Legal · Privacy

Privacy Policy

Last updated: October 6, 2026

This policy explains how ChunkCraft processes personal data when you visit the website, create an account, buy or use a plan, operate a Minecraft server, or contact support. It applies to the website, dashboard and related hosting services.

1. Controller and contact

The operator of ChunkCraft is responsible for the processing described here. Privacy requests can be sent to Email support. The operator's personal name and postal address are not published on this beta website yet.

2. Data we process

Account data: Clerk user ID, email address, verification state, profile information supplied through Clerk or Google, account creation time and authentication events.
Contract and billing data: selected plan, subscription state, checkout and renewal status, billing identifiers and webhook events. Full card details are handled by the payment infrastructure and are not stored in the ChunkCraft application database.
Server data: server name, owner ID, plan, allocated port and address, Minecraft version and software, selected settings and mods, operational state, resource usage and lifecycle events.
World and player-operation data: world files, configuration, whitelist and operator changes, backups and exports. Player names may be processed when you use access-management features. Console output can contain player names, IP addresses or user-generated content.
Technical and security data: request time, IP address, user agent, routing and proxy information, security events, error messages and service logs created by the host, Cloudflare, Clerk or the application.
Support data: messages, attachments and diagnostic information you choose to send by email or through the ChunkCraft Discord community.

3. Purposes and legal bases

We process data to create and secure accounts, provide the requested hosting service, provision and control servers, administer subscriptions, deliver downloads and backups, answer support requests, enforce plan limits, prevent abuse, diagnose incidents and meet legal obligations. Depending on the situation, processing is necessary to perform or prepare a contract, to comply with law, or for legitimate interests in secure and reliable service operation. Where consent is legally required, processing is based on that consent and may be withdrawn for the future.

4. Authentication and Google sign-in

Authentication is provided by Clerk. If you choose Google sign-in, Google and Clerk process the authentication request and provide the identity information needed to create or access your ChunkCraft account. ChunkCraft does not receive your Google password. Their own privacy terms also apply to their processing.

5. Billing

Clerk Billing and its payment infrastructure process subscription and payment information required for checkout, renewal, cancellation, fraud prevention and accounting. ChunkCraft receives identifiers and status information needed to activate the correct plan. Payment providers may retain transaction data under their own legal obligations.

6. Hosting, delivery and security providers

The service is hosted on infrastructure located in Germany. Cloudflare provides DNS, proxy, security and content-delivery functions and may process connection data at its global network edge. Clerk provides authentication and billing functions. Google provides optional website analytics when you consent and authentication when you choose Google sign-in. Discord is independent from ChunkCraft when you join or use the community server. Providers process data under their own terms and, where applicable, contractual data-protection safeguards.

7. Website analytics

Google Analytics 4 loads only after you explicitly allow optional analytics. It measures page visits, campaign source, engagement, authentication flow completion, plan selection, checkout interaction, onboarding steps, server actions and their outcomes. Dashboard server identifiers are replaced with a route placeholder. We do not send account IDs, email addresses, server names or addresses, player names, command text, console output, world contents, passwords or payment credentials. Query strings are excluded; only campaign source, medium and name in a restricted slug format are used for attribution. Google may process browser and network information when you consent. Advertising storage, Google Signals and personalized advertising are disabled. User and event data retention in Google Analytics is set to 14 months; aggregated standard reports may remain available longer. You can reject analytics or withdraw consent using Analytics preferences. Rejection does not prevent using the hosting service. Browser tools, missing consent and network failures mean analytics is not a complete accounting record.

8. Internal service measurement

To evaluate whether users can successfully activate and use a server, we record account creation and verification state, the first ready server event, the first and most recent observation of active players, and dates on which use was observed. These measurement records use internal account and server IDs and do not store the identity of the observed Minecraft player. Daily activity dates are routinely limited to the current UTC date and the previous 89 dates. First and most recent usage dates remain while the account is active.

9. Cookies and local storage

Clerk and security providers use cookies or equivalent browser storage that are necessary for authentication, session continuity, fraud prevention and security. Optional third-party services may use their own storage according to their policies. Do not block necessary Clerk storage if you want to sign in or manage a server.

10. Retention

Account, subscription and active server records are retained while needed to provide the service. Server worlds remain until deletion, subject to operational recovery processes and the selected plan. Backup retention depends on the plan and backups stored on the same host are not disaster recovery. Security and diagnostic logs are retained only as long as reasonably needed for troubleshooting, abuse prevention and system integrity. Transaction and legal records may be retained for statutory periods. Account-linked internal measurement is removed when account deletion is successfully processed; infrastructure failures can require a retry.

11. Sharing and international transfers

Data is shared only with providers required to run authentication, billing, infrastructure, security, analytics and support, or when disclosure is legally required. Some providers may process data outside Germany or the European Economic Area. Where required, transfers rely on an adequacy decision, standard contractual clauses or another lawful safeguard.

12. Your choices and rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or information about your data, and may object to processing based on legitimate interests. You may withdraw consent for future processing where consent is the basis. You also have the right to complain to a competent data-protection supervisory authority. Requests should be sent from the account email where possible so ownership can be verified.

13. Security and customer responsibilities

ChunkCraft uses access controls, signed internal actions, isolated workloads and restricted infrastructure access. No internet service can guarantee absolute security. Keep your account secure, grant operator access carefully, avoid placing secrets in server names or chat, and download worlds before deleting resources you need.

14. Children

Users must be legally able to enter the relevant agreement or use the service with the permission of a parent or legal guardian. Minecraft account eligibility and family controls are governed separately by Microsoft and Mojang.

15. Changes to this policy

We may update this policy when the service, providers or legal requirements change. The current version and update date are published on this page. Material changes affecting active users may also be communicated through the service.