Privacy Policy

1. Information we collect and why

We receive information you provide, information generated by your use of the service, public Minecraft profile information, and information supplied by server owners, players, or people reporting a problem.

• Account and identity: email address, login and Minecraft usernames, account identifiers, password hash, account status, creation time, age-eligibility declarations and, where applicable, a declaration of parent or guardian permission. Minecraft profile lookups and ownership verification may provide a public UUID, skin, verification result, and information about a disputed username. We use these to create and secure accounts, associate the correct Minecraft identity, and resolve ownership issues.
• Hosting: server names, settings, software and plugin selections, seeds or prepared-world choices, assigned addresses, session deadlines, world files, logs, and saved-state downloads. We use these to operate the hosting you request.
• Operations and safety: session identifiers, network connection information, keyed abuse-prevention signals, resource usage, service errors, security alerts, moderation decisions, and related notices. These help enforce resource allowances, protect accounts, diagnose failures, and review abuse. Automated checks may limit registration or stop or restrict workloads; contact support to request review of an incorrect restriction.

Ordinary signup does not ask for your exact birth date, legal name, street address, phone number, or identity documents. Do not send unnecessary sensitive information in server content or support messages. Information you voluntarily include may still be processed as part of that content or conversation.

Necessary session and security cookies support sign-in and limit duplicate free accounts. Some abuse checks use keyed hashes of IP addresses and browser-cookie identifiers; these remain security-related information, not proof of a person's identity. Network providers and game servers may separately process unmodified IP addresses. We do not use advertising trackers or browser fingerprinting. Refusing necessary cookies may prevent sign-in or registration.

2. Terms acceptance records

When you explicitly accept the Terms, we store your account ID, the version accepted, the server-recorded acceptance date and time, a cryptographic hash identifying the document, and whether acceptance happened at registration or during a later acceptance request. We also preserve the corresponding Terms text so we can establish what that version said.

We use these records to administer the agreement, determine whether updated Terms require acceptance, resolve disputes, and respond to lawful requests. Accepting a new version preserves the history of earlier acceptances. Logging in alone does not count as acceptance, and staff cannot accept Terms for an account while viewing it through the staff impersonation feature.

The acceptance record itself does not store an IP address, browser fingerprint, or user-agent string. Separate session, network, and security processing described in this policy still applies. The public archived Terms document contains policy text, not a public list of users or their acceptance records.

3. Support tickets and communications

Live chat and text being typed: while you use an active live-support chat, authorized support staff can automatically see text in the live-chat message box as you type, before you send it. This includes text you later edit or delete. The preview helps staff prepare replies and is limited to that chat box; it does not capture other page inputs, password fields, or forms. Draft updates stop when you minimize or close the chat or no support agent is available. You can contact [email protected] by email instead of using live chat.

Unsent draft previews are held in short-lived application memory, expire after ten seconds, and are not saved in the conversation transcript, application database, backups, audit reasons, or transcript exports. Sent chat messages and private staff notes are encrypted in application storage. Conversation records include the session or account association where available, staff assignment, department, priority, status, and timestamps. Authorized staff can review sent messages for support, security, and accountability. Ending a chat does not delete its sent messages or staff records; the support-record retention practices below apply.

Tickets contain your account association, subject, category, messages, replies from support, system messages, timestamps, and open or closed status. Review records may include the assigned staff member, review state, and decisions about requests such as additional servers or custom installations. Ticket audit records identify actions such as creation, replies, closing, and reopening.

We use this information to answer questions, troubleshoot, handle requests, maintain continuity across replies, investigate complaints, and review staff actions. Emails to support contain the sender information and content you supply and are handled through the support mailbox. Do not send passwords, authentication codes, payment details, or private information about other people unless it is necessary and you have a lawful basis to provide it.

Tickets are associated with their owner's authenticated account and are not publicly posted. Authorized staff can access conversations for their work. Closing a ticket changes its workflow status; it does not delete the conversation or related records.

4. Staff access and accountability

Staff may use a support persona or a customized display name and Minecraft skin picture in live chat. Staff can select a skin from the shared library, upload a skin they made, or import a skin by Minecraft Java username. Importing a skin sends the chosen username to Minecraft profile and texture services; saved skin pictures are served by NotchHost to chat visitors. Staff profiles and their chosen skin pictures are public within the chats where they appear. Internal messages and audit records retain the actual staff-account identity, and previously sent messages retain the public profile used when they were sent.

Staff permissions differ by role. Support personnel can review tickets and operational information. Personnel with additional permissions can access account details, investigate identity disputes, adjust limits or account status, operate servers, and use file or console tools. Certain administrators can view the panel as a customer to troubleshoot; this does not reveal the customer's password.

Staff access is permitted for support, maintenance, security, abuse investigation, administering the service, and legal compliance. The tools record relevant access and actions, including the staff account, action, target account or server, time, and a reason where required. Examples include opening account profiles or ticket conversations, revealing protected account fields, beginning or ending a customer view, and requesting file or console operations.

Staff notes may associate an account, username, or Minecraft UUID with a note, severity, author, and time. Operational jobs may record commands or file-operation details, status, results, and timestamps. These records help investigate problems and make administrative actions accountable. This does not mean every activity on the host is recorded or that staff have no technical ability to access server content.

Ticket subjects and messages, staff-note bodies, audit reasons, and staff-job payloads and results are encrypted in application storage. Authorized services and staff can decrypt the information they are permitted to use; this is not end-to-end encryption.

5. Minecraft players and plugins

A hosted server or plugin may process player usernames, UUIDs, IP addresses, chat, commands, inventories, and gameplay events. What is recorded depends on the server software, plugins, and configuration. Server owners can access their server data and available downloads; authorized NotchHost staff may access it for the purposes described above. Other players may see information you make visible in gameplay or chat.

