Privacy Policy
Last Updated: November 5, 2026
Website accounts and CraftCorps Hardcore — updated 18 October 2026
Website sign-in and staff permissions now use the CraftCorps account service at login.craftcorps.net. We retain old website profiles, content and references and link a profile only after ownership is verified through its old password or unique connected Discord identity. A matching name or email alone is not proof.
For migration, we retain an eligible old bcrypt password hash for up to 90 days from import, deleting it when the profile is claimed or the retention period ends. It does not replace your CraftCorps account password. Unsupported or conflicting profiles stay unclaimed pending review. Contact support for account recovery or coordinated access, export and deletion requests.
The website uses a random session cookie for up to seven days and encrypted server-side credentials; it no longer authenticates using the old website JWT session. The account service has a separate session of up to 30 days. Signing out or revoking that account session invalidates linked website access.
Public text chat on CraftCorps Hardcore is relayed between Minecraft and Discord. Private messages and private voice groups are not relayed. The public map shows terrain and builds. Public messages may be retained by the receiving platforms.
CraftCorps Hardcore chat is automatically translated into each player's language. Public chat, friend direct messages and /helpop requests are sent to Google Cloud Translation for this. Google processes the text on its global infrastructure, does not store it after translating it and does not use it to train models. Type /language translate off in game to stop your messages being sent for translation and to see chat untranslated.
Automatic anticheat suspensions (CraftCorps Hardcore). When several anticheat checks agree that a player is cheating, or when the same cheat pattern shows up again after an automatic warning kick, an automated system can suspend that player for 72 hours. Staff check every suspension within those 72 hours. If they don't confirm it, it ends by itself. Only a staff member can turn it into a longer ban, which lasts at most until the end of the current season and never more than 120 days. These bans are never permanent. An automatic suspension doesn't affect season rewards. A ban confirmed by staff means you can't win season rewards that season. The ban screen shows a ban reference. To appeal, open a Ban appeal ticket on our Discord (discord.craftcorps.net) or email [email protected]. A parent or guardian can do this for you. Legal basis: legitimate interests (keeping the game fair for other players).
Shared connections. An automatic suspension usually also bans the IP address for the same 72 hours, and a ban confirmed by staff can extend that to at most 7 days. Before it does, the server checks whether another account joined from that IP address in the last 30 days, so family members or other players on the same network are not locked out. For this check the server keeps a keyed hash of each login IP address for 30 days, together with the account and the date. It doesn't keep the address itself, and the hash can't be turned back into an address without a secret key that only the server holds. Legal basis: legitimate interests (making sure a ban does not catch players who did nothing wrong). You can ask which dates we hold for your account, or ask for them to be erased, at [email protected].
Linking Minecraft to Discord. You can link your accounts in game with a code, or by signing in with Discord on login.craftcorps.net. If you sign in, Discord sends us your Discord user ID and username, and we show you both accounts and ask you to confirm. If you say yes, we link them and add you to the CraftCorps Discord server. Before linking, we check that neither account is banned on CraftCorps and that the Discord account isn't banned from our Discord server. We use your Discord access only for these steps and don't store it. We keep a record of each request (Minecraft UUID and name, Discord ID and username, and when you confirmed) for 7 days, then delete it. The link stays until you remove it with /unlink. If you claim the reward for linking, the game server keeps your Minecraft UUID and a hash of your Discord ID with no time limit, because each Discord account can claim once. Legal basis: performing the service you asked for, and legitimate interests for the ban check (keeping banned players out) and the one-claim record (keeping the reward fair).
Map icon. The face from your Minecraft skin is stored by your Minecraft UUID on the public map host, so anyone who has your UUID can view it. It shows no position. It stays until your skin is removed or the map is reset.
Retired services — updated 5 November 2026
These CraftCorps services have closed: the SMP server, Battle Royale and our other earlier game servers (event, beta and creative servers and the old lobby network), the Android launcher and the mobile mod, the installer for the official Minecraft launcher, Craft Music and its karaoke Discord bot, CraftCam livestreams, the egg and pearl currencies and wagering, the video contest, and the news section of this website. We no longer collect or use data for any of them.
On 4 and 5 November 2026 we deleted those game servers, their worlds and the databases that held their match statistics, Battle Score and wager records, together with the old coordinator database, Craft Music's data, what remained of CraftCam and the backups of the old SMP worlds. On 5 November 2026 we also deleted the video contest submissions, votes and comments, and the news articles and their comments, from the website database, and the egg and pearl balances and the Android launcher's crash reports and session telemetry from our Azure database. Some records from these services remain:
- Payment and reward records: The ledger of Minecraft redeem codes (MCRC) earned, claimed and redeemed, and egg transfers. We keep them indefinitely for legal and accounting reasons, audit and dispute resolution (see section 5).
