We collect the minimum we need to run Blocktopia, and we treat what we hold as a long-term legacy rather than a growth funnel.
The short version
We collect the minimum we need to run Blocktopia. We never sell your personal information. Player data is treated as a long-term legacy, not a growth funnel. Blocktopia is for ages 16 and up — we don't knowingly collect data from anyone under 16.
Who we are (data controller)
The data controller responsible for your personal data under the GDPR is the operator named in our Impressum. For any privacy request you can reach us at [email protected] or through our help page.
What we collect
- Account info: email, chosen Minecraft username, and password (hashed).
- Age: at sign-up we ask your date of birth to verify you are old enough to use Blocktopia (16+). If it shows you are under 16, we don't create an account. From it we set a single derived under-18 flag, used only for age-gating adults-only (18+) servers — a protection we're rolling out. Your date of birth is held in our authentication system and is never shown publicly; the under-18 flag is held server-side and is never exposed in public profiles, API responses, or leaderboards.
- Gameplay stats: if the Blocktopia plugin is installed on a server you play, we receive counts of actions (blocks placed, mobs defeated, time played). We never receive chat, inventory, or location data.
- Minecraft UUID: the public identifier Mojang assigns to your account. We use this to link stats to your profile. No other PII beyond this.
- Basic usage logs: IP address and user agent for security (kept 30 days), so we can block abuse and debug problems.
What we don't collect
- Location (beyond the country inferred from IP for server recommendations)
- Content of in-game chat or private messages
- Real names, phone numbers, or payment details (Blocktopia is free; we take no payments)
- Browser fingerprints or cross-site tracking
Age requirement (16+)
Blocktopia is for ages 16 and up. Under GDPR Art. 8, as applied in Germany, the digital-consent age is 16, and we do not offer accounts to anyone under it. If we learn that an account belongs to someone under 16, we close it and delete the data.
For players who are 16 or 17 (under 18) we record an under-18 flag that will gate access to adults-only (18+) servers routed through Blocktopia as we roll that protection out. A 16+ player is the data subject for their own account and exercises their own GDPR rights (see Your rights below); we do not transfer control of an account to anyone else, including a parent, on request.
See our information for parents for what the under-18 flag does and does not cover.
Legal basis for processing
Under GDPR Art. 6 we rely on the following bases:
- Performance of a contract (Art. 6(1)(b)): creating and running your account, claiming your username, and displaying your stats and profile.
- Legitimate interest (Art. 6(1)(f)): short-lived security logs to block abuse and debug the service, and keeping the platform safe.
- Consent (Art. 6(1)(a)): for any optional processing we may add later (e.g. an opt-in newsletter). Since Blocktopia is 16+, our users meet the digital-consent age and can give this consent themselves.
- Legal obligation (Art. 6(1)(c)): where the law requires us to retain or disclose specific data.
How long we keep data
- Account data (email, username, hashed password, date of birth, under-18 flag): for as long as your account exists, then deleted on account closure.
- Gameplay stats & achievements: retained as long-term legacy; on account deletion they may remain in anonymised form to preserve server leaderboards.
- Security logs (IP address, user agent): 30 days, then deleted.
- Deleted-account remnants: personal content is removed promptly; anonymised stats carry no identifying information.
International transfers
Our hosting is provided by Hetzner, located in the EU, so account and gameplay data stays within the EU/EEA. Where a processor we use for email delivery or similar operational functions is located outside the EU, we rely on an adequacy decision or the EU Standard Contractual Clauses (SCCs) as the safeguard. We do not run advertising or cross-site tracking.
Your rights
Under the GDPR you have the right, at any time, to:
- Access a copy of all your data (Art. 15)
- Correct anything that's wrong (Art. 16)
- Delete your account and personal content (Art. 17)
- Restrict or object to processing (Art. 18, 21)
- Receive your data in a portable format (Art. 20)
- Withdraw consent at any time, where processing is based on consent
Email us via the help page and we'll action your request — we reply to data requests first.
You also have the right to lodge a complaint with a data-protection supervisory authority. The authority competent for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
Cookies
We use only strictly-necessary cookies — to keep you signed in (an encrypted session cookie) and to secure the login flow (short-lived OAuth/PKCE and account-linking state). We don't use analytics, advertising, or third-party tracking cookies, so there's nothing non-essential to opt into. Because these cookies are essential to run the service, they don't require consent under the GDPR and the German TTDSG; clearing them will simply sign you out.
Security
Passwords are hashed with a modern algorithm. Sessions are encrypted cookies. We use multi-factor authentication for staff access to production systems. If we ever suffer a data breach, we'll notify affected users within 72 hours.
Contact
Questions about privacy? Reach out through our help page. A real person will answer.