Privacy Policy
Last updated: October 21, 2026
1. Server log files
When you visit the site, our web server automatically processes: IP address, date and time, requested page, transferred data volume, browser and operating system (user agent) and the referrer URL. This data is used to deliver the site, analyse errors and fend off attacks. The web server runs on our own server and writes an access log; the log is rotated when it reaches 50 MB, at most five old files are kept, and old files are deleted after 90 days at the latest. Legal basis: Art. 6(1)(f) GDPR.
2. Visitor statistics (cookie-free)
We count page views and daily visitors with our own cookie-free method. A hash is derived from IP address, user agent, the current day and a secret server key. The hash cannot be reversed to the IP address and changes every day, so visitors are not recognised across days. The IP address itself is never stored. With each page view we also store which page it was, as its route only (for example “/players/[name]”, never which player, and never search terms or other parameters), and per daily hash how many pages were opened and which was the first. This tells us how many pages a visit has and which pages are used most. No cookies are set and no data is shared with third parties. Legal basis: Art. 6(1)(f) GDPR (interest in reach measurement); no consent under § 25 TDDDG is required because nothing is stored on or read from your device.
2a. Country check (IP geolocation)
To count visitors per country (see below) we look up the country your IP address belongs to, and for the United States, Canada and Australia also the state or province. We use our own copy of the free “IP to City Lite” database of DB-IP (db-ip.com, licensed under CC BY 4.0) on our server; your IP address is not sent to DB-IP or anybody else, and we keep only the result (country and state, no city), never the IP address. We never ask your device for its location.
Country statistics: if you leave “Anonymous country statistics” switched on in our privacy notice, the country (and state, see above) is added to the daily visitor hash described in section 2 and counted once per day in a counter per country. We only ever look at the number of visitors per country and day. Legal basis: Art. 6(1)(f) GDPR (our interest in knowing where our players come from to improve the site). You can switch it off at any time under “Privacy settings” at the bottom of every page; from then on your visits are no longer counted per country.
2b. Privacy notice
On your first visit, and again when the notice changes, the site shows a notice that explains the cookies, the local storage and the country check and asks you to confirm it before you use the site. Your answer (the version of the notice you confirmed, whether country statistics are on, and the time) is stored only in your browser's local storage, so that we do not ask again. The legal pages can be read without confirming. Search engines do not see the notice.
3. Local storage in your browser
For convenience features the site stores settings only in your browser (local storage and, for two short-lived values, session storage). This data is never sent to us. It contains: the theme (light/dark); sound and volume settings of the minigames, the daily chest and Market+ deal alerts; which Market+ deals were already announced; whether you closed the daily chest hint and the account menu hint; your sell multipliers and favourite sell items; the flip calculator multiplier; your recent search terms; the state of the enchantment predictor; your preferred trade handover mode; your answer to the privacy notice (section 2b); and, in session storage, notifications you snoozed and a marker that prevents reload loops after an update.
This storage is strictly necessary for the features you use or the choices you make (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings; “Reset settings” on your account page removes the most important values.
4. Trading market (login cookie, Minecraft name)
When you use the trading market you enter your Minecraft name and verify it by sending a one-time code to our bot in-game. We store this name, the associated public Minecraft UUID (resolved via the Mojang API), the time of your verification, your listings, reservations and trade status, including the payment and delivery events reported by our vault bot. A strictly necessary login cookie keeps you signed in (HttpOnly, 1-year lifetime, deletable in your browser); it contains no tracking identifier and is used only for the trading market (§ 25(2) no. 2 TDDDG). Legal basis: Art. 6(1)(b) GDPR (performing the trade you requested). Trades are kept as long as needed to resolve disputes; on request we delete your trading data unless trades are still open. Only in-game currencies are traded. We process no payment data.
Creator codes and referral links: if you enter a creator code, or open a creator's referral link (/r/<code>), we store which creator you support with your session and your verified account until you remove it; opening the link sets the same login cookie described above. Opening a Market+ member's referral link stores that member's name in an HttpOnly cookie (bagel_mp_ref, 30 days, deletable in your browser) so the referral can be filled in when you buy Market+. Legal basis: Art. 6(1)(b) GDPR (the support or referral you asked for).
4a. Support tickets
Verified players can open support tickets on the site. For a ticket we store your Minecraft name and UUID, the category and subject, the chat messages and the photos or videos you or our team send, the status, the name of the team member handling it, time stamps and internal notes of our team about the case. Subject, messages, notes and files are encrypted (AES-256-GCM) before they are stored in our database; they are readable only through our admin panel by the site operator and the support team.
