Last updated 29 August 2026

Authentication privacy notice

This notice covers login.craftcorps.net, the CraftCorps Minecraft authentication gateway, and security controls on the public event server. It supplements the broader CraftCorps Privacy Policy and controls for these services if the two notices conflict.

Gameplay broadcasting and public terrain

CraftCam can publish Minecraft viewpoints, activity summaries and the featured player's proximity voice on a public livestream, including YouTube. Automatic participation is off until you choose /broadcast on in game. Use /broadcast off to stop camera targeting, activity sharing and voice relaying. This does not remove footage already published; contact us for a review. Private voice groups are excluded. /broadcast status shows your preference, not whether a livestream is currently live.

The public BlueMap displays terrain and construction. Friend-only location markers do not hide bases. Opting out of CraftCam does not hide public terrain or prevent other players from recording their own gameplay. Use /guide for the gameplay stakes and support details.

Controller and contact

The controller is CraftCorps Nicolas Palomino, ul. Bolesława Prusa 24/10, 50-319 Wrocław, Poland; NIP 8952259152; REGON 525782789; registered in CEIDG. Contact: [email protected].

Information and sources

• Account information: verified email address, optional verified phone number, password hash, and account status.
• Social sign-in information received from Google, Discord, or Microsoft when you choose that provider: its stable account identifier and limited profile or email claims.
• Minecraft information: username, cracked Java, premium Java or Bedrock/Floodgate UUID, ownership status, server login approvals, and the identities linked to your CraftCorps account.
• Moderation information: sanction reference, matched and linked account/game/Discord/application identities, latest game IP containment target, private and player-visible reasons, evidence-case reference, responsible staff identifier, start, expiry, revocation, appeal, and per-surface enforcement status.
• Friend-map information: your linked profile's current block-level position and direction is shown back to your signed-in account; if you enable the friend locator, it is also disclosed only to signed-in accounts linked to a mutually accepted in-game friend.
• Security information: IP address, browser or client information, session identifiers, timestamps, and authentication or ownership events.
• Gameplay security information: Minecraft UUID and username, Java or Bedrock platform, client brand and protocol version, game-session times, anti-cheat check and violation level, ping, server performance, and technical details about the action that triggered a check.

We never receive social-provider passwords, store plaintext CraftCorps passwords, or store production SMS codes.

Purposes and legal bases

• Provide the account, authenticate players, link Minecraft profiles, and recover access: necessary to perform the service contract or take steps you request before using it (GDPR Article 6(1)(b)).
• Show the private friend map when requested: necessary to provide the friend-locator feature you enable and request (Article 6(1)(b)).
• Prevent account takeover, impersonation, cheating, abuse, and ban circumvention; resolve ownership claims; investigate incidents; and enforce reviewed restrictions across matched and verified linked surfaces: our legitimate interests in securing the service and protecting fair play (Article 6(1)(f)). You may object on grounds relating to your situation.
• Respond to binding legal requests and protect legal claims: compliance with legal obligations or our legitimate interests, as applicable (Articles 6(1)(c) and 6(1)(f)).

An email address or a supported social identity is required to create an account. The security information and Minecraft identifiers are required to authenticate a game session. Adding a phone number is optional; without one, SMS recovery and phone/password sign-in are unavailable.

Recipients and service providers

We do not sell personal data or use it for advertising. Data is disclosed only as needed to:

• KORBANK, our infrastructure host in Poland, and Cloudflare for DNS, delivery, TLS, availability, and abuse protection;
• Twilio Verify for an SMS code when you choose phone verification or recovery;
• Resend for transactional verification and recovery email;
• Google, Discord, or Microsoft when you choose that sign-in provider, and Discord or another registered CraftCorps application when needed to apply or remove a global sanction; and
• professional advisers or public authorities where lawfully required.

International transfers

The origin service and database are hosted in Poland. Cloudflare's network and the selected SMS, email, or social-login provider may process data outside the EEA. Where required, transfers use an applicable European Commission adequacy decision, including the EU–US Data Privacy Framework for participating recipients, or European Commission Standard Contractual Clauses and supplementary safeguards. You may request information about the safeguard applicable to a provider by emailing us.

Retention

• Account, linked social identity, and Minecraft profile data: while the account is active, then erased or anonymised following a verified deletion request unless a limited record is needed for a legal claim or security investigation.
• Unverified email registrations with no linked social identity or verified phone: 7 days.
• Login sessions: valid for up to 30 days; expired or revoked session records are removed within a further 90 days.
• Phone verification records: codes expire after 5 minutes; related records are removed within 30 days.
• Minecraft login challenges: expire after 10 minutes; related records are removed within 90 days.
• Global sanctions: while active; expired or revoked records are removed after a further 180 days unless a documented appeal, incident or legal claim requires a reviewed hold.
• Friend-map positions: replaced about once per second, rejected by the web service after 10 seconds, and removed when the game plugin stops.
• Authentication audit events containing IP address and browser information: 180 days.
• Anti-cheat violations and supporting technical details: 365 days. Closed game-session metadata with no retained violation: 90 days. A named record may be held longer only for a documented appeal, incident, or legal claim and must be reviewed monthly.
• Encrypted root-only authentication backups: no more than 30 days, unless a specific backup is temporarily preserved for a documented incident, rights request, or legal claim and reviewed monthly.

Cookies

This site uses only first-party cookies that are strictly necessary for CSRF protection, temporary form state, and keeping you signed in. The temporary session cookie ends with the browser session; the login cookie lasts up to 30 days or until sign-out or revocation. We use no advertising or analytics cookies on this site. Blocking these cookies prevents authentication, so no cookie-consent banner is shown.

Your rights

Subject to the GDPR's conditions, you may request access, correction, erasure, restriction, or portability of your data, and object to processing based on legitimate interests. You may also ask us to review a kick, restriction, or ban. Email [email protected] and include the random sanction reference where available. We may verify your identity before acting and normally respond within one month.

You may also complain to the President of the Polish Personal Data Protection Office (UODO).

Children and automated controls

CraftCorps is not available to children under 13. Players aged 13–17 should review the Terms of Service with a parent or legal guardian. Automated security controls may reject an impossible game action, set a player back, temporarily disconnect a session, reject a login, or reserve a Minecraft username for a verified premium owner. Permanent anti-cheat action requires human review; we do not make solely automated decisions producing legal or similarly significant effects. Contact us if you believe a security, gameplay, or ownership decision is wrong.

Changes

We will update the date above when this notice changes. Material changes will be announced through the CraftCorps website or community channels.