Privacy Policy

Visiting. When you open a page, the hosting provider and the domain name service receive your device's network address, the page you asked for, your browser's description of itself, and the time. These records exist to deliver the page, to keep the site working, and to stop abuse. The site sets a cookie with your country code so it knows which privacy rules apply to you, and a cookie with your light or dark choice.

Voting. To vote for a server you enter a Minecraft username. For a Java vote the site checks that username against Mojang's public name service and keeps the account id it answers with; for a Bedrock vote there is no lookup and no account id. The site records the username, the edition you chose, the time, whether the vote was delivered to the server, and a fraud flag if the vote looked automated, and it stores a hash of your network address made with a secret and the day's date, so the hash is different every day. The hash exists to allow one vote per player and per network for each server every 24 hours and to spot vote fraud; it is never stored as an address, and the site keeps no way to turn it back into one. The same hash is the key of a rate limit counter that is deleted after a day. The site sets a signed cookie so the vote page can show you when you can vote again. The server you voted for receives your Minecraft username and the name of this site, so it can give you your in game reward, and its owner can see your username in their vote log. The server does not receive your address or the hash.

Server owner accounts. To list or claim a server you create an account with an email address and a password, or sign in with a link sent to that email. The site keeps your email, a display name if you set one, your listings, your server's Votifier settings (the token or public key is encrypted before it is stored, and the plain value is never kept), the record of how you proved you run the server, and the log of votes delivered to your server. Sign in is handled by the hosting provider's sign in service, which keeps its own record of sign ins, including the network address; passwords are stored only as hashes. When you choose a password the browser sends the first five characters of a hash of it to the Have I Been Pwned range service to check whether it appears in known breaches; the password itself never leaves your browser for that check.

Reports. When you report a listing the site keeps the reason you chose, the details you wrote, the time, and the same kind of daily hash of your network address, so that one visitor cannot flood the queue. Reports are read by the site's staff and are never shown to anyone else.

Security checks. The vote form and the report form use Cloudflare's Turnstile check to tell people from automated scripts. Cloudflare receives the request and may set a cookie on its own domain for that check.

Analytics. The site uses Google Analytics to count visits and see which pages are used. In the European Economic Area, the United Kingdom, and Switzerland, and for any browser that sends the Global Privacy Control signal, analytics storage is off. Everywhere else it is on by default, and you can turn it off on the Your Privacy Choices page, which sets a cookie the site honors for a year. The site has no advertising network and no marketing pixels.

Video. Server pages can show a YouTube video. The video loads only when you press play, and it loads from YouTube's no cookie domain. Until then YouTube receives nothing.

Server checks and vote delivery. The site's worker, which runs on Cloudflare, connects to the listed Minecraft servers every few minutes to read their player counts and status; that traffic goes to the servers, not to you. The same worker delivers votes to servers, so it receives the username and edition of each vote, and it relays the Mojang username lookups.

To show the server list and the pages you ask for. To count and deliver votes and to keep the vote counts honest. To let server owners manage their listings and receive their votes. To review reports. To keep the site safe from abuse. To measure how the site is used, subject to the analytics choices above. To send the emails an account needs: confirming an address, signing in by link, resetting a password, and changing an email address. The site sends no newsletters and no marketing email.

The site runs on services that process information on its behalf and only for it: Lovable (hosting, the database, the sign in service, file storage, and email delivery), Cloudflare (the domain name service, the security check on forms, and the worker that checks servers, delivers votes, and relays username lookups), Have I Been Pwned (the partial password hash check at sign up), Google (Analytics, subject to your choices), Mojang, a Microsoft company (username lookups when you vote), YouTube (when you play a video), and Discord (the public member count of a server's Discord community, read with no information about you). The server you vote for receives your Minecraft username. The site does not sell personal information and does not share it for advertising. Information is disclosed to authorities only when the law requires it.

Server check results are deleted after 90 days. Rate limit counters are deleted after a day. Claim codes are deleted once they are used, and 7 days after they expire. Mojang username lookups are stored for 30 days, and a stored answer is reused for 24 hours. Vote records are kept so that vote counts and rankings stay correct; the address hash in them changes daily and cannot be linked back to you after that day. Listing reports are kept until they are reviewed and for one year after the review. Account information is kept until 14 days after you ask for the account to be deleted, and the deletion can be cancelled during those days. A listing you remove, and everything attached to it, is deleted 14 days after you ask. A sponsorship the listing paid for stays in the payment records and the public auction archive under the server's name. Hosting and domain name service logs are kept by those providers under their own retention rules.

Connections to the site use HTTPS. Personal information in the database is reachable by the site's own server code only; browsers can read only the public views of listing data. Server owner secrets such as Votifier tokens are encrypted at rest with a key held outside the database. Passwords are hashed by the sign in service. Access to the database and the hosting account is limited to the people who run the site. Network addresses in vote and report records are stored only as hashes. No system is perfectly secure, and the site cannot promise that a breach will never happen; if one affects your information the site will tell you as the law requires.

You can delete your account, or remove a listing you have verified, from the Account and Removal page. Either takes effect 14 days after you ask, and you can cancel during those days from the link in the confirmation email or from that page. If your server is offline for good and you cannot pass the ownership check, write to support@everythingmc.com and we remove the listing after a manual check. You can turn analytics off on the Your Privacy Choices page. If you live in the European Economic Area, the United Kingdom, or Switzerland, you can ask for a copy of your information, ask for it to be corrected or deleted, object to its use, or ask for it to be moved; the legal bases are your consent for analytics, the contract with you for accounts and listings, and the site's legitimate interest in running an honest vote and a safe site for everything else. If you live in California or another state with a privacy law, you have the right to know what is collected, to delete it, to correct it, and not to be discriminated against for asking; the site does not sell or share personal information as those laws define it. Send any request to support@everythingmc.com; the site answers within 30 days and may ask you to confirm you control the email address or username in question. You can also complain to your data protection authority.

Everything MC is a general audience site. Voting needs no account and stores nothing personal beyond a Minecraft username, the Mojang account id for a Java vote, and a daily hash. Server owner accounts are for people 13 and over. If you are a parent or guardian and believe your child under 13 has given the site personal information, write to support@everythingmc.com and it will be deleted.

When this policy changes, the date at the top changes and the new text is published here. Material changes are announced on the site before they take effect.