This Privacy Policy informs you about the type, scope, and purpose of the processing of personal data within our website and the associated CraftProxy service. We process personal data strictly in accordance with the General Data Protection Regulation (GDPR / DSGVO).

1. Data Controller

The responsible party (Controller) for data processing on this website and service within the meaning of the GDPR is:

2. Hosting Infrastructure

Our website and the reverse proxy servers are hosted by an external service provider:

• Prepaid-Hoster.de (Henrik Kramer e.K.)

Personal data collected on this website and through our proxy service is stored on our hoster's servers in Germany.

Data Processing Agreement (DPA): We have concluded a data processing agreement (AVV) with the above-mentioned provider. This is a contract mandated by data privacy laws that guarantees that they process the personal data of our website visitors and users only based on our instructions and in compliance with the GDPR.

Content Delivery Network (Cloudflare): To deliver this website quickly and protect it against attacks, requests to craftproxy.net are routed through the content delivery network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare processes the technical connection data of your request (in particular your IP address, the requested URL and browser information) and may deliver cached copies of our pages. The legal basis is our legitimate interest in a fast and secure website (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Cloudflare. Data may be processed in the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework, on the basis of which an adequacy decision of the European Commission exists (Art. 45 GDPR).

3. SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transfer to us cannot be read by third parties.

4. Data Processing when using CraftProxy

a) Website Access (Server Logs)

When you visit our website, the server automatically collects data that your browser transmits to us. This data is temporarily stored in log files to ensure the stable and secure operation of the website (Art. 6(1)(f) GDPR). Collected data includes:

• IP address
• Date and time of the request
• Requested file/URL
• HTTP status code
• Browser type and version
• Operating system

These logs are kept for a maximum of 30 days to detect and mitigate attacks, after which they are automatically deleted or anonymized.

b) The Reverse Proxy Service (Mod & Network)

When the host executes the /host command and players connect to the generated proxy address, our Infrastructure must process certain network data to route the traffic successfully. This processing is strictly necessary for the technical provision of the contractually requested service (Art. 6(1)(b) GDPR) and to prevent network abuse (Art. 6(1)(f) GDPR).

• Processed Data: IP addresses of the host and connecting players, connection timestamps, dropped packets, and basic connection states.
• Storage & Retention: IP addresses are held in memory only for the duration of the active connection to route the packets. Minimal connection logs are kept temporarily (up to 7 days) strictly for debugging and DDoS mitigation purposes. We do not inspect, intercept or store in-game actions, in-game chat messages, or any other in-game data.

c) CraftProxy Account (automatic sign-in of the mod)

When you start Minecraft with the CraftProxy mod installed, the mod signs you in to our backend automatically. To verify that you really own your Minecraft account, the mod uses the standard Minecraft server authentication: your Minecraft client registers a random session ID with Mojang, and our server then asks Mojang's session server (sessionserver.mojang.com) to confirm this session for your username. Your Minecraft or Microsoft password and your Minecraft access token are never sent to us.

• Processed Data: Minecraft username, Minecraft UUID, a random API token (stored only as a hash, valid for 30 days), and the time your account was created and last updated.
• Recipient: Mojang AB (Stockholm, Sweden), a subsidiary of Microsoft Corporation, receives your username and the random session ID for verification. Data may be processed by Microsoft in the USA; Microsoft is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• CraftShot.net account: After the verification, our backend passes your Minecraft username and UUID to CraftShot.net, our social platform (same controller, see Section 1). CraftShot.net creates or links your CraftShot account and returns an API token that the mod uses for friends, chat and online status (Section 4 d). If you also use CraftShot.net or the CraftShot LabyMod addon with the same Minecraft account, it is the same account.
• Legal Basis: Art. 6(1)(b) GDPR — the account is required to provide the mod's online features you use.
• Retention: Your account data is stored for as long as you use CraftProxy. You can request the deletion of your account and all associated data (friends, invites, messages, cosmetics) at any time via the e-mail address in Section 1.

d) Friends, Chat, World Invites and Online Status

The mod offers an optional friends network (the Social menu). Friends, direct messages and the online status are provided by CraftShot.net and shared with your CraftShot account: friends and conversations you have on CraftShot.net also appear in the mod, and vice versa. To provide these features we process:

• Direct messages: the text of your messages, attached images, sender, recipient, time of sending and whether a message was read. Messages are stored on the servers of CraftShot.net to deliver them and show your chat history in the mod, on CraftShot.net and in the CraftShot LabyMod addon. They are only visible to the participants of the conversation. Images are downscaled by the mod if necessary and then uploaded to CraftShot.net. New messages are delivered in real time over an encrypted WebSocket connection to CraftShot.net. Messages and images are kept until you delete them or your account. More details are in the privacy policy of CraftShot.net.
• Friendships: which accounts sent, accepted, declined or removed friend requests, including timestamps. Friendships are stored until one of the two players removes the friendship or requests deletion.
• World Invites: sender, recipient, the name of the invited world and the CraftProxy address (not your home IP address). Invites are deleted when the host closes the game or the recipient clears them.
• Online Status: while the game is running the mod reports that you are online and sends a heartbeat about every 30 seconds to our backend and to CraftShot.net; we store whether you are online and the time of your last heartbeat. In the mod, your online status and the time you were last online are only shown to you and to players you have accepted as friends. How CraftShot.net displays your presence on its website is described in its privacy policy.

The legal basis is Art. 6(1)(b) GDPR (providing the friends features you use). The online status is also used for anonymous usage statistics (Section 4 g).

e) Cosmetics and Player Lookups

To display cosmetics (e.g. capes) correctly, the mod sends the Minecraft UUIDs of the players currently visible in your game to our server and receives the cosmetics equipped by those players. These UUIDs are only used to answer the request and are not stored in our database (like every request, the call may briefly appear in our server logs, see Section 4 a). We store which cosmetics a CraftProxy user owns and has equipped (Art. 6(1)(b) GDPR).

f) Discord Rich Presence

If the Discord desktop app is running on your computer, the mod shows your Minecraft version, whether you are in a world and the number of players on your Discord profile. This information is passed directly from your computer to your local Discord app and is not sent to our servers. Discord's own privacy policy applies to how Discord processes and displays it.

g) Website Statistics

Our website shows aggregate usage figures (e.g. the number of players who have used CraftProxy and how many were active in the last 30 days). These are pure counts; no names, UUIDs or other personal data are published.

5. Contacting us via E-Mail

If you contact us by e-mail, your e-mail including all resulting personal data (name, request) will be stored and processed by us for the purpose of processing your request. We do not pass these data on without your consent.

The processing of these data is based on Art. 6(1)(b) GDPR, if your request is related to the execution of a contract. In all other cases, the processing is based on our legitimate interest in the effective processing of the requests addressed to us (Art. 6(1)(f) GDPR). The data will remain with us until you ask us to delete it or the purpose for data storage no longer applies.

6. Cookies and Tracking

We do not track you.

Our website and services do not use cookies, tracking pixels, analytical tools (like Google Analytics), or any third-party marketing services. We strictly collect only the absolute minimum data required to keep the reverse proxy running securely.

Our content delivery network Cloudflare (Section 2) may set a technically necessary security cookie (e.g. __cf_bm) to distinguish humans from bots. It does not track you across websites and is deleted after at most 30 minutes (Section 25(2) TDDDG, Art. 6(1)(f) GDPR).

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): Request information about your stored personal data.
• Right to Rectification (Art. 16 GDPR): Demand the correction of incorrect data.
• Right to Erasure (Art. 17 GDPR): Request the deletion of your data, provided no legal retention obligations exist.
• Right to Restriction of Processing (Art. 18 GDPR): Request limited processing of your data.
• Right to Data Portability (Art. 20 GDPR): Receive your data in a machine-readable format.
• Right to Object (Art. 21 GDPR): Object to data processing based on legitimate interests.

To exercise any of these rights, please contact us at the email address provided in Section 1.

8. Right to Lodge a Complaint

If you believe that the processing of your data violates data protection laws, you have the right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR), particularly in the Member State of your habitual residence or the location of the alleged infringement. The competent authority for our headquarters is the Saxon Data Protection Commissioner (Sächsischer Datenschutzbeauftragter).

9. Further Mandatory Information

Protection of Minors

Our service is not specifically directed at children under the age of 16. Should we become aware that we have collected personal data from children under the age of 16 without the consent of their parents or legal guardians, we will take steps to delete this information as quickly as possible.

No Automated Decision-Making & Third-Country Transfers

We do not use automated decision-making or profiling (Art. 22 GDPR). Data is only transferred to third countries (outside the EU/EEA) where described above: to Cloudflare (Section 2) and to Mojang/Microsoft for account verification (Section 4 c). Both providers are certified under the EU-U.S. Data Privacy Framework.