Before you can write in a ticket, we ask for your consent to store the ticket and the chat history, including photos and videos, for handling your request and for training purposes for up to 12 months (Art. 6(1)(a) GDPR). If you decline, the ticket is deleted immediately. Every ticket is deleted automatically at the latest 12 months after it was opened. You can withdraw your consent at any time on Discord (Joel9277); your ticket is then deleted. Withdrawal does not affect processing that took place before it.
Notifications about your ticket (for example that the team answered) are stored with your Minecraft UUID and contain no content of the ticket. We will never ask for your password or other login details in a ticket.
4b. Builder-Market
Verified players can order builds from builders on the Builder-Market, and apply to become a builder. For a build order we store the Minecraft names and UUIDs of the buyer and the builder, the title, the description, the price, the chosen protection (with or without Market insurance), the payments and payouts reported by our bot, the chat between buyer, builder and our team including photos and videos, time stamps and the history of the order. For an application we store your Minecraft name and UUID, your text and the photos or videos of your builds, and the decision of our team. Titles, descriptions, messages, application texts and files are encrypted (AES-256-GCM) before they are stored; they are readable only by the people involved in the order and, through our admin panel, by the site operator and the team.
Buyers agree to this storage before creating an order, builders before applying and before accepting an order, for handling the order, resolving disputes and for training purposes, for up to 12 months, like support tickets (Art. 6(1)(a) GDPR; the order itself: Art. 6(1)(b) GDPR). An order nobody works on for 3 days is closed automatically, and an order that is not paid within 12 hours after a builder accepted it is cancelled; every order and application is deleted at the latest 12 months after it was created. You can withdraw your consent at any time on Discord (Joel9277); open orders are then refunded and deleted.
Until 30.09.2026 approved builders could also write in a builder chat, a room for builders only; the builder chat has been closed since then. For each message written there we stored the builder's Minecraft name and UUID, the text and the time; messages that looked like coordinates were not delivered but stored for our team. Legal basis: our legitimate interest in a safe marketplace and in preventing leaked coordinates (Art. 6(1)(f) GDPR). These messages are kept for our records and deleted 12 months after they were written.
4c. Discord (account link, verification, bots, tickets, applications)
Our Discord server and our two Discord bots are run on Discord, a service of Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA. Whatever you write or do on Discord is processed by Discord under its own privacy policy (discord.com/privacy); data may be transferred to the USA.
Linking your Discord account (optional, on your account page): you log in with Discord and allow us to read your Discord user ID and user name (scope "identify"; no messages, no server list, no e-mail address). We store them together with your Minecraft name and the time of the link. With the link, our bot gives you roles on our Discord server that match your status on this website (see "Roles and nicknames" below) and may send you direct messages about your trades, payouts, support tickets, price alerts and other notices. You choose which kinds of messages you receive on your account page or with /dms; the messages contain only what the notification on this website shows. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by unlinking; the link, your message settings and the roles are removed then.
Verification on Discord (optional): in the verification channel of our Discord server you can verify your Minecraft account without this website. The bot shows you a one-time code that you send ingame to our verification bot with /msg, exactly like the verification on this website. When the code arrives, we store your Discord user ID and user name together with the Minecraft name and UUID of the account that sent the code and the time, and link your Discord account to that Minecraft account as if you had linked it on your account page (the paragraph above applies, unlinking included); the bot then sends you a direct message that you are verified. If you cannot send the code, you can request a manual verification: this opens a ticket on Discord (see "Tickets on Discord"), and a team member who checked your account can verify it for you; this is recorded in our admin log. A banned Minecraft account cannot be verified. A verification is valid for 30 days, like on this website. Legal basis: your request (Art. 6(1)(b) GDPR) and your consent to the link (Art. 6(1)(a) GDPR).
Roles and nicknames: for linked members with a valid verification, the bot sets the nickname on our Discord server to the Minecraft name, so other members can see who they are talking to, and gives roles that match the status on this website (Verified, Market+, creator, rank and badges). Members without a valid verification get the Unverified role. In the self roles channel you can pick notification roles yourself (news, updates, giveaways, creators who go live, deals); the bot mentions these roles in its announcements, and you can remove them at any time with the same buttons. We do not store these roles on this website. Legal basis: our legitimate interest in a clear and safe community server (Art. 6(1)(f) GDPR); for the notification roles your own choice (Art. 6(1)(a) GDPR).
Bot commands: when you use a command of our bot (for example /price, /player, /deals or /dms), the bot sends your Discord user ID and what you typed to this website to answer it. We do not store these requests beyond the usual server logs. Our bot also posts news, changelogs, giveaways, creators who went live and deals in our Discord channels.
