Privacy Policy
Updated: 7 November 2026
1. About this beta notice
This notice describes data handling in the current OBSIDEX EX implementation, a Minecraft economy companion in beta and under development. It is an operator-review draft, not a legal compliance certificate. A registered operator entity, business address and public privacy/contact email have not been supplied for publication. These remain launch requirements.
No private administrative email is published as a contact substitute. Avoid providing unnecessary sensitive information while the public contact channel is unavailable.
2. Account and connection data
Google/Firebase authentication processes your Google identity and authentication credentials. The platform uses identifiers such as Firebase UID, verified email and display name to establish the appropriate account and access permissions. It does not ask for your Google password. Authentication tokens are used to authorize requests; a local display hint is not authorization.
Connection records include server identifiers, Minecraft UUID/name, approval status and timestamps. You can choose a unique reusable connection code. It is stored as a readable identifier, not a password or sole ownership proof. Each authenticated server request expires after five minutes and requires your explicit Google-account confirmation. Changing the identifier invalidates pending requests, not established links. Older expiring-code compatibility records may remain hashed until expiry.
Server operators may provide a server name, address, port, version, license or bridge configuration and public-listing preference. Public directory information is visible to visitors only where publication is opted in. A private account connection is not automatically a public directory listing.
3. Game reports, content and billing records
Where connected, the service may process game-reported balances, revisions, resources and server-scoped trading records. These are not cash balances. A membership purchase does not create game-wallet funds.
Content services may process creator profiles, submitted articles, media and moderation records. Profile/chart preferences, saved assets, a reusable connection identifier and connection approvals may also be stored. Store services retain product, price, quantity, order status and server-receipt records for purchases using that server’s game money. The website does not debit game-wallet snapshots or offer real-money store checkout. Where separately opted in by the server operator, asset snapshots and candle history are available without joining a server; private player wallets and orders are not public. Publicly published content and directory details are accessible to others; do not include personal or confidential information in public submissions.
Where a payment method is lawfully enabled, records may include plan, amount, currency, provider order/payment identifiers, settlement or review status, and a manual transaction reference or note. Provider-hosted checkout has its own privacy terms. Never submit a bank PIN, OTP, wallet private key or recovery phrase. Merchant API/IPN credentials belong only in the authenticated private settings and are encrypted server-side; they are not returned as readable values by the configuration API.
4. Why information is processed
Information is used to provide accounts and server connections, enforce server and role boundaries, show requested data, manage authorized content, reconcile enabled subscriptions, prevent abuse and operate security/audit controls. Advertising and third-party resources have the additional choices described below.
The operator must confirm the applicable lawful bases, notices and jurisdiction-specific requirements before full launch. This draft does not assume that consent is the legal basis for every operation or that every optional feature is currently enabled.
5. Browser storage and session handling
Firebase browser persistence may retain authentication state using browser storage. The private console also uses a scoped Secure, HttpOnly, SameSite=Strict cookie whose lifetime is limited by the verified token, up to one hour per issuance. Authorization is still checked server-side and renewal does not make a user permanently verified.
Local display preferences, a selected-server preference, an account-display hint and an advertising choice may be saved on your device. A short-lived account-summary cache is held only in the active document's memory, is scoped to the current user and is cleared on sign-out or identity change. Wallet balances, linking codes and payment mutations are not added to that summary cache. You can clear browser storage, but doing so may sign you out and remove preferences.
6. Advertising and external providers
Configured house advertising may appear on free-use surfaces. Optional third-party advertising, such as Google AdSense, is loaded only after the available advertising choice is accepted; you can switch back to house ads. Sensitive account/code pages do not load third-party advertising scripts through this integration.
Providers involved, when the corresponding feature is used, include Google/Firebase for identity, Supabase for backend/database services, Vercel for hosting and genuine Cloudflare Turnstile for protected actions. New creator images are uploaded through a server-side ImgBB API request and its verified public URL is stored with the creator record. Uploaded image content is shared with ImgBB and becomes publicly accessible by URL; only upload content you may publish. Videos use configured Cloudflare R2 storage. Existing previously verified media is retained for compatibility. NOWPayments is involved only when its checkout/settlement service is enabled. Their own policies apply to their processing; a provider name is not evidence that every optional feature is configured.
7. Infrastructure, access and security
Hosting and security providers may process request metadata such as IP address, browser/request details, timestamps and operational logs. Administrative and financial actions may create audit records. Access is restricted according to the relevant account, server and privileged role. Private console pages are not publicly listed, but an unlisted URL is not a replacement for authorization.
Security measures include verified identity checks, scoped sessions, database access rules, input checks and payment-signature/reconciliation controls. No website is guaranteed breach-proof or continuously available. Data may be processed in provider infrastructure outside your country; the operator must assess any required transfer safeguards rather than assume that this draft provides them.
8. Retention and your choices
Use account tools to sign out and, where available, disconnect linked identities. Disconnecting does not delete or transfer game funds. These actions do not necessarily erase provider records, audit trails, legal records or another server's data.
Records may be retained while needed for the requested service, security, transaction handling or applicable legal obligations. A fixed retention schedule and a complete account-data deletion workflow have not been represented as implemented. The operator must establish an appropriate retention and verified privacy-request process before full launch.
You may have access, correction, deletion, objection or other rights under applicable law. A verified public privacy contact is not yet published; this is an unresolved operator requirement, not a completed request channel. Do not send secrets through public comments or unverified inboxes.
9. Young users and updates
Minecraft is used by people of different ages. This service does not claim that a child-specific compliance program or parental-consent workflow is implemented. Users must meet applicable age/consent requirements; the operator must review these requirements before targeting children or collecting their data.
This notice may change as the service develops. The revision date is shown above. Additional notice or consent will be requested where required; no already-recorded policy acceptance is claimed by publishing this page.
## Creator channels and revenue applications
Creators may publish a public channel title, unique handle, description and verified owned profile/banner artwork. Their timezone is stored as a private preference. Advertising-revenue applications record the authenticated creator identity, actual declared country/territory, acceptance version/time and review status. Confirmed provider-settlement records, if any, remain private to the authenticated creator and authorized service operations; they are not game-wallet funds. No payout credentials are collected at this application stage. Content analytics currently summarize recent publishing records, not verified audience measurements.