- Staff history of the SMP server: Server performance records and player session records, last updated on 16 August 2026. A session record contains the player's Minecraft name and UUID, the session times and the country. We removed the IP addresses and the city and region from these records on 5 November 2026.
To get a copy of these records or ask us to erase them, email [email protected]. We may have to keep payment records where the law requires it.
1. Introduction
CraftCorps Nicolas Palomino (NIP: 8952259152), based in Wrocław, Poland, is committed to protecting your privacy. This policy explains how data is collected, used, disclosed, and protected when using the CraftCorps platform, including the launcher application, game servers, websites (craftcorps.net, battleroyales.net, craftclient.net), and Discord services (collectively the "Service").
As a business registered in the European Union, we comply with the General Data Protection Regulation (GDPR) and applicable Polish data protection laws.
2. Data We Collect
2.1 Account Data
- CraftCorps Account: Username, email address (optional), and password (stored as a bcrypt hash — we never store plaintext passwords).
- Microsoft/Minecraft: Via Microsoft OAuth — Xbox Gamertag, Minecraft UUID, and skin data. Microsoft account passwords are never received or stored.
- Discord: Via Discord OAuth — Discord user ID, username, and avatar. Used for account linking and community features.
- Google: Via Google OAuth — email and profile name. Used for social account verification.
- Facebook/Instagram: Via OAuth — account ID and profile name. Previously used to verify video contest entries; the contest has ended.
2.2 Gaming Data
- Progression Data: XP, rank tier, quest progress, daily logbook streaks.
- Economic Data: Transaction history (earnings and purchases), cosmetic inventory, and equipped loadout.
- Social Data: Friends list, team membership, and player reports.
2.3 Payment Data
2.4 User-Generated Content
- Job Applications: Real name, Discord name, Minecraft name, cover letter, and CV/resume uploads (PDF, DOC, DOCX).
2.5 Technical Data (Collected Automatically)
- IP Address: Collected for anti-cheat enforcement and VPN/proxy detection. IP addresses are not shared publicly.
- Website Visit Logs: When you visit craftcorps.net, our server records the page you opened, the page or site that linked you there (for example a search engine or an AI assistant), your browser's user agent and the time. These logs leave out your IP address and cookies. We use them to see how people find CraftCorps.
- Website Analytics: Page visits, referral source, browser type, and general geographic region via Cloudflare analytics. No third-party tracking cookies are used.
- Launcher Telemetry: Launcher version, operating system, Java version, crash reports, and session telemetry (opt-in, controlled by a single "Share diagnostics" toggle in the launcher's Settings → Privacy panel).
- Session Data: Legacy launcher/API sessions may use JWT tokens; current website sessions are described above.
2.6 Data We Do Not Collect
- Microsoft account passwords
- Device advertising identifiers
- Biometric data
3. How We Use Your Data
We use collected data for the following purposes:
- Service Operation: Authenticate accounts and manage game sessions.
- Game Integrity: Detect cheating and manage player reports.
- Community Features: Enable friends lists, teams, and Discord integration.
- In-Game Presence Badge: When you play on a CraftCorps server as an authenticated CraftCorps user, your player UUID is broadcast to other CraftCorps users on the same server so they see a small CraftCorps badge next to your nametag (similar to Lunar, Feather, and Badlion Client). Vanilla players never receive this broadcast and do not see the badge.
- Communication: Send in-game notifications, daily logbook reminders, rank change alerts, and moderation actions via Discord.
- Improvement: Analyze aggregated, anonymized usage patterns to improve game balance and user experience.
- Legal Compliance: Respond to legal requests and enforce our Terms of Service.
Legal basis (GDPR): We process data based on (a) contractual necessity (account and service operation), (b) legitimate interest (anti-cheat, fraud prevention, service improvement), and (c) consent (optional telemetry, marketing communications).
4. Data Sharing
We do not sell, rent, or trade your personal data. We share data only with:
- Cloudflare: Website hosting, DDoS protection, and privacy-focused analytics.
- Resend: Transactional account-verification and password-recovery email.
- Twilio Verify: Optional SMS verification and password recovery selected by the user.
- Microsoft/Mojang: Authentication tokens for Minecraft license verification.
