CraftVote

Privacy Policy

Last updated:

This page explains what personal data CraftVote (craftvote.com) collects, why, how long we keep it and what you can do about it.

In short: we collect what we need to run accounts, count votes fairly and stop cheating. No ads, no tracking, and we never sell data.

1. Who is responsible

CraftVote, run from Cyprus, decides how your data is used (the "controller"). For anything about your data, write to [email protected].

2. What we collect

When
You visit the site
What we store
Your IP address and browser details are processed to deliver the pages and to block attacks. We don't build a profile of what you look at.
When
Visit statistics
What we store
We count which pages are opened, from which site visitors arrive, and their browser, device type and country, with Umami. No cookies are used and nothing is stored in your browser. Your IP address is only used to work out the country and to tell one day's visits apart; it is not stored.
When
You create an account
What we store
Username (public), email address (never shown publicly) and your password in scrambled form (we can't read it). Also the IP address and browser used to sign up and to log in.
When
You log in with Discord or Google
What we store
Your ID at that service, your email address and whether it is confirmed there. From Discord also your handle, to suggest a username. We never get your password, and we don't keep your real name, your profile picture or the access tokens the service hands over.
When
You list a server
What we store
The listing (name, address, description, tags, country, links, banner) which is public, and your Votifier settings, which are kept secret. Our regular checks of the server (online, players, version, message, icon) are stored too.
When
You vote
What we store
The Minecraft username you typed, your IP address, your browser details, the server and the time. Your account, if you have one, is not attached to the vote.
When
You report a server
What we store
The reason, what you wrote, your IP address and, if you are logged in, your account.
When
We email you
What we store
A note that an email of a certain kind was sent to your address and whether it worked. Not its content.
When
Important actions
What we store
A security log of logins, failed logins and changes to accounts and servers, with the time, IP address and browser. It lets us investigate abuse and undo mistakes.
When
Limits against floods
What we store
Counters of how many logins, searches, votes or reports came from one connection or went at one account in the last minutes. They are stored in a scrambled form — not as your IP address or email.
When
You write to us
What we store
Your email address and your message, kept in our mailbox.

We don't ask for your real name, address, phone number or payment details.

3. Why we use it

Purpose
Running your account and your server listings, and sending the emails that belong to them (confirm email, password reset, "your server is offline").
Legal ground (GDPR)
Our agreement with you (the Terms).
Purpose
Counting votes fairly: one vote per person a day, limits per IP address and Minecraft username, the robot check.
Legal ground (GDPR)
Our legitimate interest in a fair ranking.
Purpose
Keeping the site safe: the security log, blocking abusive addresses, handling reports, finding bugs.
Legal ground (GDPR)
Our legitimate interest in a safe, working site.
Purpose
Answering requests from authorities and defending legal claims.
Legal ground (GDPR)
Legal obligations and our legitimate interests.

We don't send marketing emails. Some rules run automatically (vote limits, hiding a server with very low uptime, marking a vote for a check by our team when it comes from a VPN or hosting network or looks like part of a pattern). They only affect votes and listings, and you can ask our team to review a decision.

4. What other people can see

  • Public: your username, your server listings with the owner's username, and each server's vote count.
  • Not public: your email address, your IP address, who voted for a server and who reported a server.
  • The server you vote for: when a server has vote rewards switched on, we send it your Minecraft username, your IP address and the time of the vote. That is how the Votifier system used by Minecraft servers gives you the reward. The server's owner is responsible for what they do with it.
  • Our team: staff see what they need for support and moderation. Their access depends on their role and is logged.

5. Services we use

These companies handle data for us, under contract and only on our instructions:

Service
Cloudflare
What for
Network and security in front of the site, the "I'm not a robot" check (Turnstile), storage of banners, server icons and database backups.
Service
Railway
What for
Runs the website and its database.
Service
Resend
What for
Sends our emails (confirm your email, password reset, messages about your servers). It gets your email address and the email's content.
Service
Sentry
What for
Receives technical error reports so we can fix bugs. We strip cookies, IP addresses, emails and form contents before a report leaves the site.
Service
Google
What for
Hosts our mailbox (Google Workspace). It handles the emails you send to [email protected] and our replies.
Service
Umami
What for
Counts visits to our pages, without cookies.

If you choose "Continue with Discord" or "Continue with Google", that service learns that you are logging in to CraftVote. Their own privacy policies apply.

We may have to give data to authorities when the law requires it. We don't share data with advertisers and we never sell it.

6. Outside the EU

Some of these companies are based in the United States or may handle data there. When that happens, the data is protected by safeguards approved by the EU: the EU–US Data Privacy Framework or the EU's standard contract clauses.

7. How long we keep it

Data
Account
Kept
Until you delete it. One line in the security log keeps which account was deleted (email and username) for 365 days.
Data
Accounts that never confirm their email
Kept
Removed after 7 days.
Data
Server listing
Kept
Until you delete it. It leaves the public list at once and is erased for good when you delete your account.
Data
Server check history
Kept
30 days.
Data
Log of votes sent to servers
Kept
30 days.
Data
Login sessions
Kept
Until you log out or the session ends by itself. Removed from our database a day later.
Data
Votes
Kept
The vote itself (server, Minecraft username, time) stays, so the ranking and past months stay checkable. Your IP address and browser details are deleted after 90 days.
Data
Reports
Kept
The report stays as a record of what was decided. Your IP address is deleted after 90 days.
Data
Security log
Kept
IP addresses and browser details are deleted after 365 days. Lines about a deleted account lose its email and username after the same time.
Data
Record of emails we sent
Kept
365 days.
Data
Counters for limits against floods
Kept
A day at most.
Data
Addresses blocked from voting
Kept
While the block lasts. Blocks that ended are deleted after 365 days; blocks without an end date stay until we lift them.
Data
Emails you send us
Kept
Until your request is dealt with, and after that for as long as we need a record of it.
Data
Database backups
Kept
30 days. Deleted data can stay in backups for up to that long.

8. Your rights

Under the GDPR you can ask us to:

  • show you the data we hold about you and give you a copy;
  • correct data that is wrong;
  • delete your data;
  • limit how we use it, or object to a use that is based on our legitimate interests;
  • hand over the data you gave us in a common file format.

You can do a lot yourself on the Account page: change your username, email and password, download a copy of your data, and delete your account. For anything else write to [email protected]. We answer within one month. If you voted without an account, tell us the Minecraft username and roughly when; we may ask for something that shows the request really comes from you.

You can also complain to the data protection authority of the country where you live. In Cyprus this is the Commissioner for Personal Data Protection.

9. Children

You must be at least 16 to create an account. Voting needs no account; for a vote we only store what is listed above. If you are a parent and think your child gave us personal data, write to [email protected] and we will remove it.

10. Security

The site is only reachable over an encrypted connection. Passwords are stored in scrambled form. Our team logs in with a second step (authenticator app), and what staff do is logged.

No website is perfectly safe. If a serious breach affects your data, we tell you and the authority as the law requires.

11. Cookies

We only use what the site needs to work: no advertising or tracking cookies. The details are on the Cookies page.

12. Changes

When we change how we use data, we update this page and the date at the top. For important changes we tell account holders by email or with a notice on the site.