Privacy Policy

Data we collect

• Account data: username, email address, and a hashed password (we never store it in plain text).
• Server data: the files, worlds, and configuration you upload or generate.
• Technical data: IP address, request logs, and basic activity (logins, server actions) used for security, abuse prevention, and capacity management.
• Cookies: a strictly-necessary session cookie to keep you logged in, and - only if you consent - advertising cookies (see "Cookies and ads").

Where your data lives

All Levyathan infrastructure - the game servers, database, file storage, and backups - runs on hardware located in Switzerland. Your account data and server data are stored and processed exclusively in Switzerland, which has its own strong data-protection law (the revised FADP) and an EU adequacy decision.

One exception: transactional email (verification, password resets) is delivered via Resend, a US-based provider, which receives your email address and the message content for delivery purposes only.

Why we use it (legal bases)

To provide the service (performance of a contract), to keep it secure and prevent abuse (legitimate interests), to verify your email and send essential account messages such as password resets (legitimate interests), and to show advertising on the free tier (consent).

Email (Resend)

We use Resend to send transactional email such as address verification and password resets. Your email address is shared with Resend solely to deliver these messages; Resend processes it on our behalf as a sub-processor.

Cookies and ads

The free tier is financed by advertising served by Google AdSense - that is what keeps Minecraft servers free for everyone. Ad requests are paused and advertising cookies are only set after you accept them in the cookie banner; you can decline them and still use the service. For how Google uses data from sites that show its ads, see https://policies.google.com/technologies/partner-sites.

Retention

We keep account and server data while your account is active. When you delete a server or account, its files and backups are removed; security and activity logs may be retained for a limited period afterwards, no longer than necessary for security and legal purposes.

Your rights

Subject to applicable law (including the Swiss FADP and the GDPR), you may request access, correction, deletion, export, or restriction of your personal data, and may object to certain processing or withdraw consent. You may also complain to your local data-protection authority.

You can exercise the two biggest rights yourself, instantly: your Account page lets you download a full export of your data (access) and permanently delete your account with everything in it (erasure).

For anything else, contact privacy@levyathan.ch.