🔒 Privacy Policy

Last updated: July 29, 2026

MC Server List ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains in detail what personal data we collect, why we collect it, how we use it, how long we keep it, and the rights you have over your data. By using this website, you consent to the data practices described below.

1. Data We Collect

1.1 Data You Provide Directly.

  • Account data: Username, email address, and a bcrypt-hashed password. Your email is used for account verification, password resets, auction notifications, support responses, and important account alerts. Your password is never stored in plain text — only an irreversible cryptographic hash.
  • Profile data: Any optional profile information you choose to add, such as a profile bio or avatar.
  • Server listing data: Server name, IP address, port, Minecraft version, category, country, website URL, Discord link, short description, full description, tags, server icon, and banner image. This information is public and displayed to all visitors.
  • Support ticket data: The subject, message content, and any attachments you submit via the support ticket system.
  • Contact form data: Your name, email, and message when you use the contact form.

1.2 Data Collected Automatically.

  • IP address: Collected upon registration, on every vote, and in server logs for abuse prevention, rate limiting, and security monitoring. We do not display your IP address publicly.
  • Session data: We use PHP session cookies to maintain your login state. These cookies are essential and do not track you across other websites.
  • Server check data: When we check your server's status, we query its IP and port to determine online state, player count, MOTD, and version. This data is cached and displayed publicly on your listing.
  • Usage logs: We may log page requests, timestamps, and user agent strings for debugging, security analysis, and performance optimization. These logs may contain IP addresses.

1.3 Payment Data. When you pay for a premium auction slot, payment is processed by Stripe. We receive a confirmation of payment and the transaction ID, but we never receive, store, or transmit your credit card number, CVV, or other sensitive payment details. All payment data is handled entirely by Stripe's PCI-compliant infrastructure.

1.3.1 Discord OAuth Data. If you use "Login with Discord," we receive your Discord user ID, username, email (if you grant the email scope), and avatar image URL from Discord's API. We store your Discord ID (to identify you on future logins) and avatar URL. Your Discord password is never shared with us — Discord handles authentication on their end. You can revoke our access at any time from your Discord settings under Authorized Apps.

1.4 Data We Do NOT Collect. We do not use third-party advertising trackers, we do not sell your data, we do not profile you for marketing purposes, and we do not use analytics services that track you across other websites.

2. How We Use Your Data

We use your data exclusively for the following purposes:

  • Service operation: Creating and managing your account, displaying server listings, processing votes, and running the auction system.
  • Communication: Sending email verification links, password reset links, auction win notifications with payment links, support ticket responses, and important service announcements.
  • Abuse prevention: Detecting vote manipulation, multi-account abuse, spam, harassment, and other policy violations through IP logging and pattern analysis.
  • Security: Rate limiting, CSRF protection, brute-force detection, and incident investigation.
  • Moderation: Reviewing reported content, managing reports and tickets, and maintaining moderation logs.
  • Server status verification: Periodically querying listed Minecraft servers to display accurate online status and player counts.

2.1 Legal Bases (GDPR). For users in the EU/EEA, we process your data based on: (a) your consent (given at registration), (b) performance of a contract (providing the service you requested), (c) our legitimate interests (security, abuse prevention, platform integrity), and (d) compliance with legal obligations.

3. Cookies & Sessions

3.1 Session Cookies. We use a single PHP session cookie (PHPSESSID by default) to keep you logged in and maintain your session state across page loads. This cookie is essential for the site to function and is deleted when you close your browser.

3.2 No Tracking Cookies. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. We do not participate in any ad networks or behavioral tracking programs.

3.3 Cookie Control. Since we only use an essential session cookie, you can block it in your browser settings, though doing so will prevent you from logging in or using account features.

4. Data Sharing

We do not sell, rent, or trade your personal data to anyone. We share data only in the following limited circumstances:

  • Stripe: When you make a payment, your transaction is processed by Stripe. Stripe receives your payment details directly — we only receive confirmation and a transaction reference. Stripe's privacy policy is available at stripe.com/privacy.
  • Email infrastructure: Transactional emails (verification, resets, auction notifications) are sent via our mail server or a third-party SMTP provider. The recipient email address and message content are transmitted to the mail provider for delivery.
  • Legal compliance: If required by law, court order, or government regulation, we may disclose data to relevant authorities. We will only disclose what is legally required.
  • Consent: With your explicit consent, we may share data for a specific purpose you have agreed to.

