Privacy policy

Who is responsible

StolenHeart is personally operated from Lithuania. Goatman is the public community contact, and an adult account holder is responsible for the Tebex store. Send privacy requests through Support using the email address shown there.

The legal name and service address of the person responsible for website, server and support data have not yet been published. The adult’s responsibility for the store does not by itself establish who controls every other system.

What we receive

• Website visits: connection IP address, requested pages, request times and normal technical request information processed by hosting and security services.
• Store requests: recipient username, Minecraft edition, selected package identifiers and quantities. A gift recipient’s name is supplied by the purchaser.
• Gameplay: usernames, UUIDs, connection IPs, chat, commands, in-game locations, inventories, progress, moderation records and purchase-entitlement information.
• Support: the email address or Discord account used to contact us, messages, attachments and relevant transaction or gameplay evidence you supply.
• Fair-play checks: gameplay signals and client or mod information reported by server anti-cheat checks.

Our custom anti-cheat checks gameplay and reported client or mod information for disallowed modifications. Details of any automatic enforcement and outside recipients are still being confirmed.

Only send information relevant to your issue. Do not send passwords, login codes or full card details. Enter payment information only at Tebex checkout. Our checkout form collects the recipient name, edition and chosen items, not full card numbers or security codes.

Why we use data

We use data to run the server, deliver purchases, answer support requests and protect fair play. Depending on the use, we rely on the following legal bases:

• Providing requested services: account identifiers, gameplay progress and delivery information needed to provide the service or take steps you request before a contract.
• Legitimate interests: proportionate security, fair-play checks, moderation, service reliability and support, balanced against players’ privacy and particular protection for children.
• Legal obligations: records needed to meet a specific legal duty, where one applies.
• Consent: optional official features of player builds, messages or gameplay, and other optional uses where consent is required. Consent can be withdrawn for future use without making earlier lawful use unlawful.

Essential connection and account information is needed to join the server or deliver a purchase. Without it, those services may not work. Optional media permission is not a condition of playing. We send support and purchase-related emails, not promotional campaigns.

Website services and data sharing

Cloudflare: hosts the website and its API and processes connection information for hosting and security. We use connection IP addresses to limit abusive requests. See Cloudflare’s privacy information.

Tebex: receives the recipient name and selected items when checkout is prepared. Browser connections also reveal an IP address and technical request data. Tebex handles billing, payment records, fraud checks and purchase-related communication under its privacy policy. We use relevant transaction and entitlement information to help deliver or investigate purchases.

Discord: the homepage automatically requests approximate public member and online counts from Discord. Discord receives your IP address and normal request information. These count requests omit cookies, login credentials and the referring page. No Discord account or social widget is loaded. Joining Discord or submitting a ticket is a separate action governed by Discord’s privacy policy.

Google Translate: only opens when you choose it. The language tool sends public page text, excluding checkout forms, hidden dialogs and basket contents. Google then receives normal connection data under its privacy policy. Translation is optional.

Server hosting and email: Pine Hosting hosts the Minecraft server. We use Gmail for the support inbox under Google’s privacy information. These services handle the server files and messages needed to provide their services.

Email links: Gmail and Outlook buttons open those services only when selected. Their account and privacy settings apply there. You can instead copy the support address into your own email service.

Fonts and images are hosted with the website. We do not use advertising trackers, optional analytics scripts or an embedded video player. Hosting and security providers may still process operational logs.

Outside services are responsible for processing they carry out independently. Where a provider handles data on our behalf, our own data-protection duties still apply. The remaining details about service arrangements and international transfers are listed under Further information.

Staff access and public information

Within our team, direct access to raw player records is restricted to the owner. Discord and server support staff can see the support tickets they handle. The email inbox is currently accessed only by the owner. Hosting and service providers may separately process data as described above.

Other players can see ordinary public gameplay information, including usernames and nametags. Website leaderboards show player names, ranking positions and gameplay statistics already public in-game. They do not display connection IPs, chat, inventories, moderation records or purchase details. Delayed statistics are labelled. No top-supporters board is displayed.

We ask permission before officially featuring player builds, messages or gameplay. In-game visibility does not make private correspondence or unrelated personal information public.

Security and data breaches

The website uses HTTPS and limits checkout requests. Team access is restricted as described above. These safeguards reduce risk, but no online service can guarantee that an attack or disclosure will never occur.

A breach does not automatically establish that we failed in our duties. Equally, an outside attacker does not automatically remove our responsibility. Under the GDPR, an exemption from compensation liability requires us to establish that we bear no responsibility for the event that caused the damage. This policy does not waive your rights or shift that burden to you.

If an incident affects data we handle, we will investigate, take appropriate steps to contain it and notify the relevant authority and affected people where the law requires. Using a hosting, email or payment provider does not excuse a failure to meet our own duties.

For a suspected payment-card problem, contact Tebex and your bank or payment provider promptly. For a suspected disclosure involving StolenHeart records, contact Support. Do not include full card details, passwords or login codes.

How long records are kept

Every six months, we delete routine logs and support emails that are more than three months old. Depending on the cleanup date, a record can remain for almost nine months.

Browser-session storage is described in the cookie policy. Tebex and other independent providers have their own retention practices; the StolenHeart cleanup schedule does not delete their records.

Server-file backups are replaced on a two-hour cycle, with an intermediate backup retained to cover the gap. This description concerns server files, not Gmail or Tebex records.

The maximum age of the intermediate backup and the retention periods for active progress, punishment records and purchase entitlements are still being documented. The routine log schedule is not a confirmed deletion schedule for those separate records.

Your privacy rights

Depending on the processing and applicable law, you can request access, correction, deletion, restriction or a portable copy of your data, object to processing, and withdraw consent. Ask about safeguards and review if an automated decision has a significant effect on you. Some rights have lawful exceptions.

Use the email address on Support. We may ask for enough information to verify your identity or account ownership. GDPR requests are normally answered within one month. If the law allows an extension, we will explain it within that month.

You can complain to Lithuania’s State Data Protection Inspectorate or another competent data-protection authority. You do not have to complete a Discord moderation appeal first.

English is our support language. We will not treat a valid legal request as void solely because it is written in another language.

Younger players and policy changes

Our recommended community age is 13+, but younger players may use the Minecraft server where their account rules and law permit. Parents or guardians can contact us about their child’s data. Discord and Tebex have separate age requirements. We do not ask visitors to post their birth date or identity documents on the website.

Where a child’s consent is the legal basis, any required parental permission must be obtained before that optional processing. Browsing this website is not permission to feature a child’s content or personal information.

Material planned policy changes are announced on the website and Discord one month in advance. New data uses are explained before they start, including any choices or consent required.

Further information

We still need to publish the operator’s legal details and confirm the legal basis for each use, anti-cheat data and automatic enforcement, ticket and email recipients, hosting logs, remaining retention periods, processing locations and international-transfer safeguards.

You can ask about your data through Support. These outstanding details do not affect your privacy rights or our duty to respond.