Privacy notice

In short

• Riftwatch is the website of a Minecraft server, run by Dennis Wiebler.
• No accounts, no forms, no analytics, no tracking, no advertising, no consent banner.
• To deliver the pages, Cloudflare and our server in France process your IP address. Our server keeps its access logs for 14 days; Cloudflare keeps sampled request data for up to 31 days.
• Riftwatch sets no cookies. A few small values stay in your browser: whether you turned the sound off, how loud you set the music, and, until you close the tab, whether you have seen the intro, which advancements you earned and which items you mined.
• The crew page shows members of our Discord team who linked their Minecraft name with the bot; anyone can object at any time.
• Questions about your data: [email protected].

Contents

1. 1. Controller
2. 2. Visiting the website
3. 3. Cloudflare
4. 4. Storage on your device
5. 5. Email
6. 6. Fonts and external links
7. 7. Live map (map.riftwatch.net)
8. 8. Crew page (riftwatch.net/crew)
9. 9. Recipients
10. 10. Transfers outside the EU
11. 11. Retention
12. 12. Your rights
13. 13. Right to object
14. 14. Security
15. 15. Changes

1. Controller

The controller under the General Data Protection Regulation (GDPR) is:

Email: [email protected]. Phone or post on request. We have not appointed a data protection officer; at Riftwatch's size the law does not require one.

2. Visiting the website

When you open riftwatch.net, your browser sends a request. It passes Cloudflare (see 3) and reaches our server, which IKOULA operates for us in a data centre in France.

Purpose

Deliver the pages, protect the website against attacks and misuse, find faults.

Data

Your IP address, date and time, the requested address, status and size of the answer, request headers such as browser type and language, and the referring page if your browser sends it.

Legal basis

Art. 6 (1) (f) GDPR. Our legitimate interest is a website that works and stays secure.

Retention

The access logs on our server are deleted after 14 days. The website software itself writes no request logs.

3. Cloudflare

Cloudflare runs our domain's name service and sits in front of our server as a proxy: it terminates the encrypted connection, forwards the request and protects the website against attacks (DDoS protection, Browser Integrity Check). Cloudflare processes the request in the data centre that receives it, usually one near you.

Purpose

Deliver the website fast and securely, fend off attacks.

Data

As under 2, plus the country and network derived from your IP address.

Legal basis

Art. 6 (1) (f) GDPR. Our legitimate interest is a website that stays available and secure.

Retention

Cloudflare's request analytics keep sampled details of single requests for up to 31 days; blocked requests appear as security events for up to 31 days. We see them in our Cloudflare dashboard and use them only to fend off attacks and find faults.

If we switch on a Cloudflare security check during an attack, Cloudflare may set the cookie cf_clearance after your browser has passed the check, so it is not checked again on every request.

4. Storage on your device

Riftwatch stores information on your device only where this is strictly necessary for a function you use (§ 25 (2) No. 2 TDDDG). We therefore ask for no consent.

Sound setting

When you turn the sound off, your browser keeps the value true under the key riftwatch-sound-muted in its local storage, so the page stays silent on your next visit. Turning the sound on removes the key.

Music volume

When you move the volume slider below the sound button, your browser keeps the chosen level as a number between 0 and 1 under the key riftwatch-music-volume in its local storage, so the music keeps that volume on your next visit. Setting the slider back to full volume removes the key.

Intro

When a page of riftwatch.net first loads in a tab, your browser keeps the value 1 under the key riftwatch-intro-seen in its session storage, so the intro does not play again on every reload or page change. The browser deletes it when you close the tab.

Advancements

When you earn an advancement on the website, your browser keeps the list of earned advancements under the key riftwatch-advancements-earned in its session storage, so they are not awarded again when you return to a page in the same tab. The browser deletes it when you close the tab.

Inventory

When you mine blocks on the website, your browser keeps the number of collected items per kind under the key riftwatch-inventory in its session storage, so your hotbar stays filled when you open another page or reload in the same tab. The browser deletes it when you close the tab.

None of these values leaves your device. Riftwatch sets no cookies.

5. Email

Mail to [email protected] passes through Cloudflare Email Routing, which forwards it to the operator's mailbox at Google (Gmail). Cloudflare acts as our processor. Replies go out from this mailbox. Google processes these mails as a separate controller under its own privacy policy and may process them outside the EU (see 10).

Purpose

Answer your message and handle your request, including requests about your data.

Data

Your email address, your name if you give it, the content of your message and its metadata such as time and subject.

Legal basis

Art. 6 (1) (f) GDPR. Our legitimate interest is answering the people who write to us.

Retention

In the operator's mailbox until the matter is settled, then 1 year. Cloudflare Email Routing keeps a delivery log (sender, recipient, subject, time, result) for up to 31 days.

6. Fonts and external links

Riftwatch serves its fonts, images and sounds itself; its pages load nothing from Google or other third parties.

The button "Join Discord" is a plain link. Only when you click it do you leave Riftwatch for Discord, whose own privacy policy then applies. Riftwatch embeds no Discord widget.

7. Live map (map.riftwatch.net)

map.riftwatch.net is a 3D map of the Riftwatch Minecraft world. The open source software BlueMap renders it on our server in France. Like the website, it is delivered through Cloudflare, which processes the requests as described under 3.

The map shows live the Minecraft name, the skin (head) and the position of every player who is currently online on the Riftwatch Minecraft server. Players in spectator mode and players who are vanished or invisible are not shown. To show the skin, our server asks Mojang's skin service for it when a player joins (at most once per hour): it sends the player's UUID (the unique ID of the Minecraft account), receives the public skin and cuts the head out of it. The player's IP address is not sent. Mojang receives the UUID as a recipient (see 9).

