely to result in a high risk to you, we will notify you under Article 34 GDPR. ## Your rights You have the following rights in relation to us: - access to the data we process about you (Article 15 GDPR) - rectification of inaccurate data (Article 16 GDPR) - erasure (Article 17 GDPR) - restriction of processing (Article 18 GDPR) - receipt in a common format and transmission to another controller (Article 20 GDPR) - objection to processing based on a legitimate interest (Article 21 GDPR) - withdrawal of consent with effect for the future (Article 7 (3) GDPR) **Right to object** Where we process data on the basis of Article 6 (1) (f) GDPR, you may object to the processing on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests. You can obtain, take along and delete your own data yourself at any time: in the dashboard under “My data” ([mc-sync.eu/dashboard/account/data](https://mc-sync.eu/dashboard/account/data)). The file you download there is at the same time the information under Article 15 and the portability under Article 20 GDPR; the deletion there covers everything stored under your Discord ID. For everything else — and if you prefer not to use the dashboard — an informal message to the address given under “Controller” is sufficient. We respond without undue delay and at the latest within one month (Article 12 (3) GDPR). For requests via Discord, please understand that we must verify who we are talking to — disclosing data to the wrong person would itself be a data breach. Regardless of this, you have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, [www.baden-wuerttemberg.datenschutz.de](https://www.baden-wuerttemberg.datenschutz.de) ## Changes to this policy We adapt this privacy policy when the service or the legal requirements change. The version published on this page is the one that applies; the date in the header shows how current it is. If something material about the processing changes, we additionally point it out on the support server.