Privacy

1The short version

• mcvalue.gg shows no advertising and uses no tracking. Your browser loads fonts, scripts and images from mcvalue.gg only, never from a third party.
• We set cookies only where they are technically necessary: for signing in, and for language, appearance and currency when you change them.
• Profiles show publicly available data of Minecraft accounts: name, UUID, skin, capes and earlier names. On top of that we calculate an estimate of what the account is worth.
• If you do not want your Minecraft profile to appear here, you can have it removed free of charge through the form “Hide a profile”; our team handles the request. As the linked owner you can also hide single capes, earlier names or the value yourself in the settings.
• An account with mcvalue is optional. It does not need an e-mail address.

2Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is the operator of mcvalue.gg.

Privacy requests, in particular about a Minecraft profile, reach us through the form “Hide a profile”. As the linked owner of a profile you can hide single capes, earlier names or the value yourself in the settings.

3When you visit the website

When you open a page, your browser transmits technically necessary information: your IP address, the address requested, the time, the browser identifier and, where applicable, the page you came from.

• Protection and delivery: traffic runs through Cloudflare (protection against overload, delivery). Cloudflare processes your IP address on our behalf.
• Access log: the web server keeps a log of requests with IP address, time, address, status code and browser identifier. It serves troubleshooting and the defence against abuse and is deleted after 15 days at most.
• Request limits: so that single networks cannot overload the site, we count requests per network (IPv4 address or IPv6 prefix). No clear text is stored for that, only a check value formed with a secret key, and a counter; both expire after minutes to one day at most.
• A calculation in your browser: some forms (registration, “Hide a profile”) and the first load of a profile make your browser solve a short calculation. This replaces third-party puzzles; no data is sent to third parties in the process.
• Application log: the application itself logs no IP addresses, e-mail addresses, user names or browser identifiers.
• Security reports: if something on a page violates our security policy (CSP), your browser reports it to us. Of that we store only the page concerned, the rule violated and the origin of the blocked resource.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

4Cookies and local storage

We set technically necessary cookies only. No consent is required for them, which is why there is no cookie banner. Without signing in and without changing language, appearance or currency, the site sets no cookie.

• __Host-mcv_s: keeps you signed in. Without “Stay signed in” it ends with the browser session, otherwise after 30 days.
• __Host-mcv_dev: recognises your device after a sign-in, so that other people’s failed attempts do not lock you out. Lifetime 180 days.
• __Host-mcv_lang, __Host-mcv_theme, __Host-mcv_cur: remember language, appearance (light, dark, system) and currency when you change them.

The local storage of your browser also holds the list “Recently searched” of the home page. It never leaves your browser and can be removed there with “Clear history”.

5Minecraft profiles

When somebody searches for a player name or a UUID, our servers fetch the publicly available data for it and store it:

• from Mojang (the official interface): UUID, current name, skin and the cape being worn;
• from NameMC: earlier names with their dates, the list of capes known there and, when someone looks up a name, which accounts held that name before;
• from OptiFine (s.optifine.net): the picture of an OptiFine cape, requested with the player name. Your browser loads it from mcvalue.gg only;
• calculated by us: rarity score, tier and an estimated price range with its reasons, and daily counters of how often a profile was viewed.

This data relates to a Minecraft account. We neither know nor store a legal name, an e-mail address or login details of the account. Because a player name can be linked to a person, we treat the data as personal data all the same.

The purpose is looking up accounts and a comprehensible assessment of their value. The legal basis is our legitimate interest, and that of our users, in this information (Art. 6(1)(f) GDPR). The data is publicly available from the sources named in any case.

You can object to this processing at any time. In practice that means: we hide the profile. The whole profile is removed through the form “Hide a profile”, with or without an account; our team handles the request. As the linked owner you can also hide single capes, earlier names or the value yourself in the settings. Hidden profiles appear neither as a page nor in suggestions, cape lists or preview images.

