Draft for review ·
Privacy Policy
Draft — pending owner confirmation. Operator, contact and account eligibility details are placeholders. This draft is available for review and is not a finalized legal policy.
What we collect, why we need it, and the choices you have.
1. Render API and MCP
- Uploads: for each render, the Minebud MCP sends only the pack files the chosen target needs, read from the pack folders you name. Listing targets runs on your computer and sends nothing.
- Processing: uploaded files are used only for that render and are not stored after it completes.
- Results: a finished render is available to anyone who has its unguessable link for 24 hours. The image or video and the record of that render are then deleted.
- Usage counters: we keep render counts per account: daily counts for 35 days and monthly counts for 13 months.
- API keys: we store only a keyed hash of each key, its name and when it was created and last used. A key is shown once, when you create it or approve a sign-in.
2. Pack Glitch Saver
When a server owner enables Pack Glitch Saver, we collect bounded scripting and pack error messages in a private, world-specific project on our self-hosted GlitchTip service. Messages include occurrence counts, timestamps and error categories. We filter ordinary chat and redact common IP addresses, email addresses, URLs and credentials; custom pack messages may still contain personal information, so pack authors should avoid logging it. Error events are retained for 30 days. Disabling collection stops new reports; deleting the world also queues deletion of its diagnostic project. Cleanup can be delayed during service outages.
3. Draft invoices
For accounts with retained servers, we create a zero-total USD draft invoice every 30 days and email its PDF attachment to your current verified address. Records include your display name and email at creation, server names and identifiers, service dates, invoice number, delivery state and the email provider receipt. Snapshots and private PDFs are encrypted in Cloudflare D1 and R2, and remain until account deletion. Deletion removes draft records and queues PDFs for removal after 24 hours; storage outages may delay cleanup. Your email provider retains messages under its own policies. These drafts require no payment and are not tax invoices.
4. Who handles your information
This policy covers minebud.dev, its account dashboard and our hosted Minecraft worlds. The operator identified in Contact is responsible for account administration, website security and service operations. If you join a customer's world, that world owner also determines how their world is run and how player content is used; their own notice and rules may apply.
This policy describes the service and optional features when enabled. Our Terms of Service explain free-world limits and acceptable use. An intended future feature does not mean we currently collect its data.
5. Player connection locations
For Pro and Pro+ worlds, we use the connecting player’s network address to look up an approximate country locally on the game host. This feature stores the country of their latest recorded join and country totals with the world’s player history. It does not store or send the IP address to a geolocation provider, Cloudflare’s dashboard database, or the server owner’s browser. Owners see country counts and online counts, not precise locations or a player-to-location list. VPNs and proxies may show a different country; unresolvable addresses appear as unknown. Earlier joins are not reconstructed. These records are removed with the world. Country data is provided by DB-IP.
6. Xbox player pictures
The Players menu resolves public gamer pictures through Microsoft's Xbox profile service using our server's Xbox account. Microsoft receives the requested gamertag. We cache the profile picture URL for up to 24 hours. Your browser loads pictures directly from an approved Microsoft image service, which receives your browser's IP address and normal image-request information. We suppress the dashboard referrer and do not store picture files on our servers. Your browser may cache them.
7. Backups and addons
When enabled, backups store compressed world saves and recovery metadata in private Cloudflare R2 storage. They include saved world and player data, but exclude addons, logs, server settings and account data. You can create, restore and delete recovery points and choose an optional automatic schedule. Recovery points are subject to the world's storage and count limits; automatic deletion of oldest recovery points defaults off. World deletion includes cleanup of tracked backup objects, which can be delayed while the host is unavailable.
When you use addons, we process uploaded packs, manifests and derived artifacts to validate and deliver them. Resource-pack artifacts are published through a public Cloudflare R2 CDN and can be downloaded by anyone with their URLs. Upload sources, behavior packs and encryption keys are kept outside that public bucket. Minecraft clients receive the keys needed to use encrypted resource packs, so encryption does not make those packs confidential. Shared resource artifacts may remain while other worlds still reference them.
8. Information we process
- Account information: your email address, account identifier, optional username, display name, selected avatar color, creation time and account status. Your display name initially defaults to the beginning of your email address.
- Authentication: a password hash, encrypted email and authenticator information, hashed verification and recovery proofs, security settings and session records. We process your submitted password and codes to verify them; we do not store a readable password or keep a readable copy of recovery codes in the account database.
- Sessions and activity: browser/device labels, approximate city or region supplied by Cloudflare, session creation and last-seen times, and audit records of account actions and dashboard navigation. These records support your Audit and Sessions pages and administrative security checks.
- Network and security information: IP addresses, browser/request information, bot-verification results and request counters. The application keeps keyed, pseudonymous mailbox, account and network identifiers for rate limits and free-tier eligibility. These identifiers can still relate to you; they are not anonymous data.
- World information: world names, settings, ownership, status, connection addresses, saved world and player data, console output, player counts, resource statistics and activity times. Game software and network infrastructure process player connection information and identifiers needed to operate multiplayer worlds.
