Privacy

1. Who is responsible

The HexaCraft team is responsible for your data. For anything about your data, write to privacy@hexacraft.org.

2. What we keep and why

• Visiting the site. Our web server logs your IP address, the page, the time and your browser's name. We use this to keep the site running and stop abuse (our legitimate interest).
• Your account. Your name, which other players see. Your email address, for verification, password resets and receipts. A hash of your password, never the password itself. Your date of birth, to enforce the 13+ age limit and to switch friend requests off for players under 18. We need these to provide your account (contract).
• Your logins. For each browser and launcher you log in with: a device name, the IP address it last used and when. You can see and end them on your account page. A security log of logins and account changes, with IP addresses, helps us spot break-ins (legitimate interest).
• The game. The launcher's public identity key, your skin, the capes you own and the one you wear. Other players see your skin and cape in the game (contract).
• Friends and chat. Your friends, friend requests, blocks and mutes, and your messages. Your online status is held in memory only and shown to your friends. Messages are stored as you wrote them; they aren't end-to-end encrypted. We read them only when a player reports a chat. Reports keep a copy of the chat's recent messages for our moderators (contract, and our legitimate interest in keeping players safe).
• Purchases. What you bought, when, the price, and your agreement to delivery at once. Tax law requires us to keep these records (legal obligation).

Playing singleplayer stores nothing on our servers. We don't sell your data, show ads, use analytics or tracking, or make automated decisions about you.

3. Who else gets your data

• Stripe takes payments. It receives your card details, email address and country directly. Stripe is responsible for its own processing: see stripe.com/privacy.
• Cloudflare carries all traffic to this site, runs our DNS, sends our emails, forwards mail to our address and stores our encrypted backups and downloads.
• Our hosting providers run the server this site is on and the relay hosted worlds go through. The relay sees the IP addresses of the players in a hosted world while they play, and keeps nothing.
• Other players see your name, skin, cape and anything you send them.
• Servers run by other people get your name, account id, skin and IP address when you join them. They aren't ours, and their owners handle that data.

Stripe and Cloudflare may process data in the United States. They do so under the EU Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework.

4. How long we keep it

• Web server logs: up to 90 days.
• Verification and reset links: 24 hours and 1 hour. An account that is never verified is deleted after 7 days.
• Messages: 90 days.
• Security log: 1 year.
• Reports: as long as needed to deal with them and with repeated abuse.
• Purchase records: as long as tax law requires, usually up to 10 years, even after you delete your account.
• Everything else: until you delete your account.

When you delete your account, we delete your email address, password, date of birth, logins, skin, friends, requests and blocks at once. The account itself is closed for good but not erased: we keep its id, name and what it bought, for our purchase records and to stop someone else taking the name straight away. The name becomes available to others after 30 days. Messages you sent stay with their recipients, shown as from a deleted player, until they're 90 days old. Backups are kept for 14 days on our server and 90 days off-site.

5. Cookies

We only use cookies the site needs to work: one keeps you logged in (for up to 30 days after your last visit), one protects forms from other sites, and one remembers for a day that we couldn't make an account for someone. The payment page loads Stripe, which sets its own cookies to prevent fraud. There are no other cookies.

6. Children

Accounts are for players 13 and older. If we learn an account belongs to someone younger, we lock it. If you're under 18, friend requests start switched off.

7. Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. Write to privacy@hexacraft.org from your account's email address and we'll answer within a month. You can also complain to the data protection authority where you live.

8. Changes

If we change this policy in a way that affects you, we'll tell you by email or on this site first.

Last updated: 4 October 2026.