To keep a hidden profile hidden, we maintain a block list with the UUID and the reason for the block. It is kept permanently, also across data restores.

6An account with mcvalue

For an account we store:

• your user name (it is not shown publicly anywhere);
• your password as a hash only (Argon2id), never in clear text;
• an e-mail address only if you choose to give one. We currently send no e-mails;
• language, appearance and currency, and the time at which you accepted the terms of use;
• your sessions: a hash of the session key, a coarse device label (for example “Firefox, Windows”), a country code and the times of sign-in and last use. We do not store an IP address with them;
• recovery codes as hashes only;
• notices to you inside the site and a log of security-relevant events (for example “password changed”), without IP address and without browser identifier.

The legal basis is the contract of use (Art. 6(1)(b) GDPR). You can export your data in the settings and delete the account there at any time.

7Linking a Minecraft account

If you want to prove that you control a Minecraft account, you join our Minecraft server and enter a code there. For that the server sends us the UUID and name of the account, the code and the IP address of the connection. The IP address only serves to limit failed attempts and is not stored in clear text. We never learn the login details of your Minecraft or Microsoft account.

We store the link between your mcvalue account and the UUID together with the time of the proof. What is publicly visible is at most that and when control was proven, never your mcvalue account.

The connection to the Minecraft server runs through a protection service (TCPShield), which processes your IP address in doing so. The legal basis is the contract of use (Art. 6(1)(b) GDPR).

8Premium and payment

The seller and contracting party for Premium is Tebex Limited (see the imprint). The purchase is completed on Tebex’s pages; Tebex processes your payment and billing data as a controller in its own right.

We receive notifications from Tebex about the state of a subscription and store which account it belongs to, its status and when it ends. We do not store names, addresses, payment data or IP addresses from the purchase.

9The form “Hide a profile”

Through the form we store the player name or UUID given, your message and, if you give one, a way to contact you. We use this only to handle the request. We delete contact details and message 90 days after the request has been dealt with.

The legal basis is compliance with your rights as a data subject (Art. 6(1)(c) GDPR) and our legitimate interest in handling the request (point (f)).

10Feedback on a valuation

In a profile you can say with one click whether an estimate is too low, about right or too high. We store the vote together with a check value of your network or, if you are signed in, of your account, so that the same vote does not count more than once. The check value is a hash formed with a secret key; we do not store an IP address with it. No account is needed for this.

11Recipients and service providers

• Cloudflare: delivery and protection of the website (processing on our behalf). Data may be transferred to countries outside the EU in the process.
• TCPShield: protection of the Minecraft server used for the proof of control.
• Hosting: the servers are located in a data centre of Hetzner Online GmbH in Germany.
• Tebex Limited: seller of Premium, a controller in its own right.
• Mojang and NameMC: our servers request data about Minecraft accounts there. These services learn nothing about you as a visitor in the process; your browser does not contact them.

We do not sell data and do not pass it on for advertising purposes.

12How long we store data

• Sessions: without “Stay signed in” up to 12 hours after the last use, 7 days at most; otherwise up to 30 days after the last use, 90 days at most.
• Counters for request limits: minutes to one day at most.
• Access log of the web server: 15 days at most.
• Log of security-relevant events: 400 days.
• Requests through the form “Hide a profile”: 90 days after they were dealt with.
• Account data: until you delete the account.
• Profile data of Minecraft accounts: as long as the profile is kept; after an objection only the entry in the block list remains.
• Backups: 35 days at most.

13Your rights

Under the GDPR you have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing that is based on a legitimate interest (Art. 21).

Much of this you can do yourself: export your data and delete the account in the settings, hide single capes, earlier names or the value in the settings, and have a whole profile removed through the form.

You can also lodge a complaint with a data protection supervisory authority if you believe that we do not process your data lawfully.

14Changes to this text

If the site or the legal situation changes, we adapt this text. The version published here applies.