4.1 No Sale of Data. Under CCPA, GDPR, and similar regulations, we confirm that we do not sell personal data to any third party for monetary or other consideration.

5. Data Retention

5.1 Active Accounts. Your data is retained for as long as your account is active. If you log in regularly, your data is kept indefinitely to maintain your listings, votes, and history.

5.2 Inactive Accounts. Accounts that have been inactive for 12 months may have their server listings hidden. After 24 months of inactivity, we may delete the account and associated data, except where retention is required for legal or abuse-prevention purposes.

5.3 Vote & Moderation Logs. Vote records (including IP addresses), moderation logs, and abuse-prevention data may be retained for up to 24 months after the relevant event, even if the associated account is deleted, to prevent repeat abuse and pattern detection.

5.4 Payment Records. Transaction IDs and payment confirmations are retained for 7 years for accounting and tax compliance. No credit card data is retained (Stripe handles this).

5.5 Support Tickets. Ticket content and responses are retained for 12 months after the ticket is closed, then permanently deleted.

5.6 Server Status Data. Cached server status data (player counts, MOTD) is overwritten on each check and not historically archived.

6. Data Security

We implement the following security measures to protect your data:

  • Password hashing: All passwords are hashed using bcrypt with a cost factor. Plain-text passwords are never stored or logged.
  • CSRF protection: All forms include CSRF tokens to prevent cross-site request forgery attacks.
  • Rate limiting: Login, registration, voting, and bidding endpoints are rate-limited to prevent brute-force and automated abuse.
  • Input validation & sanitization: All user input is validated and sanitized to prevent SQL injection, XSS, and other injection attacks.
  • Secure payment processing: Payments flow directly to Stripe — we never touch credit card data.
  • Access controls: Admin and staff access is role-based. Sensitive directories are protected via server configuration.
  • HTTPS: All traffic is encrypted via TLS/SSL.

Despite these measures, no system is 100% secure. In the event of a data breach, we will notify affected users and relevant authorities as required by applicable law (including within 72 hours under GDPR Article 33 where applicable).

7. Your Rights

Depending on your jurisdiction (GDPR for EU/EEA residents, CCPA for California residents, and other local laws), you may have the following rights:

  • Right of access: Request a copy of all personal data we hold about you.
  • Right to rectification: Correct inaccurate or incomplete personal data.
  • Right to erasure ("right to be forgotten"): Request deletion of your account and associated personal data, subject to legal retention requirements.
  • Right to restrict processing: Request that we limit how we use your data while a dispute is resolved.
  • Right to data portability: Receive your data in a structured, machine-readable format and transmit it to another service.
  • Right to object: Object to processing based on our legitimate interests (e.g., direct marketing or profiling).
  • Right to withdraw consent: Withdraw consent you previously gave for specific data processing (note: this may limit your ability to use certain features).
  • Right to lodge a complaint: You may complain to your local data protection authority. For EU residents, your supervisory authority can be found at edpb.europa.eu.

To exercise any of these rights, contact us via our contact page. We will respond within 30 days. We may ask for verification of your identity before processing requests. We do not charge a fee for data requests unless they are manifestly unfounded, excessive, or repetitive.

8. Children's Privacy

Our service is directed at Minecraft server owners and players, and is not intended for children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal data from children under 13. If you believe a child under 13 has registered an account, please contact us and we will delete it immediately. For COPPA compliance, we rely on the fact that we do not knowingly collect data from children under 13 and do not direct our service to that age group.

9. International Data Transfers

Your data may be stored on servers located in a different country than your own. If you are in the EU/EEA, UK, or another region with data protection laws, we ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses (SCCs) where applicable. By using this service, you acknowledge and consent to these transfers.

10. Third-Party Links & Services

This website contains links to external services that are not operated by us:

  • Stripe — Payment processing (stripe.com/privacy)
  • Minecraft servers — Listed servers may collect their own data from players who connect
  • Discord — Used for optional OAuth2 login and server listing Discord links (discord.com/privacy)

We are not responsible for the privacy practices of these third-party services. We encourage you to review their privacy policies before sharing any data with them.

11. Changes to This Policy

We may update this Privacy Policy at any time. Material changes will be posted on this page with an updated "Last updated" date. We will notify users of significant changes via email where feasible. Your continued use of the site after changes constitutes acceptance of the revised policy.

12. Contact

For privacy questions, data access requests, or to delete your account, use our contact page. We are committed to resolving privacy concerns promptly and transparently.