Purpose

Show the Riftwatch world and who is playing in it; deliver the map, protect it against attacks and misuse, find faults.

Data

For players online on the Riftwatch Minecraft server: Minecraft name, UUID, skin, position and viewing direction in the world. For visitors of the map: the request data listed under 2.

Legal basis

Art. 6 (1) (f) GDPR. Our legitimate interest is a live map of the Riftwatch world for its players and visitors that works and stays secure.

Retention

Name, UUID, position and viewing direction reach the map only while the player is online; BlueMap does not store them. The head cut out of the skin stays on our server after the player leaves: BlueMap keeps it as an image file named after the UUID in each of the three maps (Overworld, Nether, End), updates it when the player joins again and never deletes it by itself, so it remains retrievable through the map until we delete it. We delete it on request (see 12). The access logs of the map on our server are deleted after 14 days, as for the website.

Visiting the map stores nothing in your browser (no cookies, no local storage) and loads nothing from third party servers.

8. Crew page (riftwatch.net/crew)

The crew page lists the people who run Riftwatch: the owner, the moderation and the staff of our Discord server "Riftwatch Official". A team member appears there once they link their Minecraft name in Discord with the command /mcname (for the whitelist of the Minecraft server); the bot says so in its answer. A member who does not want to be listed tells an Admin on Discord or writes to us, and is then hidden. Our Discord bot reads the entries from the Discord server and writes them as a file to our server, from which the page loads them.

Purpose

Show visitors who runs Riftwatch and whom they can turn to.

Data

For team members on the page: the display name on the Discord server, the highest team role and the face of the Minecraft skin of the name linked with /mcname (a generated pixel head while the skin cannot be loaded). To get the skin, the bot sends the linked Minecraft name and the account ID to Mojang AB (Sweden), cuts the face out of the skin, stores it as a picture on our server and serves it from riftwatch.net, so your browser sends no request to Mojang or Discord when you open the page. Discord profile pictures, Discord IDs, user names and Minecraft names are not published.

Legal basis

Art. 6 (1) (f) GDPR, our legitimate interest in showing who runs Riftwatch. Object at any time through an Admin on Discord or by mail to us; the entry and its picture are then removed within ten minutes.

Retention

Until the member objects, leaves the Discord server or loses every team role. Pictures that no entry uses any more are deleted at the next update. Visitors of the page: the request data listed under 2; the page asks our server for the current list once a minute while it is open.

9. Recipients

• Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, as our processor for name service, proxy, security and Email Routing, under its Data Processing Addendum.
• IKOULA NET SAS, 2 Cité Paradis, 75010 Paris, France, as our processor for the server, under its data processing terms.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as provider of the operator's mailbox (Gmail) for mail to our address (see 5).
• Mojang AB, Söder Mälarstrand 43, 118 25 Stockholm, Sweden (Mojang Studios, part of Microsoft), as operator of the Minecraft services, for the skin download of the live map (see 7). It receives the UUID of a player who joins the Riftwatch Minecraft server. Mojang and Microsoft process the request as controllers in their own right under the Microsoft Privacy Statement, which applies to all Minecraft services.

We do not sell or share your data with anyone else.

10. Transfers outside the EU

Our server stands in France. Cloudflare processes requests in its global network, normally in a data centre near the visitor, which may lie outside the EU; its analytics may be stored in the USA. Cloudflare, Inc. is a US company. Google may process the mail in the operator's mailbox in the USA. Mojang's skin service runs on Microsoft's global network; Microsoft may store and process the request in the USA and in other countries where it operates.

Transfers to the USA rely on the adequacy decision for the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795); Cloudflare, Inc., Google LLC and Microsoft Corporation are certified under it. Where the framework does not apply, Cloudflare's Data Processing Addendum provides the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914).

11. Retention

• Access logs on our server: 14 days.
• Access logs of the live map (map.riftwatch.net) on our server: 14 days.
• Player heads of the live map (image files named after the UUID) on our server: until we delete them, no automatic deletion.
• Request analytics and security events at Cloudflare: up to 31 days.
• Email Routing delivery log at Cloudflare: up to 31 days.
• Sound setting: on your device until you turn the sound on again or clear your browser data.
• Music volume: on your device until you set the slider back to full volume or clear your browser data.
• Intro flag, earned advancements and mined items: on your device until you close the tab.
• Entries of the crew page (name, role, avatar file) on our server: until you object, leave the Discord server or lose your team role; then removed within ten minutes.
• Emails to us: until the matter is settled, then 1 year.

12. Your rights

You have the right to access your data (Art. 15 GDPR), to have incorrect data corrected (Art. 16), to have your data deleted (Art. 17), to have the processing restricted (Art. 18) and to object to processing based on legitimate interests (Art. 21). Write to [email protected]. We answer within one month. The crew page (see 8) is based on legitimate interests; you can object to it at any time, also through an Admin on Discord.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is:

Email: [email protected]. Website: www.lda.bayern.de.

13. Right to object

Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop the processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

14. Security

We protect data with technical and organisational measures (Art. 32 GDPR), among them encrypted connections only (TLS, HSTS, an origin certificate checked by Cloudflare), a website service that cannot write to its own files, security headers on every page and access to the server only by key.

15. Changes

We update this notice when the processing changes, for example when the modpack download or new pages arrive. The date at the top shows the current version.