Privacy Policy
This explains what we hold about you, why, how long for, and what you can make us do about it. It covers account holders, people who connect to our network in game, and visitors to this site.
1. Who is responsible
The controller of your personal data is Isaiah D. Mullins, trading as MossMC, in North Carolina, United States.
Data protection contact: privacy@moss-mc.com. We are not required to appoint a Data Protection Officer and have not done so.
Important distinction. We are the controller for the data described below. We are not the controller of data that a customer collects on a server they run here — chat logs, their own store records, their own plugins' data. For that, the server's operator is the controller and we are at most a processor acting on their instructions. If your concern is about a specific community server, contact its owner.
2. What we collect, and why
| Data | Why we hold it | Lawful basis (UK/EU) |
|---|---|---|
| Email address, username, password hash | To create and secure your account and contact you about it | Performance of a contract |
| Minecraft username and UUID, if you link one | To apply what you buy to your account in game | Performance of a contract |
| Billing records: amounts, dates, plan, processor reference, last four digits and card brand | To take payment, issue receipts, meet tax and accounting duties, and investigate disputes | Contract; legal obligation |
| Server configuration and metadata you enter | To provide the hosting you asked for | Performance of a contract |
| IP addresses, device and browser information, session and login records | To keep accounts secure, detect fraud and abuse, enforce bans and one-account rules, and diagnose faults | Legitimate interests — security and preventing abuse |
| Network activity: servers joined, chat and adverts you post, sanctions applied to you | To operate a shared space, moderate it, and respond to reports | Legitimate interests — safety of the network |
| Support and abuse correspondence | To answer you and keep a record of what was decided | Contract; legitimate interests |
| Referral attribution: who invited whom, and when | To credit referrals correctly and detect self-referral | Contract; legitimate interests |
We do not store your full card number. Payments go directly to our processor.
We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use it to train machine learning models.
3. Where we rely on legitimate interests
Where the table above says "legitimate interests", we have considered whether our interest is overridden by your rights. We rely on it for keeping accounts secure, preventing fraud and abuse, enforcing bans, keeping the network safe for the people on it, and understanding faults. We hold the minimum needed for those purposes and do not use the data for anything else. You may object at any time — see section 8.
4. Cookies
We use a session cookie to keep you signed in, and a small number of strictly necessary cookies for security, including protection against cross-site request forgery. We do not use advertising cookies, third-party trackers, or analytics that profile you across sites.
Because we set only strictly necessary cookies, no consent banner is required. If that changes, we will ask first.
5. Who else sees it
We share personal data only with service providers who process it on our instructions, under contract, for the purposes above:
- Payment processors (Stripe, and PayPal where offered) — to take and reconcile payments. They are independent controllers for the payment itself and their own privacy policies apply.
- Infrastructure and data centre providers — who host the servers and store backups.
- Email delivery — to send account, billing and support messages.
- Database and error-monitoring services — to run the platform and diagnose failures.
We may also disclose data where we are legally required to, where it is necessary to establish, exercise or defend legal claims, to report child sexual abuse material to the National Center for Missing & Exploited Children as the law requires, or to protect the rights and safety of users or the public.
If the business is reorganised, sold or transferred, account data may transfer with it. We will tell account holders before that happens.
6. Where your data goes
We operate from the United States and our infrastructure may be located in the United States and in Europe. If you are in the United Kingdom, the European Economic Area or Switzerland, your data will be transferred to the United States.
For those transfers we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures including encryption in transit and access controls. You may request a copy of the relevant clauses from privacy@moss-mc.com.
7. How long we keep it
We do not keep personal data indefinitely. Our retention schedule is:
| Data | Kept for |
|---|---|
| Account record and linked Minecraft identifiers | While the account is open, then deleted within 30 days of closure |
| Server files, worlds and configuration | Deleted within 30 days of the server being removed or the account closed |
| Routine backups | Expire on their own cycle, no more than 90 days |
| Billing and transaction records | 7 years, as tax and accounting law requires |
| Login, IP and session records | 12 months |
| Network chat, adverts and activity records | 90 days, unless attached to an open report or sanction |
| Ban and sanction records | While the ban is in force, and up to 3 years after, to enforce evasion rules |
| Support and abuse correspondence | 3 years |
| Records connected to a legal claim, investigation or statutory report | As long as required, then deleted |
Where we must keep a billing record, we reduce it to what the law requires and delete the rest.
8. Your rights
Wherever you live, you may ask us to give you a copy of what we hold about you, correct it if it is wrong, or delete it. Email privacy@moss-mc.com. We will verify that the request comes from you, and respond within 30 days, or sooner where the law requires.
If you are in the UK, EEA or Switzerland
You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time without affecting what was done before. You are not subject to any decision based solely on automated processing that produces legal or similarly significant effects.
You may complain to your local supervisory authority. In the UK that is the Information Commissioner's Office.
EU/UK representative: .
If you are in California
You have the right to know what we collect and why, to access and delete it, to correct it, and to limit the use of sensitive personal information. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of, but you may still make the request. We will not discriminate against you for exercising any right. We honour the Global Privacy Control signal where your browser sends one.
If you are elsewhere
Many states and countries grant similar rights. We apply the access, correction and deletion rights above to everyone, regardless of where you live.
9. Children
MossMC is not directed to children under 13 and we do not knowingly collect personal information from them. Our signup and our network both require users to be 13 or older.
If we obtain actual knowledge that we hold information about a person under 13, we will delete it and close the account promptly. If you are a parent or guardian and believe we hold information about your child under 13, email privacy@moss-mc.com and we will delete it and confirm.
For users between 13 and 18, we collect the same limited data described above and nothing additional. We do not profile minors, serve them advertising, or share their data for marketing.
The retention schedule in section 7 is our written retention policy for all users, including minors. We do not retain any user's data for longer than the purpose it was collected for requires.
10. Security
We protect data with encryption in transit, hashed credentials, access controls limiting who can reach what, and separation between customers' environments. We review access and keep the number of people with it as small as possible — currently one.
No system is perfectly secure and we do not claim ours is. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours where required, and tell affected users without undue delay.
11. Changes
We may update this policy. The version and effective date are at the top of this page, and material changes are notified to account holders as described in the Terms of Service.
12. Contact
Privacy, data requests and complaints: privacy@moss-mc.com
Everything else: support@moss-mc.com