Privacy Policy

1.Who we are

UniversalMC is run by [Business legal name — to be provided]. For the purposes of data protection law, we are the “controller” of the personal information described in this policy, which means we decide how and why it is used. This policy covers our website, our Minecraft: Java Edition network (play.universal-mc.com), our Coin Store, and our Discord server.

Operator

[Business legal name — to be provided] (trading as “UniversalMC”)

Postal address

[Business postal address — to be provided]

Email

[Support email address — to be provided]

2.What we collect

When you sign in to the website

There are no website passwords and no email sign-up. When you run /link in-game, we create a one-time code linked to your Minecraft UUID and username. We store only a scrambled (hashed) version of the code, with when it was created, when it expires, and when it was used. When you sign in, we keep:

• your Minecraft UUID and username, when your website account was created, and your last login time; and
• a session record: a hashed version of your session token, when the session was created, last used, and expires, and your browser’s user-agent string (which describes your browser and operating system).

When you buy Coins

Payments are handled by Stripe on Stripe’s own checkout page. We never see or store your full card number. We keep an order record with your Minecraft UUID and username, the items, amounts, and currency, the Stripe Checkout Session ID and PaymentIntent ID, payment, refund, and dispute status, and timestamps.

Stripe collects your email address to send you a receipt, plus the payment details it needs. We do not copy your email into our own order records, but our staff may be able to see it, and limited payment information, in our Stripe account when handling an order, refund, or dispute.

Coins

We store your Coin balance against your Minecraft UUID, a history of changes to it (amount, reason, reference, and time), and a queue of Coin deliveries that have not been added yet.

When you contact Support

A support ticket contains the category, subject, and message you write, an optional contact email address, an optional order ID, and your Minecraft UUID and username if you were signed in. Staff may add internal notes. Please do not include sensitive information, such as health details or payment card numbers, in a ticket.

Cookie choices

When you choose your cookie settings, we record a random ID, your choice, the policy version, and the time. We do not record your IP address or your Minecraft account with it. See the Cookie Policy.

Technical logs

Like most websites, the reverse proxy run by our hosting provider may log your IP address, browser user-agent, the page you asked for, and the time. Our website also uses your IP address briefly, in memory only, to limit how many requests can be made in a short time. That rate-limiting data is not stored.

Voting

When you vote for UniversalMC on a third-party server-list website, that website sends us your Minecraft username and the site’s name so we can give you an in-game reward. Rewards are only given for votes those websites confirm to us, never for clicking links on our website.

Playing on the network

When you connect to the network, our servers necessarily receive your IP address, Minecraft UUID, and username, and your account is checked with Minecraft’s authentication service. Our servers also store game data needed to run the game modes, such as progress, ranks, and Coin balance.

Staff

If you are a staff member with administrator access, we also store your two-factor authentication setup (with the secret encrypted) and record your administrator actions, with your UUID and username, in an audit log.

Discord

If you join our Discord server, Discord handles your information under its own privacy policy. Our staff can see what you post there, your Discord username, and moderation history.

What we do not collect

• We do not use website passwords.
• We do not receive or store full payment card numbers.
• We do not use analytics, advertising, or third-party tracking cookies or scripts.
• We do not ask for your real name, date of birth, or precise location.

3.How we use it, and our legal bases

Where data protection laws such as the GDPR or UK GDPR apply, we must have a legal basis for each use. The table below sets out our main uses.

We do not sell your personal information, and we do not share it for targeted (cross-context behavioural) advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4.Who we share it with

• Stripe processes payments for us. Stripe also acts as an independent controller for some data, for example to meet its own legal and fraud-prevention obligations. See Stripe’s privacy policy (opens in a new tab).
• Our hosting provider, [hosting provider name and location — to be provided], stores our servers and databases.
• Mojang and Microsoft provide the Minecraft authentication service that confirms your account when you join the network.
• Discord and server-list (voting) websites are independent services with their own privacy policies.
• Professional advisers, such as lawyers and accountants, when needed.
• Authorities, when the law requires it or when needed to protect people’s safety or our rights.
• A new owner, if UniversalMC is sold or transferred. This policy would continue to protect your information.

5.International transfers

Our servers are located in [country or region — to be provided]. Stripe processes data in the United States and other countries. Where we transfer personal information from the EU or UK to a country without an adequacy decision, we will rely on a recognised safeguard, such as standard contractual clauses.

6.How long we keep it

We keep information only as long as we need it. The periods below are proposed and have not yet been finalised or put in place.

7.How we protect it

• The website is served over HTTPS.
• Session tokens and link codes are stored only as hashes, so a copy of our database cannot be used to sign in.
• Card payments are handled entirely by Stripe.
• Administrator access is limited to staff with the network admin or owner rank, and requires two-factor authentication.
• Administrator actions on the website are recorded in an audit log.

No system is perfectly secure. If a breach affects your personal information, we will tell you and the relevant authorities where the law requires us to.

8.Children

Minecraft is popular with young players. Our website stores your Minecraft UUID, which is a persistent identifier and is treated as personal information under laws such as the US Children’s Online Privacy Protection Act (COPPA). We do not currently ask for anyone’s age.

Anyone under 18 (or the age of majority where they live) needs a parent or guardian’s permission to buy Coins. If you are a parent or guardian and believe your child has given us personal information, contact us and we will help, including deleting it where appropriate.

[Approach for children under 13 (or the local age of digital consent) — to be decided]

9.Your rights

Depending on where you live, you may have rights to access, correct, delete, or move your information, and to object to or restrict how we use it. You can also complain to your data protection authority. How to make a request is explained in Privacy Rights Information.

10.Cookies

We only use strictly necessary cookies: one to keep you signed in and one to remember your cookie choice. See the Cookie Policy.

11.Changes to this policy

We will update this policy when our practices change, and change the version and “last updated” date at the top. If a change is significant, we will also tell you on the website before it takes effect.

12.Contact

For privacy questions or requests, use Support or contact us at:

Operator

[Business legal name — to be provided] (trading as “UniversalMC”)

Postal address

[Business postal address — to be provided]

Email

[Support email address — to be provided]