Privacy

Who is responsible

Kjell Reidar runs HardcoreSMP and is responsible for this data. Send privacy questions to kjellreidarr@gmail.com.

What we store when you play

• Your Minecraft account: username and player ID (UUID). If you play Bedrock, the player ID is made from your Xbox ID.
• What you type in chat and the commands you use, including private messages (/msg) and team chat (/tc). This is in the server logs and is used for moderation.
• Game statistics: what Minecraft counts (blocks, items, mobs, damage, distance travelled, chests, villager trades and much more), day by day. Also which biomes you have been to and when, records (such as your lowest point and the time you came closest to dying), playtime, when you were online and when you were AFK, and how much you have used /home, /tpa and /rtp.
• What the game itself saves about you: your inventory, where you are, your level and your advancements, and the homes you set with /sethome (name and coordinates, which only you can see).
• Your death: when and where you died (coordinates and biome), what killed you, and if it was a player, who and with what weapon (including the weapon's name). Also your level, whether you were AFK, who you were fighting just before, and the death message.
• Whether you first connected through hardcoresmp.no or another address. We store only the answer (NO or EN), not the address itself. Everyone who played before the tags existed got NO.
• Your team, if you are on one: when you joined and when and why you left (left, were removed, or the team was disbanded), your role and permissions, invitations (who invited whom), who started the team, the team's homes (name, coordinates and who set them) and which member achieved each of the team's milestones.
• The anti-cheat (GrimAC): your name and when you were first and last here, your sessions with the Minecraft client and version you used, and what it flagged.

We do not store your IP address when you play.

What we store when you visit the website

• One cookie that remembers whether you picked Norwegian or English, for one year. We use no tracking, analytics or ads, and your browser loads nothing from other websites.
• If you create an account on the website, we keep a fingerprint (an argon2id hash) of your password, never the password itself, when the account was made and the password last changed, and how many wrong passwords were typed recently. The account is tied to your Minecraft account; we never ask for an email.
• While you register or choose a new password, your browser holds a cookie with the registration (a random key, what it is for and the Minecraft name) for up to 30 minutes. We keep the name and the password's fingerprint until you confirm, and delete them within two hours if you don't. The code you get with /login is kept only as a fingerprint and is valid for 10 minutes. Once you have confirmed, you get a cookie for two minutes that says it worked.
• If you sign in, you get one more cookie: a random session ID and nothing else, for up to 30 days. We store only a fingerprint of it and when you signed in, and delete the session within an hour after you sign out or it expires.
• To stop guessing and abuse, we count wrong passwords and requests per IP address. These counts are kept only in memory, never on disk, and are forgotten shortly after you stop; the count of wrong passwords within 20 minutes at the latest.
• The web server logs your IP address, the time, the page you opened (including what is in the address, such as a search), whether it worked, and the page you came from, to protect the site from abuse.

What is shown publicly

This is part of the game: your profile on the website shows your skin, whether you play Java or Bedrock, your NO or EN tag, your statistics and records, advancements and milestones with their date, when you started and were last online (to the hour), and an overview of your sessions: which day, which hour you logged on, how long you played and how long you were AFK. The session you are in now, and the session you died in, are shown to the minute.

If you die, the graveyard and your profile show when and where you died (biome and coordinates), the cause and any weapon, your level, whether you were AFK, the death message and who you were fighting, if anyone. The home page shows who is online right now, which world they are in and how long they have been online.

If you are on a team, the team page shows the team's name, tag, colour and logo, its members (alive and fallen) with their role and when they joined, who achieved the team's milestones, and the statistics of everything the members did while on it. Your profile shows the tag. The homes are never shown.

Your profile page itself is not shown in search engines like Google, but your name can be found through the player list, the graveyard, the advancements and the team pages. IP addresses, chat, private messages, your homes and anti-cheat data are never shown publicly.

Who else gets data

• Mojang and Microsoft: Java players sign in through Mojang, Bedrock players through Xbox. The website fetches your skin and cape from Mojang using your player ID.
• GeyserMC, which lets Bedrock players play here: if you play Bedrock, the server checks your Xbox ID with GeyserMC's service for linked accounts, and sends your skin there so Java players can see it. The website fetches Bedrock skins from there.
• Hetzner in Germany (EU), where the server and the website are hosted.
• Some plugins send anonymous statistics about the server itself (player count, versions) to bStats. Nothing about you.

Mojang and Microsoft may process the data in the USA. Microsoft is certified under the EU–US Data Privacy Framework, which the EU has approved for transfers there. GeyserMC is a volunteer open-source project, and we do not know where its services are hosted; they may be outside the EU.

We never sell your data, and we do not share it with anyone else.

Why we do it

We need this data to run the server, enforce the hardcore rule (one life), stop cheating and show the statistics that are part of the game. The legal basis is legitimate interest (GDPR Article 6(1)(f)).

You do not have to give us anything yourself: what we store comes from your Minecraft account and what you do on the server. Without a Minecraft account you cannot play. An account on the website is optional and only needed to manage a team there.

No decision about you is made fully automatically, with one exception that is the game itself: if you die, you are banned automatically. The anti-cheat stops movements it believes are cheating and alerts us, but it never removes or bans anyone on its own; a person does that.

How long we keep it

• Server logs (chat and commands): deleted automatically after 30 days.
• Anti-cheat: sessions are deleted after 90 days, what it flagged after one year, and your name with first and last seen at the latest one year after you last played.
• Backups: deleted automatically within 15 days.
• Web server logs: deleted on a rolling basis. The log keeps only the last 100 MB, which at current traffic is a few days.
• Statistics, profile, graveyard, teams and what the game saves about you: for as long as the server exists, or until you ask us to delete them. If you are banned, we keep your player ID and when you died, so the ban still applies.

Your rights

You can ask to see the data we have about you (and get a copy), have mistakes corrected, have it deleted, have our use of it restricted, or object to how we use it. Write to kjellreidarr@gmail.com. We answer within one month, and we will ask you to prove the account is yours first, for example by typing a code in chat on the server.

If you are under 16, a parent or guardian can contact us for you.

If you are unhappy with how we handle your data, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).