Privacy notice

1. Data controller and contact

The data controller is Alessio Chima. For questions or requests about your personal data, contact info@eldaria.it.

2. Data we process and why

To manage your account and provide the website, forum and Minecraft server, Eldaria processes the categories of data set out below.

• For your website account, we process your username, display name, profile information and preferences, as well as the data needed to sign in and recover the account. We also keep the registration date, your declaration that you are at least 14, and the versions of the privacy notice and terms shown to you. For staff accounts, we also process the data needed for two-factor authentication. For each active sign-in we record the IP address, the type of browser and the times of sign-in and last use, so you can see in your personal area where your account is signed in and sign out devices you do not recognise. To stop passwords and codes being guessed, we count failed attempts by username and IP address.
• To link your account to the game, we process your Minecraft name and its UUID, the account's unique code, through /weblogin. While you play, the server may record the IP address used to connect, connection times, chat messages, commands, block actions, ranks, titles and game statistics. We also process records of shops, trades and in-game coins to run the economy and prevent abuse.
• The forum and social features process discussions, posts and edits, reactions, votes, mentions, quotes, followed content, friendships, friend requests, blocks and notifications. For support and moderation, we also process reports and tickets, sanctions, the reasons for them and staff action records.
• In staff areas, we keep the data needed to review actions taken by staff, including a log of the most sensitive ones (permissions, settings, failed sign-ins to staff accounts) with the IP address they came from. For staff accounts authorised to manage website content, we also process information about files they upload.
• The map may show your Minecraft name and your avatar's live position in the game world. This is the character's position on the map, not the physical location of the person playing. It is visible only to signed-in users who have linked a Minecraft account, and we do not keep a history of these positions.
• Your game name is not necessarily your real name. Eldaria does, however, link the Minecraft name to the UUID and account and can associate that account with an IP address, messages, sanctions and activity history. In the ordinary running of the service, Eldaria does not ask for or know the player's real-world name, email address, telephone number, date of birth or identity documents. Even without knowing someone's real-world identity, these links can show an account's activity over time and relate to an identifiable person. Eldaria therefore handles this information as personal data.
• Profiles, chat messages and tickets may still contain personal information that you choose to provide. A username and linked Minecraft account are required to register and use the service.

3. Legal bases

We process data to create and manage your account and provide the game and community features you request because this is necessary to provide the service (Article 6(1)(b) GDPR).

To protect the server and community, prevent abuse and fraud, moderate content and handle disputes and appeals, Eldaria relies on its legitimate interests (Article 6(1)(f) GDPR).

Where the law requires a particular processing activity, the legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR).

We do not sell data or use it for advertising or commercial profiling.

4. Who can receive or see the data

Staff can access the data needed for their assigned duties. Access to IP addresses is limited to roles authorised to handle security and moderation. Signed-in users can see your profile and the content you publish in the community; access to the forum requires a linked Minecraft account. The avatar's live position on the map is visible only to signed-in users with a linked Minecraft account.

OVH hosts the game server, the proxy and the map; IONOS hosts the website and its database; Netsons manages the domain's DNS and its mailboxes, including the one given here as the contact address. The infrastructure used is in the European Union: OVH in France, IONOS in Spain, Netsons in Italy.

Discord receives public communications and, for tickets, a notice containing the ticket number and link. The notice does not include the ticket text or the author's name. When a skin image is requested, the Minecraft service operated by Mojang/Microsoft receives the UUID needed to retrieve it.

When you open the sign-up, sign-in or password recovery pages, Cloudflare receives your IP address and technical browser signals. It also receives the temporary token sent by the website to verify its anti-bot check.

5. Processing outside the European Union

Discord and Cloudflare may process data in the United States. Information published by these providers states that they participate in the EU-US Data Privacy Framework for processing covered by it and refer to standard contractual clauses for transfers not covered by it, where applicable. Before publication, the services actually used and the applicable contractual safeguards must be confirmed. The destination and safeguards for Minecraft skin requests also remain to be checked.

6. How long we keep data

• We keep account data until you delete your account. Sessions end when you sign out or, at the latest, after 30 days; for staff accounts with two-factor authentication, after 8 hours without use and after 24 hours at most. Failed-attempt counters are deleted one day after the last attempt. /weblogin codes expire after 5 minutes or when used; recovery codes remain valid until used or replaced.
• IP addresses, technical logs, closed tickets, sanctions and staff action records do not currently have an automatic deletion period. Access is limited to authorised staff; we review these records at least once a year and delete them when they are no longer needed for security, appeals or staff accountability.
• The retention period for shop, trade and in-game coin records still needs to be set.
• If you delete your account, forum posts may remain to preserve discussions and will show the author as “Deleted user”. The link to your Minecraft identity may remain available to authorised staff for as long as it is needed for security and moderation. You can ask us to edit or remove an individual post.
• Your skin image is cached while needed to display your profile and is removed when your account is deleted. Browser preferences remain stored for up to one year and can be cleared in your browser settings.

7. Your rights

You can ask to access, correct, erase or restrict your data. You can object to processing based on legitimate interests and, where the relevant conditions are met, request data portability. You can export or delete your account from your account page. For other requests, contact the controller at info@eldaria.it.

If you believe that the processing breaches data protection law, you can complain to the Italian Data Protection Authority (garanteprivacy.it).

8. Minimum age

To register, you must declare that you are at least 14. This is a service access rule; Eldaria does not ask for or store your date of birth. Do not post information such as your real name, address, telephone number or school in your profile, on the forum or in chat.