Privacy Policy

1. Controller

2. What we process

• Server logs (technical): IP address, user-agent, requested URL, timestamp. Legal basis: Art. 6 (1) f GDPR (legitimate interest in operational security & abuse prevention). Retention: max 30 days.
• Account data (on registration): username, email, hashed password, registration timestamp, optionally Minecraft username & UUID after verification. Legal basis: Art. 6 (1) b GDPR (contract fulfilment).
• Session cookies: a session token after login (own cookie / localStorage, no tracking). Legal basis: Art. 6 (1) b GDPR.
• Mojang player data: when you log in to the Minecraft server your Mojang UUID is transmitted. We may query Mojang's public profile API to detect name changes.
• Shop purchases: payments are processed via PayPal. We store order number, recipient Minecraft name, and purchase date. Payment details are processed exclusively by PayPal and not stored by us.
• Forum posts: content you publish on the forum is stored permanently and linked to your username.

3. Third-party services

The following services process data on our behalf or when you use certain features:

• PayPal: Zahlungsabwicklung im Shop (EU/USA). Privacy info
• Cloudflare: CDN & DDoS-Schutz für die Subdomains (EU/USA). Privacy info
• Mojang: Minecraft-Account-Verifikation (UUID-Lookup) (EU/USA). Privacy info

4. Cookies

We use only strictly necessary cookies / localStorage entries:

• kehbyz_token: your login session token.
• kehbyz_streak_*: local streak counter for daily rewards.
• kehbyz_cookie_consent: stores your cookie choice.

Third-party cookies (PayPal) are only loaded on the checkout page and only after your consent via the cookie banner.

5. Your rights

Under GDPR you have the right to:

• Access your stored data (Art. 15)
• Rectification of incorrect data (Art. 16)
• Erasure / right to be forgotten (Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Lodge a complaint with the competent supervisory authority (Art. 77)

To exercise your rights, send a short email to 9ercoc@gmail.com.

6. Server location & transfers to third countries

The website and the game server are hosted in Germany. Data is generally processed within the EU.

Transfers to the USA: PayPal (payments) and Cloudflare (CDN/DDoS protection) process data partly in the United States. Both providers participate in the EU-U.S. Data Privacy Framework (Commission adequacy decision of 10 July 2023) or use EU Standard Contractual Clauses (Art. 46 GDPR) as a transfer safeguard.

Mojang (Microsoft): when you log in to the Minecraft server, your UUID is transmitted to Mojang's session servers for authentication. Mojang/Microsoft processes this data outside the EU under their own terms (linked in section 3).

7. Necessity of providing data (Art. 13 (2) e GDPR)

The following data is required to use the service. Without providing it, the respective feature cannot be used:

• Username + Email + Password: required to create an account and log in.
• Minecraft username: required to deliver rewards or shop purchases in-game.
• Payment data (via PayPal): required to complete a purchase. We do not receive your full payment details.

You can browse most of the website (map, forum read-only, wiki, news, rules) without providing any of this data.

8. Automated decision-making (Art. 13 (2) f GDPR)

We do not use automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR. All moderation, ranking, and reward decisions are either rule-based (e.g. cooldown timers, daily-streak counters) or carried out manually by staff.