This policy explains what personal data the Furiah’s Visuals website collects, why, how long we keep it, and what rights you have. We collect as little as we can.
This is a draft. It will be reviewed before launch.
Who is responsible
The controller of your personal data is OWNER_NAME, ADDRESS, COUNTRY. For anything about privacy, write to CONTACT_EMAIL.
What we collect
Your account
- Your email address, username and password. We never store the password itself, only a strong one-way hash of it.
- Whether your email address is verified, your notification choices (“email me when purchases open”, product news), when you created the account and when you were last active.
- If you turn on two-factor sign-in: its secret key, stored encrypted, and your backup codes.
- If you sign in with Discord (when available): your Discord account ID and the email address Discord shares with us.
Your Minecraft account
- The Minecraft username and UUID you link, and when you linked and verified it.
- To show your Minecraft head, our server fetches your public skin from Mojang. Your browser never contacts Mojang directly.
Sessions and security
- When you’re signed in: a session record with your IP address, your browser’s user agent (we show only the browser), your country (from Cloudflare) and timestamps.
- Rate-limit records that hold IP addresses, to stop brute-force and abuse.
- A security log of sign-ins, failed sign-ins, password resets, two-factor changes and account actions. It stores IP addresses only as keyed hashes, never in plain form.
Licenses and downloads
- Your licenses: plan, status, start and end dates, how you got it, and the Minecraft UUID it’s bound to.
- How often each release was downloaded.
Saved setups
- Menu setups you choose to save to your account.
Emails
- The emails we send you (verification, password reset, security notices, license changes, and the news you opted in to). Our email provider also keeps delivery records.
What stays in your browser
- The menu demo saves your changes in your browser’s local storage, so they survive a reload. They reach us only if you choose to save a setup to your account.
- Your dismissed announcements and the site color you picked also stay in your browser.
Anonymous statistics
- Counts such as how often the menu demo is opened and which sections and styles are viewed. These are anonymous totals with no personal data.
- Cloudflare Web Analytics, which doesn’t use cookies and doesn’t track you across sites.
Why we use it, and on what legal basis
- To provide your account, licenses, downloads and support. This is necessary to perform our contract with you (GDPR Art. 6(1)(b)).
- To keep the service and accounts secure: sessions, rate limits, the security log, bot protection, and spotting shared licenses. This is our legitimate interest in protecting the service and our users (Art. 6(1)(f)).
- To improve the website, using anonymous statistics. This is our legitimate interest (Art. 6(1)(f)).
- To email you when purchases open, or with product news, only if you asked for it. This is your consent (Art. 6(1)(a)), which you can withdraw at any time in your panel settings.
- To meet legal obligations, such as keeping tax records once purchases open (Art. 6(1)©).
Cookies
We use one cookie: the session cookie that keeps you signed in. It’s strictly necessary, so it doesn’t need consent, and it’s set only when you sign in. It’s marked HttpOnly, Secure and SameSite=Lax. We don’t use advertising or tracking cookies, so there’s no cookie banner.
Who processes your data for us
- Cloudflare, Inc.: hosting, database, file storage, bot protection (Turnstile) and cookieless web analytics.
- Resend: sending our emails.
- Mojang (Microsoft): our server uses Mojang’s public API to look up Minecraft names, UUIDs and skins.
- Discord: only if you choose to sign in with Discord, when that’s available.
These providers process data only as needed to provide their service to us. We don’t sell your data, and we don’t share it for advertising.
International transfers
Some providers process data outside the European Economic Area, including in the United States. We rely on the EU–US Data Privacy Framework where a provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses.
How long we keep it
- Your account and its data: while your account exists. When you delete your account, we delete your personal data and your Minecraft link. We keep license records and security-log entries in anonymized form, so they can’t be linked back to you.
- IP addresses in sessions and rate limits: at most 30 days. A daily job clears older ones.
- The security log: 12 months.
- Mojang lookups: cached for up to 10 minutes (names) and 1 day (profiles and skins).
- Records we must keep by law, such as invoices once purchases open: for the period the law requires.
Your rights
You have the right to:
- access your data, and get a copy of it;
- correct it;
- delete it;
- restrict how we use it;
- receive it in a portable format;
- object to uses based on our legitimate interests;
- withdraw consent at any time, without affecting what we did before.
Your panel has Export my data, which downloads your data as JSON, and Delete account. For anything else, write to CONTACT_EMAIL; we reply within one month.
You can also complain to a data protection authority. In Poland, that’s the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland. You can also complain to the authority where you live.
Security
Passwords are hashed and data is encrypted in transit. Two-factor sign-in is available to everyone and required for the site’s owners. IP addresses in logs are keyed hashes, and every administrative action is logged.
Children
You must be at least 16 years old, or have a parent’s or guardian’s permission, to create an account.
Automated decisions
We don’t make decisions about you based solely on automated processing. Signals such as a possibly shared license are only flagged for a person to review.
Changes
If we change this policy in a way that matters, we’ll tell you by email or on the website. The date at the top shows the latest version.