Privacy Policy
Last updated: 21 October 2026
This explains what personal data CardyCraft ("we") collects when you use The Buildyard (the Minecraft server and buildyard.world), why, who sees it, how long we keep it and what your rights are. We keep it to what we need. We don't run advertising, we don't use analytics or tracking scripts, and we don't sell your data.
1. Who is responsible
The controller is CardyCraft. Contact: the contact details on cardycraft.com.
2. What we collect and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Discord login: your Discord user ID and username (we only ask Discord for the "identify" scope, no email, no servers, no messages) | Log you in and recognise your account | Contract (providing the account) | While your account exists; deleted when you ask |
| Linked Minecraft account: UUID and player name | Connect the website to your in-game player | Contract | Same as above |
| Game data: ranks, hours played, blocks placed, worlds you own and who you trusted, homes, plots, settings, mutes and ignore lists | Run the server and enforce limits and rules | Contract / legitimate interest | While you play; deleted on request |
| Activity statistics: per day, your totals of hours played, blocks placed and broken, sessions, active and idle minutes, distance moved, and how many chat messages and commands you sent (counts only, never what you wrote); which hours you were online; the block types you place most; and per world, blocks placed and broken, visits and time spent there and who built most in it | Show you your own Analytics on your dashboard, show world owners the activity in their worlds, and help us run the server (overall numbers, lag) | Legitimate interest | Daily history 400 days, hourly online times 120 days; deleted with your account |
| Chat and commands (in-game). Public chat may also be relayed to our Discord server. | Moderation, safety, fixing problems | Legitimate interest (a safe community) | Server logs are rotated; typically kept for a limited time (weeks) |
| Your uploads: worlds, schematics, heightmaps, exported files | Provide the storage, download and preview features | Contract | Until you delete them, or automatic clean-up (unconfigured uploads 24 h, download links 24 h, schematics archived after 90 days). Heightmaps are also copied to the game server so you can build them, and that copy is removed within a minute of deleting one here |
| Your portfolio: the pictures, texts and links you put on it and how it looks. It's a public page (buildyard.world/u/your-name) that also shows your Minecraft name and head, rank, stats and public worlds, unless you hide it | Show your builds to other players and visitors | Contract | Until you delete a picture or text, or delete your account. Uploaded pictures are re-encoded (their hidden metadata, like camera or location data, is removed) |
| Archived worlds: a world you archive, with its settings (name, trust list, flags) | Keep it safe off the game server so you can restore it later | Contract | Until you restore it (the stored copy is then deleted) or delete your account |
| Member applications: your answers, the links you give, your Discord name/ID and Minecraft name, and our decision and notes | Decide whether you become a Member | Steps at your request before granting a rank (contract) / legitimate interest | Until decided; then 12 months after the decision, then deleted automatically. You can withdraw a pending application any time. |
| Donations: amount and currency, date, your Minecraft UUID (and through your linked account your Minecraft name), the Stripe checkout session and payment IDs, whether it was refunded or disputed, and whether you asked to be left out of the public donor list. Stripe also keeps, with the payment, that you accepted immediate delivery and the loss of the 14-day right of withdrawal. | Record the donation, grant and adjust your donation rank, handle refunds and chargebacks, keep our books | Contract; legal obligation (bookkeeping and tax law) | As long as bookkeeping and tax law requires, then deleted. Kept when you delete your account, but then no longer linked to a name anywhere on the site. |
| Public pages: your Minecraft name and player head on the playtime leaderboard (with your rank and hours played), on the community page (if you hold a rank listed there) and in the public donor list on the donate page (top donor and recent donations, names only, never amounts). The same top-10 playtime, blocks-placed and number-of-worlds lists are published as a small data feed for the leaderboard holograms in our in-game hub. | Community features: recognising active players, staff and supporters | Legitimate interest | Only linked accounts appear. Tick "Don't show my name in the public donor list" when donating to stay off the donor list; deleting your account removes you from all of them. |
| Technical data: IP address, browser type and pages requested, in web server and game server logs. When a wrong account-link code is entered we also store the IP address and Discord ID for 10 minutes. | Security, abuse prevention (for example stopping link codes from being guessed), debugging | Legitimate interest | Typically up to about 14 days for web logs; 10 minutes for wrong link codes |
| Browser storage: a login cookie and your light/dark choice (see the Cookie Policy) | Keep you logged in, remember your theme | Strictly necessary / your own choice | See Cookie Policy |
If you write to us, we keep the message as long as needed to answer and follow up.
3. Who sees your data
- Our staff, as far as they need it. Member applications are seen by the owner only.
- Other players see your Minecraft name, rank, public worlds and chat, as in any multiplayer game.
- Service providers ("processors") that run the service for us: the server host of this website (Oracle Cloud Infrastructure), the game server host (PebbleHost), our domain/DNS provider (Hostinger), and Hetzner (storage in Germany) for archived worlds. Discord is involved when you log in and when chat is relayed; it acts under its own privacy policy.
- Stripe, our payment processor, when you donate. On Stripe's checkout page you give Stripe your payment details (card or bank account), e-mail address and billing country; from us it receives the amount and your Minecraft UUID as a reference. We never see your card or bank details. Stripe also uses the data for fraud prevention and its own legal obligations, under the Stripe Privacy Policy.
- Mojang (Microsoft), to show player heads: our server asks Mojang's public profile service for the skin that belongs to a Minecraft UUID and keeps the cropped head image for up to a week. Only your Minecraft UUID is sent, by our server; your browser and IP address are never involved.
- Authorities, if the law requires it.
We don't sell or rent personal data and we don't use it for advertising or profiling.
4. Transfers outside the EU/EEA
Some providers (for example Discord, Stripe, Mojang or cloud hosts) may process data outside the European Economic Area. Where that happens it relies on the safeguards required by law, such as the EU Standard Contractual Clauses.
5. Your rights
Under the GDPR you can ask us for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interest. Where we rely on your consent you can withdraw it at any time. To use a right, contact us via the contact details on cardycraft.com; we answer within one month. You can withdraw a pending application yourself from your dashboard.
Deleting your account yourself. At the bottom of your dashboard, "Delete my account" immediately deletes
your Discord login and username, the link to your Minecraft account, all your schematics and heightmaps, your portfolio, uploads that haven't
reached the game server yet, prepared world downloads and heightmaps, your applications and your stats on this website. Two
things are not deleted by it: your worlds on the game server (delete them first, in-game with
/worlds or from the worlds list on your dashboard) and donation records, which bookkeeping law
makes us keep (they no longer show your name anywhere). Server logs and backups roll over on their normal
schedule. For anything else, such as in-game data, contact us.
You also have the right to complain to a data protection authority. In Belgium that is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), or the authority in the country where you live.
6. Children
The service is for people aged 13 and over. If you are younger than the age at which you may agree to data processing yourself, you need your parent or guardian's permission. If you believe a child's data was given to us without that, tell us and we will delete it.
7. Security
We use HTTPS, restrict access to staff, keep secrets out of the public website and limit what each part of the system can reach. No system is perfectly secure; if a breach affects you we will notify you and the authority as the law requires.
8. Changes
If we change this policy we update the date at the top and, for important changes, tell you on the website.
Questions about this page? Contact us via the contact details on cardycraft.com.