Invites (referrals): when you join our Discord server, the bot records who invited you (from the personal invite link you used, or the name you enter yourself), your Discord user ID and user name and the time you joined and left; when you verify your Minecraft account, it counts the invite for the member who invited you (each Minecraft account only once). The number of members someone invited is shown publicly on our Discord server (with /invites and on the invite leaderboard). Legal basis: our legitimate interest in rewarding members who bring new players and in keeping fake accounts out (Art. 6(1)(f) GDPR).
Support and applications: to answer faster, our team can see a copy of your support ticket messages in a private channel on our Discord server that only the team can read. Only tickets whose consent text mentions this are copied; photos and videos stay on this website. The copy in Discord is deleted when the ticket is deleted, at the latest after 12 months (section 4a). Team members can also read the text of a builder application in Discord; the text is shown only to the team member who asks for it and is not posted in a channel (section 4b). Legal basis: your consent to the ticket or the application (Art. 6(1)(a) GDPR).
Tickets on Discord: you can also open a support ticket directly on our Discord server. The bot then creates a private channel that only you and our team can see; the conversation takes place there. On this website we store your Discord user ID and user name, the category, the subject, your first message, your Minecraft name (taken from your linked and verified account, otherwise as you typed it), who took and who closed the ticket and the time stamps. When the ticket is closed, the bot sends us a transcript of the channel (author, time, text and the names of attached files) and we store it encrypted (AES-256-GCM) on our server; you can get it from the bot as a direct message. Subject, message and transcript are encrypted as well. Everything is deleted at the latest 12 months after the ticket was opened. Legal basis: your request for help (Art. 6(1)(b) GDPR) and your consent when you open the ticket (Art. 6(1)(a) GDPR).
Suggestions and clan advertising: suggestions for our Discord server, this website or the game and requests to advertise your clan are sent on our Discord server the same way as tickets on Discord (a private channel with our team, see above) and are stored, encrypted and deleted like them (the area or clan name as the subject, your text, the transcript; at the latest after 12 months). Legal basis: your consent when you send it (Art. 6(1)(a) GDPR).
Applications on Discord: you can apply as a builder, for our team or as a creator on our Discord server. We store your Discord user ID and user name, your Minecraft name and UUID (from your linked and verified account, for team applications as you typed it if you have none), your answers (for builders and the team: your age, your experience or motivation, your portfolio or availability; for creators: the platform, your channel, the creator code you want and your text), the time and the decision of our team with its reason. The answers are stored encrypted (AES-256-GCM) and are shown only to our team, your age included. We send you the decision as a direct message on Discord. If a creator application is approved, your channel and code are used for your creator profile on this website. Applications are deleted at the latest 12 months after they were made. Legal basis: your consent when you apply (Art. 6(1)(a) GDPR).
Build orders on Discord: from 30.09.2026 on, the title, a short preview of the description and the price of a new build order are also shown to our builders in a channel of our Discord server, so that a builder takes it quickly; buyer names, chats and files stay on this website. When the order is no longer open, the post is marked as no longer available. Legal basis: your consent to the order (Art. 6(1)(a) GDPR, section 4b).
Team actions: our team can also answer tickets, ban accounts, maintain the scammer list, decide applications and manage team accounts from Discord. These actions are recorded in our admin log like actions in the admin panel. The first message of a ticket (on this website or on Discord) is compared with keywords of answers our team prepared, and a matching answer is either sent to you right away as an "Automatic answer" or only suggested to our team; when a team member looks up the overview of a player's account from Discord, the lookup is recorded in our admin log.
4d. Advertising (ad orders)
You can buy a banner ad on pages of this website through our Discord server. For an ad order we store your Discord user ID and user name, the Minecraft name and UUID of your linked and verified account (the account that pays), the type (clan or private), the package, the pages, the duration, the name, text, colour and link of the ad, the price, the payment reported by our bot, the time slot, the ticket on Discord that belongs to the order, the decision of our team with its reason and the time stamps. Your own ad text is stored encrypted (AES-256-GCM). The ticket is handled like a ticket on Discord (section 4c).
While your ad runs, its name, text and link are shown to every visitor of the chosen pages; your Minecraft name and Discord details are not shown. We do not count views or clicks of an ad. Ad orders are deleted at the latest 12 months after they were made. Legal basis: the ad you ordered (Art. 6(1)(b) GDPR).
4e. Wallet
Verified players can open a wallet on this site, pay in ingame money through our bot and use it for the raffle, the shop, Market+, builder orders and minigames. For the wallet we store your Minecraft name and UUID, your balance, every booking (deposits, cash-outs, purchases and earnings), your deposit limits and the payouts our bot sends. Legal basis: Art. 6(1)(b) GDPR (running the wallet). We keep these records as long as your wallet exists and as long as needed to prove payments and settle disputes.
