1. Who we are
EndoraPvP ("EndoraPvP", "we", "us") operates the Minecraft network reachable at play.endorapvp.com and the website endorapvp.com. We are established in the Netherlands and act as the controller for the personal data described in this policy within the meaning of the General Data Protection Regulation (GDPR) and the Dutch Implementation Act (UAVG).
You can reach us about privacy matters through the support page or in the official Discord. EndoraPvP is an independent community project and is not affiliated with Mojang Studios or Microsoft.
2. What data we collect
We only collect data that is needed to run the website, the game servers and the store.
Website account
- E-mail address and a password hash (Argon2id; we never store the password itself) when you register with e-mail.
- Discord user id, username and avatar when you sign in with Discord. We do not receive your Discord e-mail unless you grant it, and we do not read your messages.
- Minecraft UUID and username when you link your Minecraft account (through an in-game code or Microsoft sign-in). With Microsoft sign-in we only receive the Minecraft profile (UUID and name), never your Microsoft password.
- Session data: a random session token (stored hashed), the browser user agent and a keyed hash of your IP address, used to keep you logged in and to detect abuse.
Gameplay
- Player statistics such as kills, deaths, hearts, killstreaks and playtime, linked to your Minecraft UUID, shown on leaderboards and player profiles.
- Punishments and appeals: bans, mutes, kicks and warnings issued by staff, with the reason, the issuing staff member and the duration. Appeals you submit (text, contact details) are stored with the punishment. Public punishment pages never show IP addresses or e-mail addresses.
- Security data on the game servers: the anti-cheat and ban system keeps a hashed IP address per connection to enforce bans against ban evasion. Raw IP addresses are not shown on the website.
Store
- Purchases are processed by Tebex (Tebex Limited, United Kingdom), which acts as merchant of record and processor of your payment details. Payment card data never reaches our servers. We receive the transaction id, the purchased package, the price, the Minecraft username/UUID the purchase is for and a hashed e-mail address so we can deliver the rank and handle refunds or chargebacks.
Support and contact
- Name, e-mail address and the message you send through the support form, so we can reply.
Technical data
- Our web server keeps short-lived access logs (IP address, requested page, time, user agent) for security and troubleshooting. The website additionally counts page views per day using a hashed IP address that cannot be reversed; no advertising or cross-site tracking takes place.
3. Why we process your data and on which legal basis
| Purpose | Data | Legal basis (art. 6 GDPR) |
|---|---|---|
| Providing your website account, login and account linking | E-mail, password hash, Discord id, Minecraft UUID, session data | Performance of a contract (6.1.b) |
| Running the game servers, leaderboards and profiles | Minecraft UUID, username, statistics | Performance of a contract and legitimate interest in an engaging game experience (6.1.b, 6.1.f) |
| Moderation: punishments, appeals, preventing ban evasion | UUID, punishment records, hashed IPs, appeal text | Legitimate interest in a fair and safe community (6.1.f) |
| Store purchases, rank delivery, refunds and chargebacks | Transaction data from Tebex, Minecraft UUID | Performance of a contract and legal obligations such as bookkeeping (6.1.b, 6.1.c) |
| Answering support requests | Name, e-mail, message | Legitimate interest / steps prior to a contract (6.1.f, 6.1.b) |
| Security, abuse prevention and aggregated statistics | Hashed IP addresses, server logs, audit log of staff actions | Legitimate interest in securing our services (6.1.f) |
| E-mails about your account (verification, password reset) | E-mail address | Performance of a contract (6.1.b) |
We do not send marketing e-mails, we do not sell personal data and we do not use automated decision-making with legal effects.
5. How long we keep data
- Account data: as long as your account exists. Deleting your account removes your profile, sessions, linked Minecraft account and support tickets, or anonymises records we must keep.
- Sessions: 30 days after last use; password reset and verification tokens expire within hours.
- Punishments and appeals: for the duration of the punishment and, for permanent punishments, as long as the network operates, so bans remain enforceable. Expired temporary punishments stay in the history for moderation context.
- Purchase records: 7 years, as required by Dutch tax law (Algemene wet inzake rijksbelastingen), limited to the transaction data we hold.
- Player statistics: as long as the gamemode exists; resets may clear them.
- Server access logs: at most 30 days. Page view counters are stored as daily totals without personal data.
- Support tickets: up to 12 months after they are closed.
6. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy (data portability);
- have inaccurate data corrected;
- have your data erased ("right to be forgotten"), unless we must keep it, for example purchase records or active punishments;
- restrict or object to processing based on our legitimate interests;
- withdraw consent at any time where processing is based on consent;
- lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority of your EU member state.
Registered users can export or delete their account themselves from the account page. For anything else, contact us through the support page; we respond within one month.
7. How we protect your data
- All connections to the website use HTTPS. Security headers (Content Security Policy, HSTS) are enforced.
- Passwords are hashed with Argon2id; session tokens and reset tokens are stored hashed.
- IP addresses used for security are stored as keyed hashes, not in clear text.
- Access to the admin panel requires a verified staff rank and every action is logged.
- Rate limiting protects login, registration and forms against abuse.
8. Children
Our services are intended for players aged 16 and older, or younger players with permission of a parent or guardian in line with the age at which minors may consent under Dutch law. If you believe a child has provided personal data without such permission, contact us and we will remove it.
9. Changes to this policy
We may update this policy when our services change. The date at the top shows the latest version. Material changes are announced on the website and in Discord.