Privacy Policy

01About this policy

This policy explains what data the Myrcraft Administration (“we”) collects in the game, the launcher, on myrcraft.com and in support, why, who we share it with, how long we keep it and how you can control it. It complements the Terms of Service.

By signing up you consent to your data being processed as described here. You can withdraw consent by deleting your account or writing to us.

02What data we collect

Account:

email, language, sign-up date, account role and status, the version of the Terms you accepted and when;
your password — only as an Argon2id hash; we don't store the password itself and can't recover it;
when you sign in with Google or Discord — your account ID there, display name, and email if the provider has verified it;
for two-step sign-in — the encrypted authenticator secret and hashes of the recovery codes.

Sessions and devices:

for every sign-in on the website and in the launcher — your browser or device (User-Agent), country by IP address, sign-in time and last activity. The IP itself is not stored in the session;
to fight cheats and ban evasion, the launcher sends hashes of hardware identifiers (system ID, disk serial number, MAC address — as hashes only), plus the launcher version, OS and language;
when you join the game — the IP address the server pass was issued to and the address you connect to the game server from.

Game: characters and their progress, items, currency and transactions, friends, in-game mail, coupon redemption history.

Statistics: how many players are online, when a play session starts and ends, which launcher version, OS and language. We compute it ourselves, without third-party analytics and without IP addresses.

Crash reports — only if you allowed sending them in the launcher: game and launcher logs, versions, OS and your comment. The launcher removes your user name and home folder from the logs.

03Chat messages

We keep all in-game chat messages, including private ones, for 30 days after they are sent, to review player reports. Then they are deleted.

A reported message is kept together with the report — up to 30 days after the report.

A moderator sees private messages only while reviewing a report: the message itself and a few messages before and after it in the same conversation. Moderators can't read conversations without a report.

If a message shows an item, a snapshot of the item at the time it was sent (stats, durability, upgrades) is kept with it for the same period.

The list of players you ignore is kept while your account exists. The other player doesn't know you are ignoring them.

04Support requests

A request contains the topic, form fields, the conversation with support, attachments, the contact email you gave, the IP address (to fight spam) and your rating. Support's internal notes are not visible to you.

Without signing in, only a secret link gives access to a request. We store a hash of the link, not the link itself, so we can't recover it. The contact email is optional and not verified: the link and reply notifications are sent to it.

Requests are seen by support and moderation staff. If the email you gave matches an account's email, the support agent sees that account to help you regain access.

Closed requests are deleted 6 months after closing, their attachments after 90 days.

05Why we use data

to run your account, sign-in, the game, the launcher and updates;
to protect players and the Services from hacking, cheats, spam, fraud and ban evasion;
to moderate the chat and review reports;
to answer support requests;
to send service emails: email confirmation, password reset, support replies and important notices;
to find and fix bugs and decide how to develop the game;
to comply with the law.

We don't show ads, don't sell data and don't share it for others' advertising.

06Legal bases

Myrcraft is played in many countries. We process data under the data protection law of the country where you live — including the EU General Data Protection Regulation (GDPR) for players in the European Union and the laws of CIS countries. Our bases are:

performance of the Terms — accounts, the game, purchases and support can't work without this data;
legitimate interests — protection from hacking, cheats, spam and fraud, moderation, fixing bugs and statistics;
consent — you give it when you sign up, and crash reports are sent only with your consent in the launcher; you can withdraw consent at any time;
legal obligations — when the law requires us to keep or disclose data.

Only with services Myrcraft can't work without, and only what they need:

Railway — hosting of servers and databases;
Cloudflare — domains, attack protection, the “I'm not a robot” check (Turnstile), file storage (attachments, crash reports, backups) and inbound mail;
Resend — sending email from myrcraft.com;
Sentry — server error reports; request and user data are removed before sending;
Google and Discord — only if you sign in with them;
Mojang — the launcher downloads game files from their servers, so they see your IP address;
a payment partner — for purchases; only they receive your card details.

These services' servers may be outside your country — in the European Union and the United States. When data is transferred abroad, we use services that commit to protecting it: for data from the EU — under the European Commission's Standard Contractual Clauses or to countries with a recognised level of protection.

We disclose data to public authorities only on a lawful request.

08How long we keep data

account and game data — while the account exists and 30 days after it is deleted;
website session and launcher sign-in — up to 30 days or until you sign out;
chat messages — 30 days;
closed support requests — 6 months, attachments — 90 days;
crash reports — 90 days;
game sign-in IP addresses — about a day after the play session ends;
game statistics — up to a year;
database backups — 30 days;
ban records and the staff action log — longer, to investigate violations and prevent repeat ones; after account deletion they are not linked to your email.

09Deleting your account

You can delete your account in your account settings. All sessions end right away and you can no longer sign in. After 30 days the data is erased:

characters, items, currency, friends and in-game mail;
chat messages you sent and received, reports on them, ignore lists and chat restrictions;
sessions, Google and Discord sign-ins, two-step sign-in and hardware hashes;
game statistics and crash reports.

Some records remain anonymised: the email is replaced with a technical address, the character name is removed from coupon history, and the email, account link, IP address and form fields are removed from support requests; the conversation is kept until the end of the period above. If the account was banned, the hardware identifiers from the ban are kept without a link to the account.

10Cookies and browser storage

We use only necessary cookies — no advertising or analytics cookies:

myr_session — website sign-in; 30 days;
myr_support — access to a support request without signing in; 90 days;
myr_locale — website language; 1 year;
myr_tz — time zone, to show times correctly; 1 year.

The browser (localStorage) keeps recent emoji and skin tone for the support chat. The Turnstile check loads a Cloudflare widget. The launcher keeps your sign-in in the OS's secure storage, and its settings and log in its own folder on your computer.

11Your rights

You can find out what data we hold about you and get a copy, correct it, delete your account, restrict or object to processing, withdraw consent and receive your data in a machine-readable form to move it to another service. Much of this is available in your account settings: sessions, sign-in methods, two-step sign-in, deletion.

For anything else, write to [email protected] from the email your account is registered with. We will reply within 30 days — or sooner if the law of your country requires it — and may ask you to confirm the account is yours.

If you believe we are violating your rights, you can complain to the data protection authority of your country. But please write to us first — we will try to put it right.

12Minors

Myrcraft is meant for players aged 16 and over. We don't knowingly collect data from younger children. If you are a parent and believe your child under 16 has created an account, write to [email protected] and we will delete it.

13Security

Data is sent only over encrypted connections. Passwords are hashed, two-step sign-in secrets are encrypted, staff access is limited by role, and two-step sign-in is mandatory for staff.

If you have found a vulnerability, write to [email protected].

14Changes to this policy

We update this policy when the way we handle data changes. The new version is published on this page with its date; we will announce significant changes on the website.

15Contacts

Questions about your data: [email protected]. Support: myrcraft.com/support and [email protected].