- Communications: information you send when contacting us and the recipient, content and delivery information needed for verification and security emails. Avoid sending passwords, codes or unnecessary sensitive information.
9. Why we use it
We use information to create and secure accounts, authenticate requests, host and manage worlds, send requested verification and security messages, show activity and sessions, answer requests and diagnose service failures. We also use it to enforce free-tier limits, prevent unwanted email, investigate abuse and comply with applicable legal obligations.
Where a law requires a legal basis, providing the account and hosting service is necessary to perform our agreement with you. Security, abuse prevention and reliable operation serve our legitimate interests, subject to your rights. Legally required disclosures or records rely on the relevant legal obligation. If we introduce processing that requires consent, we will request it separately and explain how to withdraw it. Accepting service terms is not blanket consent to unrelated data use.
We do not currently run advertising, send marketing newsletters, sell account data or use customer worlds to train an AI feature. The application records operational and account activity rather than using a third-party advertising analytics SDK. Payment collection is not enabled, and we do not collect payment-card details.
10. Abuse prevention and automated checks
Registration, login and password reset use Cloudflare Turnstile. Cloudflare processes network and browser signals to detect bots, and may process signals for improving its detection systems under its own privacy terms. See the Turnstile Privacy Addendum and Cloudflare Privacy Policy.
Our application applies request and email limits and checks free-world allocation against existing account, mailbox and network claims. Gmail aliases are normalized for these checks, and IPv6 addresses within a /64 share an allowance. Public datacenter, VPN and Tor lists are downloaded to our infrastructure; your IP is checked there and is not sent to the list publishers for a lookup.
These checks can automatically delay or deny a request, and shared networks can affect eligibility. They do not establish a person's identity with certainty. Contact us to explain an error or request human review. A service denial does not prevent you from making a privacy request.
13. How long information stays
- Accounts and audit history: account records and their audit history remain until account deletion. Signing out alone does not delete your account or audit history.
- Sessions and proofs: sessions stop authorizing access at expiry or revocation. Verification proofs expire after ten minutes or are consumed earlier. Expired records are removed by bounded cleanup jobs; a cleanup delay does not make an expired proof valid.
- Abuse counters: the longest current email-budget window is 30 days. Expired counters are removed by scheduled cleanup. These limits use keyed identifiers rather than readable recipient addresses or IPs.
- Free-tier claims: account, mailbox and network claims remain while a world exists, including during pending deletion. Old mailbox claims remain after a verified email change. Claims expire 24 hours after the world is actually deleted and are then removed by scheduled cleanup, even if the account was deleted earlier.
- World saves: a world remains until deletion completes or it becomes eligible for automatic removal after 60 days without player activity. A request to delete an account schedules its worlds for removal. Deletion can take longer while a host is unavailable.
- Operational records: recent console and server logs rotate as their bounded storage fills. Records held by infrastructure and email providers follow their applicable retention arrangements. Recovery copies may persist until overwritten under the provider's recovery cycle; deleting a live record does not immediately erase every recovery copy.
- Support and legal records: correspondence is kept as needed to resolve the request and any related security, dispute or legal obligation. If retention is legally required after a deletion request, we limit it to the purpose and duration required.
14. Security and processing locations
We use encrypted website connections, password hashing, encryption for stored email addresses and authenticator secrets, access controls, verification, session revocation and bounded request limits. Hosted game data is not end-to-end encrypted from the service operator. No system can guarantee absolute security.
Cloudflare and hosting infrastructure can process information outside your country. Applicable protections depend on the operator, the providers and the laws that apply to your data. Contact us for information about processing locations and applicable transfer arrangements. We do not promise that all data stays in a particular country.
15. Your choices and privacy rights
You can change your display name, avatar color, password and email in Settings, manage authenticator protection, inspect account activity and revoke sessions. You can request world deletion in its settings. For account deletion, a copy of your information, corrections you cannot make yourself or other privacy requests, contact us below.
Depending on the law that applies, you may have rights to access, correct, delete, restrict or object to processing, and to receive portable data. You may also withdraw consent where processing relies on it, and complain to a data-protection regulator. Some rights have exceptions. We will verify identity proportionately, explain any lawful refusal or limitation and respond within applicable legal time limits. Do not send identity documents unless we specifically explain why they are necessary and how to provide them securely.
If your request concerns a world run by another customer, tell us which world is involved. We may direct the world-specific part of your request to its owner while handling information for which we are responsible.
16. Children and policy updates
Account eligibility and any parental-permission requirements are set out in our Terms. A parent or guardian who believes a child has supplied information contrary to those requirements should contact us. We will review the situation and take appropriate action under applicable law.
We will update this policy when data practices change, show the new effective date and provide additional notice of material changes where appropriate. New advertising, payment or AI features would require a fresh description of their actual processing; they are not covered by a claim that they already exist.
17. Contact
Operator: [to be supplied by the owner]
Country and region: [to be supplied by the owner]
Mailing address: [to be supplied by the owner]
Public contact email: [to be supplied by the owner]
For a privacy request, describe what you need and use your account email where possible. Never include your password, a live verification code or recovery codes.