Privacy Policy

Orbit Applications LLC, a Minnesota limited liability company, operates MinecraftServers.gg. Contact [email protected] for privacy requests. This policy covers the directory, accounts, community, voting, assistant and support. Independent game servers have their own practices.

Information and purposes

• Accounts: email, display name, password hash, verification records, terms version and acceptance time, and 13+ confirmation time. We do not request birth dates. Sessions include tokens, expiry, browser information and network addresses. Two-factor secrets and recovery information are protected.
• Community: listings, images, server-control proofs, memberships, favorites, reviews, reactions, reports and moderation history. We use them to provide the directory and resolve abuse and disputes. We query public game-server endpoints for status; responses are not independent guarantees of accuracy.
• Security and support: request network addresses, keyed identifiers, security events, delivery records and messages you send. They support authentication, rate limits, fraud prevention and responding to requests. Keyed identifiers are pseudonymous, not anonymous.

Information comes from you, use of the site, public server endpoints, official community websites and team members inviting you. Independent directory entries may be created before an owner joins. Source links and check dates are public; internal review notes and claim evidence are restricted. Contact support to request a reviewed correction, dispute ownership or request removal. Restricted identifiers of removed listings prevent accidental reimport. Service emails are transactional; we do not currently run email marketing.

Public content and recipients

Published listings, approved artwork, connections, reviews, review replies, display names and reaction totals are public. Account emails, credentials, private reports and raw vote-delivery addresses are not published in the directory. Staff access is limited by role. Owners receive aggregate listing measurements, not lists of individual visitors.

OVHcloud hosts the application and data. Google Workspace processes outgoing email and support messages. Cloudflare provides DNS, proxy/CDN security and Turnstile protection. Turnstile receives network/browser signals when protected forms load and may use signals to improve detection under its Privacy Addendum. These checks are separate from optional activity measurement.

For new or changed passwords, our server sends a five-character hash prefix to Pwned Passwords and compares padded results locally. It does not send your password, full hash, email or browser IP. That provider sees our server’s network address.

We may disclose information to meet legal duties, protect people or the service, or as part of a business transfer with appropriate safeguards. We do not operate live payment collection. Optional Google Ads measurement is described below; personalized advertising and enhanced conversions are disabled. Any future payment processing will be disclosed before purchase.

Voting and game-server operators

Votes record the game name, edition, listing, time, outcome and keyed player identity for cooldowns. A configured reward receiver receives the game name, IP address, service name and vote timestamp—not a verified Minecraft-account identity. Delivery payloads are encrypted while queued. The independent operator controls its plugin and logs; our deletion cannot erase its copy. Check its practices before voting.

Website assistant

Questions, limited recent question context, our help guide and relevant public listing data go to OpenAI for answers and safety checks. We do not add your account email, IP, password or private records. Do not type sensitive information. Answers may be wrong.

Our application does not save chat transcripts; this tab keeps messages until cleared or reloaded. API requests disable response storage, but provider abuse-monitoring retention may apply under OpenAI’s data controls. Hashed account/network identifiers, usage counts and temporary restrictions persist for abuse and cost limits. Allowance records expire on their daily/monthly schedules, up to 32 days, and scheduled maintenance clears expired records. Contact support to dispute a restriction.

Cookies, storage and optional measurement

Optional website measurement is off until you enable it in Cookie settings. It counts public page views, server-link clicks, filter usage, listing views, sponsor impressions and address copies, plus completed votes, reviews, favorites and owner actions. Broad traffic-source categories distinguish Google Ads arrivals, search, referrals and direct or unknown arrivals without storing raw referrer URLs or ad-click IDs in our statistics. Website staff can see aggregate page/filter/server activity; server owners see only their listing measurements. Search terms and private account paths are not collected. Website activity is stored as hourly aggregate counts without visitor identifiers; short-lived keyed network buckets limit request abuse. The expanded engagement collection requires a new v4 choice. Earlier choices do not authorize Google measurement. Our server uses a keyed account or IP identifier to avoid repeated counts for the same action, listing, edition and day; that identifier expires after 24 hours. Aggregate counts remain for about 366 days. These counts do not prove player joins.

Accept enables optional website analytics and Google Ads measurement; Decline keeps both off. When enabled on public directory/server pages, the Google tag receives browser/network information, public engagement events and ad-click identifiers to help attribute advertising results. Its attribution cookies (such as _gcl_aw) are configured for up to 90 days. We do not send account emails, game names, raw searches, reviews, authentication tokens or private account paths as event parameters. Personalized advertising, Google signals and enhanced conversions are disabled. Private account, owner and staff pages do not load the tag. See how Google uses information from partner sites.

Use Cookie settings in the footer to decline or withdraw at any time. Withdrawal stops future optional measurement and clears accessible Google attribution cookies; earlier aggregate counts and information already received by Google are not retroactively erased. Older choices that described no optional collection do not enable this measurement. Sign-in, voting and security do not depend on accepting it.

• mcsgg_cookie_choice and mcsgg_ads_choice remember separate website/Google measurement choices for 180 days.
• mcsgg.session_token authenticates a requested session for up to seven days, renewable with use; production names may start with __Secure-.
• mcsgg.two_factor and temporary authentication cookies secure sign-in flows, normally five minutes for two-factor challenges. Persistent session-data caching and long-term trusted-device exceptions are disabled.
• mcsgg-theme in local storage remembers your chosen theme until changed or cleared. New visitors start in dark mode.

Browser controls can remove storage; blocking essential cookies may break sign-in. Global Privacy Control and Do Not Track keep Google measurement off even after you accept. No Google requests are sent before opt-in. Declining optional measurement does not restrict the service.

Retention and deletion

Account and listing information stays while needed for the service. Account deletion removes credentials, sessions, two-factor data, favorites, reviews, reactions, notices, memberships and personal profile fields. Ownership/staff duties must first be resolved; support can help.

Maintenance clears expired sessions, verification records expired for more than a day, and expired abuse records. Completed/failed email contents and eligible non-pending delivery payloads are cleared after 24 hours; pending work can last longer. Status samples remain about 90 days and expired invitations about 30 further days.

Vote history, listing revisions, moderation and audit records may remain longer for integrity, safety, disputes or legal duties. Restricted backups can contain earlier copies until replaced or removed; deletion requests must be reapplied after restoration. These are operational schedules, not immediate-erasure guarantees. Contact us about retained information linked to you.

Your requests and choices

Account settings offer profile updates, session revocation, export and deletion. You can also email support for access, correction, deletion, portability, objections or restrictions. Depending on applicable law, you may withdraw consent, use an authorized agent, appeal a decision or complain to a regulator.

We may request proportionate verification; never send a password. We respond within applicable deadlines, explain exceptions and available appeals, and do not penalize privacy requests. Closing an account prevents account-dependent services.

Children, security and changes

Accounts require age 13 or older, with any higher local age or permission requirements. An age checkbox is not verified proof of age. If you believe a child has submitted personal information, contact support so we can investigate and handle restriction or removal as required. Parents should supervise interactions with independent servers.

Information is processed on U.S. infrastructure and by providers that may operate elsewhere. We use HTTPS, restricted access and protected credentials; no system guarantees absolute security. Where applicable law requires a processing basis or transfer safeguards, these depend on the service, security, legal duties or consent involved. Contact us for information relevant to your data.

We update the date above and give appropriate notice of material changes. A new purpose requiring consent will not rely on an unrelated earlier choice.