Privacy Policy
Last updated: 20 September 2026
This explains what personal data CardyCraft ("we") collects when you use The Buildyard (the Minecraft server and buildyard.cardycraft.com), why, who sees it, how long we keep it and what your rights are. We keep it to what we need. We don't run advertising, we don't use analytics or tracking scripts, and we don't sell your data.
1. Who is responsible
The controller is CardyCraft. Contact: the contact details on cardycraft.com.
2. What we collect and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Discord login: your Discord user ID and username (we only ask Discord for the "identify" scope, no email, no servers, no messages) | Log you in and recognise your account | Contract (providing the account) | While your account exists; deleted when you ask |
| Linked Minecraft account: UUID and player name | Connect the website to your in-game player | Contract | Same as above |
| Game data: ranks, hours played, blocks placed, worlds you own and who you trusted, homes, plots, settings, mutes and ignore lists | Run the server and enforce limits and rules | Contract / legitimate interest | While you play; deleted on request |
| Chat and commands (in-game). Public chat may also be relayed to our Discord server. | Moderation, safety, fixing problems | Legitimate interest (a safe community) | Server logs are rotated; typically kept for a limited time (weeks) |
| Your uploads: worlds, schematics, exported files | Provide the storage, download and preview features | Contract | Until you delete them, or automatic clean-up (unconfigured uploads 24 h, download links 24 h, schematics archived after 90 days) |
| Member applications: your answers, the links you give, your Discord name/ID and Minecraft name, and our decision and notes | Decide whether you become a Member | Steps at your request before granting a rank (contract) / legitimate interest | Until decided; then 12 months after the decision, then deleted automatically. You can withdraw a pending application any time. |
| Technical data: IP address, browser type and pages requested, in web server and game server logs | Security, abuse prevention, debugging | Legitimate interest | Typically up to about 14 days for web logs |
| Browser storage: a login cookie and your light/dark choice (see the Cookie Policy) | Keep you logged in, remember your theme | Strictly necessary / your own choice | See Cookie Policy |
If you write to us, we keep the message as long as needed to answer and follow up.
3. Who sees your data
- Our staff, as far as they need it. Member applications are seen by the owner only.
- Other players see your Minecraft name, rank, public worlds and chat, as in any multiplayer game.
- Service providers ("processors") that run the service for us: the server host of this website (Oracle Cloud Infrastructure), the game server host (PebbleHost), and our domain/DNS provider (Hostinger). Discord is involved when you log in and when chat is relayed; it acts under its own privacy policy.
- Authorities, if the law requires it.
We don't sell or rent personal data and we don't use it for advertising or profiling.
4. Transfers outside the EU/EEA
Some providers (for example Discord or cloud hosts) may process data outside the European Economic Area. Where that happens it relies on the safeguards required by law, such as the EU Standard Contractual Clauses.
5. Your rights
Under the GDPR you can ask us for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interest. Where we rely on your consent you can withdraw it at any time. To use a right, contact us via the contact details on cardycraft.com; we answer within one month. You can withdraw a pending application yourself from your dashboard.
You also have the right to complain to a data protection authority. In Belgium that is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), or the authority in the country where you live.
6. Children
The service is for people aged 13 and over. If you are younger than the age at which you may agree to data processing yourself, you need your parent or guardian's permission. If you believe a child's data was given to us without that, tell us and we will delete it.
7. Security
We use HTTPS, restrict access to staff, keep secrets out of the public website and limit what each part of the system can reach. No system is perfectly secure; if a breach affects you we will notify you and the authority as the law requires.
8. Changes
If we change this policy we update the date at the top and, for important changes, tell you on the website.
Questions about this page? Contact us via the contact details on cardycraft.com.