Until 21 October 2026 the wallet could also be used in our casino. The casino has been closed for good and its game records (rounds, bets, seeds, statistics, leaderboards and animation diagnostics) were deleted. The bookings of casino bets and wins in your wallet history stay with the other bookings of your wallet.
5. Public game data (auctions, orders, leaderboards, donors)
We collect data that is publicly visible in the game or via the official BagelSMP API: Minecraft names of sellers and buyers, listings, prices, leaderboards and in-game donations to our bot account. Minecraft names are pseudonyms; we usually cannot link them to a real person. Legal basis: Art. 6(1)(f) GDPR (the community's interest in market transparency). Player heads (skins) are loaded through our proxy from mc-heads.net; your IP address is not sent to that service.
5b. Daily chest and free raffle tickets
To give out the free daily chest and free raffle tickets only once per device and day, we store a device hash together with your Minecraft name when you open a chest or claim a free ticket. It is made like the visitor hash in section 2 (a secret key, the day, your IP address and your user agent) with its own key; it cannot be turned back into the IP address and changes every day. Legal basis: Art. 6(1)(f) GDPR (preventing that one person collects the rewards with many accounts). It is kept with the chest opening or the ticket.
5a. Public chat archive
One of our bot accounts is online on BagelSMP and stores the public chat it receives there: the Minecraft name of the sender, the rank symbols in front of it, the message and the time. Private messages (whispers) and server messages are not stored.
Since 17.10.2026 the archive is public: on the page “Live Chat” (/chat) everyone can read the public chat live, search it and go back through it, and the profile page of a player shows the public chat messages written under that name, all of them since the archive started on 29.09.2026. Shown are the time, the rank symbols, the name and the message; slurs are replaced by stars. The checks our bot makes on who sent a line, UUIDs and other internal data are only visible to our team, which also uses the archive as evidence in scam reports, trade disputes and support cases.
Everything in the archive was written in the public chat of BagelSMP, where every player online could read it. Legal basis: Art. 6(1)(f) GDPR (our interest and the interest of the community in a transparent record of the public chat, protecting players from fraud and settling disputes). The archive is kept without a fixed deletion period. You can object and request deletion of your messages at any time (section 9); we then remove them from the public pages and from the archive.
6. Scammer list
Scam reports contain the Minecraft name of the reported account, a description and evidence (e.g. screenshots). We publish entries only after manual review. Legal basis: Art. 6(1)(f) GDPR (protecting the community from fraud). Affected persons may object and request correction or deletion (see section 9). Real names, addresses or any data outside the game are never published.
7. External services
Item images are fetched from mc.nerothe.com and raw.githubusercontent.com (misode/mcmeta) through our server and cached; your browser does not contact these services directly. Fonts are served locally. Links to Discord or YouTube lead to external providers with their own privacy policies; our Discord server and bots are described in section 4c.
Videos: some entries of the scammer list show evidence videos from YouTube. They are embedded in YouTube's privacy-enhanced mode (youtube-nocookie.com, Google Ireland Limited / Google LLC). When such a page loads, your browser connects to YouTube and sends your IP address; once you play a video, YouTube may store data on your device. Data may be transferred to the USA. Legal basis: Art. 6(1)(f) GDPR (showing the evidence of a scam report).
Raffle draws: when you click to verify a raffle draw yourself, your browser fetches the public random number of that draw from the drand network (api.drand.sh or drand.cloudflare.com) and sends your IP address to it. Nothing happens without that click.
8. Retention
Market data is kept permanently to build price histories, without any personal reference outside the game. Visitor statistics contain only daily counters and daily hashes. Trading data: as long as needed for disputes or until deleted on request. Support tickets: at most 12 months (section 4a). Builder-Market orders and applications: at most 12 months (section 4b). Discord link and message settings: until you unlink; copies of support tickets in Discord: deleted with the ticket; tickets opened on Discord with their transcripts and applications made on Discord: at most 12 months (section 4c). Ad orders: at most 12 months (section 4d). Country statistics: daily counters per country, kept like the visitor statistics. Device hashes for chests and free tickets: kept with the opening or the ticket (section 5b). Wallet records: see section 4e. Server logs: at most 90 days (section 1).
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). To exercise these rights, contact us on Discord (Joel9277). You may also lodge a complaint with a data protection supervisory authority, e.g. the one responsible for your place of residence.
10. Children
This site is not directed at children under 13 (COPPA) or under 16 (Art. 8 GDPR). We do not knowingly collect data from children. Parents who believe their child has left data with us may contact us and the data will be deleted.
11. Notice for users in the United States
We do not sell personal information and do not share it for advertising. Where US state privacy laws (e.g. CCPA/CPRA) apply, you may exercise your rights by contacting us on Discord (Joel9277).
These texts were prepared carefully but are not legal advice.