Privacy Policy

This Privacy Policy explains how PlayMU.NET ("we", "us") collects, uses, shares and protects information about you when you use the site. We've written it in plain language; the corresponding legal terms live in our Terms of Service.

We respect the principles of the EU General Data Protection Regulation (GDPR) and apply them to all users regardless of where you live.

1. Who is the controller

PlayMU.NET is the data controller for the personal data described in this policy. For any privacy request, write to [email protected].

2. What we collect

Account information

• Display name and email (required to create an account).
• Hashed password — we never store passwords in plain text.
• Role (player, server owner, moderator, admin) and account preferences.

Voting and activity metadata

• Your IP address and user-agent at the moment of each vote (used to prevent abuse and enforce cooldowns).
• The in-game user id you provide when voting (if the listed server requires one).
• Comments, ratings and server listings you submit.
• Click events on server links and ads (for anti-fraud and basic analytics).

Payment data

• If you top up your wallet or buy a promotional placement, payment is processed by Stripe. We don't receive or store your full card number — Stripe handles that.
• We do store the transaction reference, amount, currency, status and timestamp.

Technical data

• Server logs (IP, request path, status code, timestamp) for security and debugging.
• Session cookies needed for login and CSRF protection.
• If captcha is enabled, Cloudflare Turnstile may set its own cookies; see Cloudflare's privacy notice.

3. Why we collect it (purposes and legal bases)

• Run the service (account, voting, listings, payments) — contractual necessity.
• Prevent fraud and abuse (vote manipulation, scraping, payment fraud) — legitimate interest.
• Comply with the law (tax records, lawful requests) — legal obligation.
• Improve the platform (basic, aggregate analytics) — legitimate interest.
• Send transactional emails (password reset, payment receipt) — contractual necessity.
• Marketing emails — we do not send marketing emails. If that changes we'll ask for your consent first.

4. Who we share data with

• Stripe — payment processing.
• Cloudflare — CDN, security and captcha (Turnstile).
• Hosting and email providers — infrastructure and transactional email delivery.
• Server owners you vote for — when you submit a vote, the listed server may receive your in-game user id and the timestamp via a server-to-server webhook so they can reward you in-game. Your account email is not shared.
• Public content — your display name, listings, comments and ratings are publicly visible on the site.
• Law enforcement — when we're legally required to.

We do not sell your personal data to anyone.

5. Cookies

We use a minimal set of cookies:

• Session cookie — required for login state.
• CSRF token cookie — required to protect forms.
• Turnstile cookies — set by Cloudflare when captcha is enabled.

All of these are strictly necessary to operate the site and do not require consent under GDPR. We don't use advertising cookies or cross-site trackers.

6. How long we keep your data

• Account data — while your account exists. Deleted within 30 days after you close it.
• Voting metadata — typically 180 days, then anonymized/aggregated.
• Payment records — kept for the period required by tax/accounting law (usually 5–10 years).
• Server logs — typically 30 days.

7. Your rights

Under GDPR (and similar laws in many jurisdictions) you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data ("right to be forgotten"). You can delete your account from your profile page.
• Restriction — ask us to limit how we process your data.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, where processing is based on consent.
• Complain to a supervisory authority in your country.

To exercise any of these rights, email [email protected]. We respond within 30 days.

8. Security

We use HTTPS everywhere, hash passwords with strong adaptive hashing, isolate the database behind a private network, and follow standard security practices. No system is 100% secure — if you discover a vulnerability, please report it responsibly to [email protected].

9. International transfers

Some of our processors (Stripe, Cloudflare) may store or process data outside your country. They commit to GDPR-equivalent safeguards (Standard Contractual Clauses or equivalent) for those transfers.

10. Children

PlayMU.NET is not directed at children under 16. If you believe a child has registered, contact us and we'll remove the account.

11. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with an updated "Last updated" date. For significant changes affecting your rights we'll attempt to notify registered users by email.

12. Contact

Questions or privacy requests: [email protected].