Privacy Policy

1. Controller

CHANGE_ME Vor- und Nachname CHANGE_ME Straße Hausnummer CHANGE_ME PLZ Ort Deutschland

E-mail: CHANGE_ME@example.com

2. Hosting and server location (USA)

This website is hosted by CHANGE_ME Hosting-Anbieter, NA-East (USA). The server is located in the USA (NA-East region), so your data is transferred to the USA when you visit. Transfers rely on the EU Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, otherwise on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Legal basis for hosting is our legitimate interest in a secure and efficient operation of the site (Art. 6(1)(f) GDPR).

3. Server log files

When you visit the site, the server automatically processes: IP address, date and time, requested page, transferred data volume, browser and operating system (user agent) and the referrer URL. This data is used to deliver the site, analyse errors and fend off attacks and is usually deleted by the hosting provider after a short time. Legal basis: Art. 6(1)(f) GDPR.

4. Visitor statistics (cookie-free)

We count page views and daily visitors with our own cookie-free method. A hash is derived from IP address, user agent, the current day and a secret server key. The hash cannot be reversed to the IP address and changes every day, so visitors are not recognised across days. The IP address itself is never stored. No cookies are set and no data is shared with third parties. Legal basis: Art. 6(1)(f) GDPR (interest in reach measurement); no consent under § 25 TDDDG is required because nothing is stored on or read from your device.

5. Local storage in your browser

For convenience features the site stores settings only in your browser (Local Storage): the chosen theme (light/dark), the RTP map image toggle and your personal sell multipliers. This data is never sent to us. It is strictly necessary for the feature you requested (§ 25(2) no. 2 TDDDG) and can be deleted at any time in your browser settings.

6. Trading market (login cookie, Minecraft name)

When you use the trading market you enter your Minecraft name. We store this name, the associated public Minecraft UUID (resolved via the Mojang API), your listings, reservations and trade status. A strictly necessary login cookie keeps you signed in (HttpOnly, 1-year lifetime, deletable in your browser); it contains no tracking identifier and is used only for the trading market (§ 25(2) no. 2 TDDDG). Legal basis: Art. 6(1)(b) GDPR (performing the trade you requested). Trades are kept as long as needed to resolve disputes; on request we delete your trading data unless trades are still open. Only in-game currencies are traded – we process no payment data.

7. Public game data (auctions, orders, leaderboards, donors)

We collect data that is publicly visible in the game or via the official BagelSMP API: Minecraft names of sellers and buyers, listings, prices, leaderboards and in-game donations to our bot account. Minecraft names are pseudonyms; we usually cannot link them to a real person. Legal basis: Art. 6(1)(f) GDPR (the community's interest in market transparency). Player heads (skins) are loaded through our proxy from mc-heads.net; your IP address is not sent to that service.

8. Scammer and trusted lists

Scam reports contain the Minecraft name of the reported account, a description and evidence (e.g. screenshots). We publish entries only after manual review. Legal basis: Art. 6(1)(f) GDPR (protecting the community from fraud). Affected persons may object and request correction or deletion (see section 11). Real names, addresses or any data outside the game are never published.

9. External services

Item images are fetched from mc.nerothe.com and raw.githubusercontent.com (misode/mcmeta) through our server and cached; your browser does not contact these services directly. Fonts are served locally. Links to Discord, PayPal or YouTube lead to external providers with their own privacy policies.

10. Retention

Market data is kept permanently to build price histories, without any personal reference outside the game. Visitor statistics contain only daily counters and daily hashes. Trading data: as long as needed for disputes or until deleted on request. Server logs: as per the hosting provider's policy.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Contact the e-mail address above. You may also lodge a complaint with a data protection supervisory authority, e.g. the one responsible for your place of residence.

12. Children

This site is not directed at children under 13 (COPPA) or under 16 (Art. 8 GDPR). We do not knowingly collect data from children. Parents who believe their child has left data with us may contact us and the data will be deleted.

13. Notice for users in the United States

We do not sell personal information and do not share it for advertising. Where US state privacy laws (e.g. CCPA/CPRA) apply, you may exercise your rights via the e-mail address above.