1. Who is responsible
The data controller is KelpieMC Network, [not provided yet], VAT number [not provided yet]. For anything about your personal data write to [email protected]. We have not appointed a Data Protection Officer because the law does not require one for our activity.
2. Data we collect
• Account: username, email address, password (stored only as a salted hash, never readable), date of birth, gender if you choose to give it, language, the Minecraft account (name and UUID) and the Discord account (ID and name) you link, profile picture, bio, location and social links you add, preferences, and two-step login secrets (encrypted). • Activity: threads, posts, reactions, comments, your friends and the players you block, private messages with your friends (text and images), reports you send, support tickets, staff applications, notifications and moderation records about your account. • Purchases: order number, items, Minecraft name and amount, received from Tebex. We never see your card or payment details. • Technical: IP address (shortened in your sign-in history), browser and device type at sign-in, session cookies, attempt counters and security logs. • Public reports: name and email address of whoever sends a report through the public form, with or without an account.
3. Why we use it and on what legal basis
• Running your account, the forum, tickets and the features you use, including the notifications you choose: performance of the contract (GDPR art. 6(1)(b)). • Checking the minimum age: the date of birth is required for this reason only and is never shown (art. 6(1)(b) and (c)). • Security: stopping abuse, spam and account theft, sign-in alerts, attempt limits and the captcha: our legitimate interest in protecting users and the services (art. 6(1)(f)). • Moderation and reports: legal obligations under the Digital Services Act and Italian Law 71/2017 (art. 6(1)(c)) and our legitimate interest in a safe community (art. 6(1)(f)). • Purchases and accounting: contract and tax obligations (art. 6(1)(b) and (c)). We do not use your data for advertising, we do not sell it and we do not build marketing profiles.
4. Minors
You can create an account from 14 years old, the age at which Italian law (art. 2-quinquies of Legislative Decree 196/2003) allows young people to agree on their own to online services. We check the date of birth at sign-up. If we find out that an account belongs to someone younger, we close it and delete its data. Parents and guardians can contact us at [email protected].
5. Automatic tools
The automatic filter described in the Terms checks the text of threads, posts, comments, private messages and tickets for blocked words and spam patterns. For private messages it keeps no copy of the text: a blocked message is simply not sent. It can stop a message or hold it for review by a person, but it never decides sanctions on your account by itself: no decision based only on automated processing with legal or similarly significant effects is taken (GDPR art. 22). The captcha (Cloudflare Turnstile) checks technical signals from your browser to tell people and bots apart.
6. Who receives the data
We share data only with providers that help us run the services and are bound by contract to protect it: • the hosting provider of the website and the database, with servers in the European Union; • Cloudflare, Inc., which protects and speeds up the website (it handles IP addresses and requests) and provides the captcha; • the email provider that delivers security emails and notifications; • Discord Inc., only if you link your account or choose notifications on Discord; • Tebex Limited, which handles payments as an independent controller under its own privacy policy. Pictures from other sites shown in posts (GIFs, Discord emoji), GIF searches and Minecraft skins (Crafatar, mc-heads.net, Minotar) are fetched by our server, so your browser and your IP address do not reach those services. Staff members see only the data they need for their role and never read private conversations: they see a private message only when someone who received it reports it, and then only the copy saved with the report. We disclose data to authorities only when the law requires it.
7. Public game statistics and the KelpieMC API
What you do on our game servers is public by default: the statistics and results of every game mode, mode data (for example levels, kits or progress), your friends list and in-game economy data such as balances. Anyone can see this data on the website and read it through the KelpieMC API, including third-party websites, bots and tools that use an API key. • Your online status, your recent activity and live data (for example the server or game you are playing right now) are published only if you choose to show them. • You can hide each group in game with /api settings. Hidden data disappears from the website and from the API from the next request. • Never published: IP address, email address, website account data, punishments, screenshare data and private messages. Copies that third parties read through the API before you hid your data are outside our control: we cannot recall or delete them.
8. Transfers outside the European Union
Some providers are based outside the EU: Cloudflare and Discord in the United States, Tebex in the United Kingdom. Transfers to the United States rely on the EU-U.S. Data Privacy Framework for certified companies and on the Standard Contractual Clauses approved by the European Commission; the United Kingdom is covered by an adequacy decision of the European Commission. You can ask for a copy of these safeguards at [email protected].
9. How long we keep it
• Account data: as long as the account exists. When you ask to delete it, it is deleted after 14 days (the time to change your mind): email, date of birth, gender, picture, profile, links, sessions, sign-in history, notifications and staff applications are erased. • Threads and posts: kept after the account is deleted, signed as "Deleted user", so that discussions stay readable (legitimate interest of the community). You can ask us to remove a post that contains your personal data. • Private messages: kept with no fixed deadline, so that you can read your conversations again, until the sender deletes a message or one of the two deletes the account: then the whole conversation, images included, is erased. Images are stored without their metadata (such as location or camera). When a message is reported, a copy of it and of the 10 messages before it is kept with the report. • Tickets and reports: the name becomes "Deleted user" when the account is deleted; the cases themselves are kept as long as needed for possible disputes. • Sign-in history (date, shortened IP address, device): 180 days; the most recent entry is kept to recognise new devices. • Sessions: until they expire or you sign out. Attempt counters: at most 2 days. • IP addresses in the staff activity log: 12 months. • Order records: as long as Italian tax law requires (up to 10 years), no longer linked to a deleted account.
10. Cookies and local storage
We use only what is needed for the site to work: the session cookie that keeps you signed in, the staff session cookie for the panel, and your browser storage to remember the language and that you have seen the cookie notice. We do not use advertising or analytics cookies, so no consent is needed for them.
11. Your rights
You can access your data, correct it, delete it, receive it in a portable format, restrict its use or object to it (GDPR articles 15 to 21). Most of this is self-service: edit your profile in Account settings, and use Account › Security to download all your data as a file or delete your account. For everything else write to [email protected]: we answer within one month. If you think we are handling your data unlawfully, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the country where you live.
12. Security
Connections are encrypted, passwords are stored only as salted hashes, two-step secrets are encrypted, and staff must use two-step login. We limit repeated attempts, alert you by email about new sign-ins and password changes, and record staff actions in an activity log. If a breach puts your data at risk, we notify the authority within 72 hours and, when required, tell you directly.
13. Changes
If this policy changes in a way that matters to you, we publish a notice and ask you to confirm that you have read the new version the next time you visit while signed in.
Current version: October 21, 2026.
