Privacy Policy
What we collect, why, for how long - and your rights.
The short version
- We collect what we need to run game servers: your account, linked game and Discord IDs, gameplay data, IP addresses for security, tickets and orders.
- We do not sell your data, do not show ads and do not use tracking or analytics cookies.
- IP addresses from the game are deleted automatically 12 months after you were last seen.
- Order records are kept for 7 years because Dutch tax law requires it.
- You can ask for a copy of your data or have it deleted: support@recaris.eu.
1. Who is responsible
The controller for the personal data described here is ICT-Hoogeveen, Sloodstraat 20, Hoogeveen, the Netherlands (Chamber of Commerce: 86197525). Questions about privacy: support@recaris.eu. We have not appointed a data protection officer, as we are not required to.
This policy covers recaris.eu, every game server operated by Recaris and our Discord bot. Discord, Microsoft/Mojang and Mollie also process data as independent companies under their own privacy policies.
2. What we collect, why and how long
"Legal basis" refers to Article 6(1) of the EU General Data Protection Regulation (GDPR): (b) necessary for the contract with you, (c) legal obligation, (f) our legitimate interests (running a safe, fair and working service), which we have weighed against your interests.
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Website account: email, username, password (stored only as a salted and peppered bcrypt hash), role, account creation and last login time | Creating and securing your account, logging in, contacting you about your account or orders | (b) contract | Until you delete your account |
| Linked accounts: Minecraft UUID and name, Discord user ID and name | Delivering purchases, rank roles on Discord, support tickets | (b) contract | Until you unlink or delete your account |
| Gameplay data: Minecraft UUID, name and name history, first/last join, playtime, last server, statistics, claims, homes, settlements, titles, in-game balances, leaderboard scores, and the nickname and custom join message you set (with who set them and when) | Running the game, protecting builds, leaderboards | (b) contract, (f) legitimate interest | As long as the world or game mode exists, or until you ask for deletion |
| Chat log: messages you send in game chat and staff chat, and messages relayed between Discord and the game, with time, server, channel, your Minecraft UUID, name and display name, and whether the chat filter stopped the message | Moderation: checking reports and enforcing the chat rules | (f) legitimate interest | 90 days, then deleted automatically (a message that led to a punishment can be kept as evidence with that punishment) |
| IP addresses on our game servers (see section 3) | Security, detecting ban evasion and alt-account abuse, IP bans | (f) legitimate interest | 12 months after you were last seen with that IP; on punishments until 12 months after the punishment ended |
| Website security data: IP address in rate limits, and web server logs at our host (IP, time, page, browser) | Preventing brute-force attacks, spam and abuse | (f) legitimate interest | Rate limits: about one day. Server logs: normally no longer than 30 days |
| Moderation: punishments (type, reason, dates, staff member), reports and the evidence attached, staff action log | Enforcing the rules, handling appeals, accountability of staff | (f) legitimate interest | Active punishments while they run; records up to 2 years after they end |
| Tickets and appeals: your name, messages, attachments (images) and the matching Discord ticket channel | Handling your appeal or support request | (b) contract, (f) legitimate interest | Deleted 24 months after the ticket was closed |
| Orders and memberships: account, Minecraft UUID, product, price, currency, status, dates, Mollie payment/customer/subscription IDs | Delivering what you bought, renewals, refunds, bookkeeping | (b) contract, (c) legal obligation | 7 years (Dutch tax retention duty, art. 52 AWR / art. 2:10 BW) |
| Emails you send us | Answering you | (f) legitimate interest | Up to 2 years after the last contact, longer if part of an order or dispute |
| Session cookie | Keeping you logged in, form security | (f) / strictly necessary | Until you close your browser - see the Cookie Policy |
| "Remember me" (only if you tick it when logging in): a random device token (we store only a hash of it), a short device description such as "Firefox on Windows", the IP address and the dates it was created and last used | Keeping you logged in on that device, showing you your signed-in devices, detecting a copied cookie | (b) contract (the service you ask for), (f) security | Until you sign that device out, sign out everywhere or log out there, and at most 30 days |
We get this data from you, from the Minecraft servers when you play (your Minecraft profile is verified by Microsoft/Mojang), from Discord when you link or use our bot, and from Mollie about the status of your payments. You do not have to give us data, but without an email address and password we cannot create an account, and without a linked Minecraft profile we cannot deliver purchases.