Server owners are responsible for explaining their own data practices, choosing appropriate plugins, controlling access, and responding to requests concerning their use of player information. NotchHost retains its own responsibilities as hosting provider. Contact the owner about that server's practices, or contact us about hosting-related privacy or safety concerns.

Minecraft authentication and profile services receive the lookups required for account verification and skins. Plugins and optional integrations may contact their developers or external services according to their own functions and settings. Review the relevant provider's documentation and privacy information before enabling an integration.

6. Service providers and other disclosures

Our hosting infrastructure stores accounts and game files in the United States. Cloudflare provides DNS, traffic protection, and web delivery and processes connection information. Infrastructure, communications, and other providers process information needed to perform their functions. Their processing may occur in other locations under their own applicable arrangements.

We may disclose relevant information to authorized service providers, to the account owner when providing support or downloads, or to people involved in resolving a complaint when reasonably necessary and lawful. We may also disclose information when required by law, to respond to valid legal process, or to protect people and the service against fraud, abuse, or security threats. We limit such disclosures to their purpose and applicable legal requirements.

We do not sell account information or share it for cross-context behavioral advertising. We do not use Terms acceptance as permission for advertising. Visiting from another country may involve processing in the United States; this notice does not remove any transfer safeguards or other protections required by applicable law.

7. How long information is kept

Retention depends on the record and its purpose. We do not treat session expiry, ticket closure, or account suspension as a request to erase all information.

• Session downloads: the final saved-state ZIP is normally available for 24 hours after session expiry or an ended session, as shown in the panel. Access ends at the deadline and the archive is scheduled for removal. Current-world and account data are separate from this archive.
• Accounts and current worlds: information remains while an account is active or until a reviewed deletion request is completed, subject to necessary legal, security, or unresolved-dispute retention.
• Terms acceptance: acceptance history is retained with the account to document the agreement. There is no automatic short-term expiry. A deletion request includes review of these records and any lawful reason to retain a limited record. Archived policy text can remain after personal records are removed.
• Support, moderation, and staff audits: tickets, replies, review history, notes, and audit records do not automatically expire when a ticket closes. Retention is reviewed in relation to ongoing support, account history, security investigations, disputes, and legal obligations. We have not implemented a single automatic deletion period for all these records.
• Staff jobs: completed or failed job records, including their stored results, become eligible for worker cleanup 24 hours after their last update. Separate audit records, server files, logs, or recovery copies are not deleted by that job cleanup.
• Short-lived security records: rate-limit entries have 15-minute expiry periods; signup-network signals expire after 24 hours; browser signup signals and their cookie after 30 days. Guest eligibility checks expire after 24 hours where used. Expired records may remain until the relevant cleanup runs. Account-level declarations are retained with the account.
• Other operational records: host health history is maintained on a rolling seven-day basis. Account usage totals and moderation records are distinct from that short history. Subdomain protection can last up to seven days per renewal; that reservation period is not a promise to erase all related records.

For records without a fixed period, we consider whether the account or request remains active, whether an investigation or dispute is unresolved, and whether law requires retention. Backups, recovery copies, and preserved evidence can outlast active records; removal is subject to the applicable backup or retention review. Ask support about a specific category or request deletion. We do not promise immediate erasure of every copy.

8. Security

We use HTTPS for the public website, password hashing, application encryption for selected account and support fields, authenticated download checks, and role-based staff permissions. Not every field or game file is encrypted individually, and encryption does not prevent authorized access needed to operate the service.

No system can guarantee complete security or prevent all data loss. Protect your password, review operator permissions, and keep independent backups. Report suspected unauthorized access or a security issue to support without including passwords or unnecessary sensitive information.

9. Young users

NotchHost accounts are available to users 13 and older. If you are 13–17, you must have permission from a parent or legal guardian and review the Terms with them. Where local law requires a higher age or additional parental authorization, those requirements also apply.

Children under 13 must not register or submit personal information. We do not offer an under-13 parental-consent signup process. Age and permission declarations are not verification of a person's age or a parent's identity, and they do not by themselves establish compliance with children's privacy law.

If you believe we have collected personal information from a child under 13, contact [email protected] so we can investigate, restrict access where appropriate, and take required deletion or other protective steps. Parents and guardians may also contact us about a teen's information. We may need to verify authority while minimizing additional information requested. Server owners must not use our hosting to collect children's information without required safeguards.

10. Your choices and privacy rights

Email [email protected] to request access, a copy, correction, or deletion of your information, including Terms acceptance history and support records. Identify the account and the request without sending your password. We may verify account control or an authorized representative's authority before responding.

Depending on your location and which laws apply, you may also have rights to portability, restriction, objection, withdrawal of consent for processing based on consent, review of a denied request, or a complaint to a privacy regulator. We will apply the rights and response periods required by law and explain relevant limitations. Requests may be limited by legal obligations, security needs, or other people's rights. We do not retaliate for exercising applicable privacy rights.

Processing needed to provide hosting or administer an agreement is not necessarily based on optional consent. Withdrawing an optional permission does not erase past lawful processing. If you decline updated Terms, available downloads, support, safe shutdown, and logout remain accessible, subject to existing deadlines; you can request account closure.

Necessary cookies are not used for cross-site advertising. Because we do not conduct advertising tracking, a Do Not Track or Global Privacy Control signal does not disable the session and security functions needed to operate the service.

11. Policy updates

We will publish changes here with an updated date. For material changes, we will provide additional notice through the panel or account communications where appropriate and obtain consent when legally required. A policy update does not retroactively authorize unrelated uses of information.

Privacy contact: NotchHost, LLC, Georgia, United States · [email protected].