Privacy Policy

Detraly is an analytics service for Minecraft servers. It is run by [Legal entity name], company number [Company registration number], registered at [Registered address], [Country of establishment] ("Detraly", "we", "us").

You can reach us through the contact form or [Privacy contact email], or on Discord.

Detraly is still under development. This policy describes what the service does today.

We handle personal data in two different roles.

• Controller. For operator accounts (people who sign in to the dashboard), for visitors to our website, and for messages sent through the contact form, we decide why and how the data is used. This policy is our notice to those people.
• Processor. For Minecraft player data that an operator's server sends to us, the operator is the controller and we process it on the operator's behalf. Operators must tell their players about it and have a lawful basis for it. If you are a player and want to exercise a right over this data, please start with the server operator; you can also contact us and we will help where we can.

Operator accounts

• Sign-in is with Discord (we ask for the identify and email scopes) or Google (openid, email and profile), through Supabase Auth. Supabase holds your user ID, email address, display name, avatar URL, the provider you used, and any two-factor (TOTP) factors you set up.
• Our API reads your user ID from the sign-in token. It does not store your email address.
• Things you create: networks (name, emoji, timestamps) and servers (name, type, the server IP address you enter, network, emoji, link codes and their hashes, a hash of the plugin token, status and settings, including a history of when player location was turned on or off, with the notice version shown, up to 50 entries).
• Legal acceptance records: your user ID, the Terms and Privacy versions you accepted, the time, and where you accepted (sign-in or a later prompt).

Minecraft player data (we process for operators)

• Sent by the Detraly plugin on the operator's server: player username, player UUID, whether it was a join or a leave, the time, and the server ID.
• Player IP address: sent only when a player joins, only if the operator has turned location on (currently a Diamond plan feature), and only if the player has not opted out in game with /detraly optout. We use it once, to look up a country with the DB-IP IP-to-Country Lite database (a file on our own server; no data is sent to DB-IP). The IP address is not stored and not logged. The country code is stored with the player UUID.
• Console lines: our API can accept and store console lines. The current plugin does not send any.

Website visitors

• Contact form: your name, email address, an optional company URL and your message. It is posted to a private Discord channel.
• Cloudflare Turnstile checks that a contact form submission comes from a person. Cloudflare receives your IP address and browser signals for that check.
• Analytics, only if you accept them: OpenPanel records page views (URL, page title and referrer). See the cookie policy.
• Your cookie choice is kept in your browser (local storage key detraly-consent).
• On the dashboard, a session storage item (detraly-legal-ack) remembers that you ticked the Terms and Privacy box before signing in. It is removed once your acceptance is recorded, or when the tab closes.

Technical logs

• Our API writes an access log that includes the client IP address for dashboard requests and for the plugin link request. It does not log IP addresses for the plugin's event routes. Rate limiting keeps IP addresses in memory for about two minutes (about 15 minutes for the contact form). These are not written to our database.

• Run your account and the service (sign-in, networks, servers, linking, showing analytics, support): performance of our contract with you.
• Keep the service secure and working (rate limiting, abuse prevention, Turnstile, access logs, fixing faults): our legitimate interests in running a safe service.
• Answer contact messages: our legitimate interests in replying to you, or steps you ask us to take before a contract.
• Website analytics: your consent. You can say no, and you can withdraw consent at any time.
• Keep records of what you accepted: our legitimate interests in being able to show which terms applied to you, and in some cases legal obligations.
• Player data: we process it on the operator's instructions. The operator is responsible for choosing the lawful basis and informing players.

We do not sell personal data, we do not show ads, and we do not profile people.

Operators must tell their players that Detraly processes their data, and must have a lawful basis to do so. Operators who turn location on must also show their players a notice and honour opt-outs.

The plugin lets a player opt out of location lookup in game with /detraly optout. When a player has opted out, their IP address is not used to look up a country. The operator can also delete a player's location data, or all location data for a server, at any time.

We use these providers. They receive data only as described.

• Supabase: sign-in and account records for operators.
• MongoDB: the database that holds servers, networks, player events and acceptance records (hosting region: [Hosting region]).
• Redis: a queue that holds plugin events briefly before they are written to the database.
• Cloudflare: Turnstile on the contact form.
• Discord: receives contact messages, and provides sign-in if you choose it.
• Google: provides sign-in if you choose it.
• OpenPanel: website analytics, only after consent. Data goes to our own endpoint at opapi.detraly.com; the tracking script is loaded from openpanel.dev.
• DB-IP: supplies a country database file (licensed CC BY 4.0). No personal data is sent to it.

We may also disclose data where the law requires it or to protect rights, safety and the service.

Our hosting region is [Hosting region]. Some of our providers may process data in other countries, including outside the UK and the European Economic Area. Where required we rely on a recognised transfer mechanism, such as an adequacy decision or standard contractual clauses, for those transfers.

• Player events (username, UUID, join or leave, time): kept until the operator deletes the server. There is no automatic deletion today. The data-retention days shown on plans are not enforced yet.
• Player country: deleted automatically after 30 days. The operator can delete it sooner.
• Player IP addresses and request IP addresses: not stored in our database. Rate-limit memory is about two minutes (about 15 minutes for the contact form).
• API access logs: [Access log retention period].
• Contact messages: kept in Discord until they are deleted.
• Legal acceptance records: kept for the life of your account plus [Period after account deletion].
• Account and server records: kept while your account exists. Deleting a server deletes its player events, console lines and player location data.
• Cookie choice: stays in your browser until you clear it.

• Traffic to our website, dashboard and API uses HTTPS.
• The plugin's access token is stored only as a hash and is sent to your server once, when it links. The link code you see in the dashboard is stored as entered so it can be shown again.
• Player IP addresses are never stored.
• Two-factor authentication (TOTP) is available for operator accounts.

No system is perfectly secure, and we cannot promise that nothing will ever go wrong.

Under the GDPR and UK GDPR, you can ask for access to your personal data, correction, erasure, restriction of use, and a portable copy; you can object to processing based on legitimate interests; and you can withdraw consent at any time (withdrawing does not affect earlier use). You can also complain to your data protection supervisory authority.

Under California law (CCPA/CPRA) you can ask what we hold, ask us to correct or delete it, and you will not be treated worse for asking. We do not sell personal information and we do not share it for cross-context behavioural advertising.

To make a request, use the contact form or [Privacy contact email]. We may need to confirm who you are. For player data, we may direct you to the server operator, who is the controller.

Our website and dashboard accounts are not directed at anyone under 16, and you must not create an account if you are under 16. Minecraft players can be young. Operators are the controllers of their players' data and are responsible for how it is collected and for informing players and, where required, parents.

When you accept our Terms and this policy, for example at sign-in or when we ask you to accept an update, we record your user ID, the versions accepted, the time and where you accepted. We keep this so we can show which version applied to you.

This is version 2026-11-04. If we change it in a way that matters, we will update the date and version here and tell operators in the dashboard, where we may ask you to accept the new version.

[Legal entity name], [Registered address]. Use the contact form or [Privacy contact email], or Discord.