- OpenAI and Anthropic: Server logs, chat and anticheat data may be processed by AI tools from OpenAI and Anthropic to help staff run and moderate the server. Staff make every decision except the automatic anticheat suspensions described above.
- Google Cloud Translation: CraftCorps Hardcore chat messages (public chat, friend direct messages and /helpop requests) and players' language settings, to show each message in the reader's language. Google acts as our processor under the Google Cloud data processing terms, does not store the text after translating it and does not use it to train models. Players can opt out with
/language translate off. - Discord: OAuth for account linking and for adding players who confirm a link to our Discord server; webhook notifications to staff channels for moderation (contest removals, player reports).
- ip-api.com: IP address lookups for geographic region detection and VPN/proxy identification. Only the IP address is shared; no personal identifiers are sent.
- Microsoft Azure (CDN): Hosts desktop launcher artifacts, modpack files, and update manifests. Azure logs download traffic for standard abuse prevention; no CraftCorps account data is attached to these requests.
5. Data Retention
- Account Data: Retained as long as your account is active. Deleted upon account deletion request.
- Currency Transactions: Retained for 90 days, then deleted automatically.
- Payment Records: Retained indefinitely for audit and dispute resolution purposes, including those from retired services (see Retired services above).
- Job Applications: Retained for 6 months after the position is filled, then deleted.
- IP Addresses: Retained for up to 90 days for anti-fraud purposes, then anonymized or deleted.
- Website Visit Logs: Deleted after 14 days.
- Launcher Crash Reports & Session Telemetry: Crash reports are stored for 90 days and session telemetry for 30 days, for diagnostics and device-compatibility analysis. For records from the retired Android launcher, see Retired services above.
- Contact Form Submissions: Stored for 90 days, then automatically deleted.
- Session Tokens: Expire after 30 days or upon logout.
6. Data Security
We implement industry-standard security measures including:
- HTTPS encryption for all communications
- Bcrypt password hashing (passwords never stored in plaintext)
- Cloudflare DDoS protection and WAF
- Server-side input validation and parameterized database queries
- Role-based access control for staff and admin functions
While we take reasonable precautions, no internet service can guarantee absolute security.
7. Cookies
The website uses minimal cookies for essential functionality. See our Cookie Policy for details.
8. Children's Privacy
The Service is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided personal data, contact us for deletion. Users aged 13–18 require parental or legal guardian consent as outlined in our Terms of Service.
9. Your Rights (GDPR)
As a data subject under GDPR, you have the right to:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate or incomplete data.
- Erasure: Request deletion of your personal data ("right to be forgotten").
- Restriction: Request restriction of processing in certain circumstances.
- Portability: Request your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interest.
- Withdraw Consent: Withdraw consent for optional data collection (e.g., telemetry) at any time.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with the Polish data protection authority (UODO — Urząd Ochrony Danych Osobowych) at uodo.gov.pl.
10. International Data Transfer
Our game servers, website, login service and API run on servers in Poland. Account data is stored in Microsoft Azure in the European Union. Some providers we use process data outside the European Economic Area (EEA):
- Cloudflare, which protects and delivers our website through its global network;
- Google Cloud Translation, which translates chat on Google's global infrastructure;
- Discord, where staff receive moderation and anticheat reports;
- OpenAI and Anthropic, whose AI tools help staff run and moderate the server;
- Resend and Twilio, which send account emails and SMS codes for the login service.
We are confirming the transfer safeguards for each provider with our lawyer and will update this section. The login service lists its own recipients and transfers in its authentication privacy notice.
11. Third-Party Links
The Service may contain links to third-party websites (Discord, YouTube, TikTok, Instagram, Facebook, GitHub). We are not responsible for their privacy practices. We encourage you to review their privacy policies.
12. Policy Changes
This Privacy Policy may be updated periodically. Significant changes are communicated via the website and Discord server. Continued use of the Service after changes indicates acceptance of the updated policy.
13. Data Controller
The data controller responsible for your personal data is:
- Business name: CraftCorps Nicolas Palomino
- Address: ul. Bolesława Prusa 24/10, 50-319 Wrocław, Poland
- NIP: 8952259152
- REGON: 525782789
14. Contact
For privacy questions, data access requests, or complaints:
- Email: [email protected]
- Discord: discord.craftcorps.net
© 2026 CraftCorps Nicolas Palomino. Unofficial Minecraft service. Not approved by or associated with Mojang or Microsoft.