3. IP addresses and alt detection
When you connect to a Recaris Minecraft server, we store your IP address together with your Minecraft UUID, when we first and last saw that combination and how often. We use this only to keep our servers safe: to recognise accounts that are used to evade a ban or abuse the rules ("alts"), to apply IP bans, and to stop attacks. Only authorised staff can see IP addresses. Matching IP addresses are a signal for staff, not an automatic verdict - people in the same household or network can share an IP.
IP records are deleted automatically 12 months after they were last seen. An IP address attached to a punishment is kept while the punishment runs and removed 12 months after it ended.
4. What is public
Some things are visible to everyone by design: your Minecraft name, rank and title in game and on the website, leaderboards and settlement pages, and messages in public chat. Your email address, IP addresses, orders and tickets are never public.
5. Who else receives data
- Hosting provider (Self-hosted) - stores the website, databases and game servers on our behalf, under a data processing agreement.
- Mollie B.V. (Amsterdam, the Netherlands) - processes your payments. Mollie also acts as an independent controller for its legal duties (such as anti-money-laundering checks). See Mollie's privacy statement.
- Discord Inc. (USA) - when you link Discord or use our Discord server and ticket channels, and when you view a ticket with an image that was attached in Discord (the image is loaded from cdn.discordapp.com, which receives your IP address). Discord is responsible for its own platform. Apart from this the website loads nothing from third parties: fonts and images are served from recaris.eu itself.
- Microsoft / Mojang - verify your Minecraft account when you join (under your own agreement with Microsoft).
- Our email provider - to send account and order emails.
- Staff - volunteers of the Recaris team, bound to confidentiality, with access limited to what their role needs.
- Authorities - only when the law requires it.
We never sell your personal data and never share it for advertising.
6. International transfers
We store data in the European Union where possible. Discord is based in the United States: transfers rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the company is certified, and otherwise on the European Commission's standard contractual clauses.
7. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its use, to receive it in a portable format (portability), and to object to processing based on our legitimate interests. Where we rely on consent, you can withdraw it at any time.
Email support@recaris.eu from the address linked to your account (or tell us your Minecraft name and we will verify you another way, for example with an in-game code). We answer within one month. Some data we must or may keep, for example order records for tax purposes or data needed to enforce an active ban; we then tell you why.
You can complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); you may also complain in the EU country where you live. We would appreciate the chance to solve it with you first.
8. Children
Many Minecraft players are young, so we keep it simple:
- Children under 13 may not create a website account or buy anything. We do not knowingly collect personal information from children under 13 through the website. If we learn that we did, we delete it.
- Players aged 13 to 15 may create an account only with consent of a parent or guardian (in the Netherlands the GDPR age of digital consent is 16).
- When a child plays on our servers with a Minecraft account (which Microsoft offers to children only with parental permission), the servers process the gameplay and security data described above. Parents can ask us at any time to see or delete their child's data, or to block further collection, via support@recaris.eu.
9. California residents (CCPA/CPRA)
If you live in California, you have rights under the California Consumer Privacy Act as amended by the CPRA. In the past 12 months we collected these categories: identifiers (email, username, Minecraft UUID, Discord ID, IP address), commercial information (orders and memberships), internet or network activity (gameplay data, security logs) and account login credentials (sensitive personal information, used only to log you in). The sources, purposes and retention periods are in section 2.
- We do not sell personal information and do not share it for cross-context behavioural advertising. We have no actual knowledge of selling or sharing data of consumers under 16.
- You have the right to know, access, correct and delete your personal information, and not to be discriminated against for using these rights. You can use an authorised agent.
- Send requests to support@recaris.eu; we verify your identity as described in section 7.
10. UK and Switzerland
If you live in the United Kingdom, the UK GDPR gives you the same rights as in section 7; you can complain to the Information Commissioner's Office (ico.org.uk). If you live in Switzerland, the Swiss Federal Act on Data Protection (FADP) applies; you can complain to the Federal Data Protection and Information Commissioner (FDPIC).
11. Security
We protect data with HTTPS (HSTS), salted and peppered bcrypt password hashing, a strict Content Security Policy, CSRF protection, rate limiting against brute-force attacks, role-based staff access and a log of staff actions. No system is perfectly secure; if a breach puts your rights at risk, we report it to the authority and inform you as the law requires.
12. Automated decisions
We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Automated tools (anti-cheat, chat filters, alt detection) flag behaviour; punishments beyond short automatic mutes or kicks are decided or reviewed by staff, and every punishment can be appealed.
13. Changes
We update this policy when our service or the law changes. The date at the top shows the latest version; important changes are announced on the website.