Privacy Policy

1. Who is responsible for your data

The controller of your personal data is the operator of MineRanks (“MineRanks”, “we” or “us”), based in Spain. You can contact us about any privacy matter at [email protected].

This policy applies to the mineranks.com website and to the emails we send in connection with it. It does not apply to the Minecraft servers listed on MineRanks or to third-party websites linked from it, which have their own policies.

2. When you browse the website

You can use MineRanks without an account. We do not use analytics or advertising tools that track you, and we do not build profiles of visitors.

When you visit the website, your browser sends the technical information needed to deliver the pages, such as your IP address, your browser and device type (user agent), the page requested and the date and time of access. This information is processed by our servers and by Cloudflare and is used temporarily for security purposes, to limit abusive requests, to prevent attacks and to diagnose errors.

Your language, your theme (light or dark mode) and the fact that you have already seen the cookie notice are stored in your browser so that we can remember them (see section 13).

On some pages, such as store statistics, images of Minecraft players’ heads are loaded directly from a public third-party avatar service. When this happens, your browser connects to that service, which receives your IP address and the usual technical data of any web request.

3. If you create an account

If you register with email, we process your email address, the display name you choose, your password (stored only as a secure hash, so we cannot see it), whether you registered as a player or as a server owner, your acceptance of the Terms of Service and this Privacy Policy, and whether you have confirmed your email address.

The sign-up form uses Cloudflare Turnstile, which analyses technical signals from your browser and connection (such as your IP address and browser characteristics) to tell people and bots apart and protect the form against automated registrations.

If you sign in with Google, Google shares with us your name, email address, profile picture and Google account ID. We never receive your Google password. You can revoke MineRanks’ access from your Google account settings; this does not delete your MineRanks account, which you can ask us to delete at any time.

We send you the emails you need to use your account, such as the link to confirm your email address (valid for 24 hours) and password reset links (valid for 1 hour), through a transactional email provider. We do not send newsletters or advertising.

When you sign in, we create a session identified by the mr_session cookie, which keeps you signed in for up to 30 days or until you sign out.

4. Servers you add and messages you send us

When you add a server, we store the address you provide and the public information we obtain from it. We may also record which account submitted it, in order to manage the submission and prevent abuse.

When you write to [email protected], we process your email address, your name if you include it, the content of your message and any attachments, in order to reply and handle your request (for example, correcting or removing a listing, or exercising your rights). We may ask you for additional information to verify that you control a server or that you are the holder of an account.

5. Data about public servers and players

Most of the information shown on MineRanks describes Minecraft servers, not people: player counts, records, version, MOTD, icon, banners and statistics derived from public technical data (DNS records, IP addresses and the network or ASN they belong to, and the servers’ status responses), as well as historical data from third-party public sources. Player counts are aggregate figures: we use them to produce statistics about servers, not about individual players.

In some cases this information may relate to an identifiable person, for example when a server is hosted on a home connection or its name or address includes someone’s name. In those cases we process it on the basis of our legitimate interest in offering public statistics about the Minecraft server ecosystem, limited to what the server itself makes public. If this affects you, you can object or ask us to remove the information by writing to [email protected].

For some servers, we also record the information that the server itself makes public about purchases in its store (for example, lists or announcements of recent purchases), which may include the buyer’s Minecraft username, the product purchased and the date and time of the purchase, in order to produce sales statistics, a feature reserved for the future Pro plan. We treat Minecraft usernames as personal data even though they are pseudonymous, and we do not try to find out who is behind them. If you are a player and do not want your username to appear in these statistics, write to [email protected] and we will remove it.

6. Purposes and legal bases

We only process personal data for the following purposes and on the following legal bases:

•To provide your account and the features you use (sign-in, adding servers and account emails): performance of the contract formed when you accept the Terms of Service (Article 6(1)(b) GDPR).

•To keep MineRanks secure (anti-bot checks, rate limiting, prevention of fraud, abuse and attacks, and security logs): our legitimate interest in protecting the service and its users (Article 6(1)(f) GDPR).

•To collect and publish statistics about public servers, including the store statistics described in section 5: our legitimate interest in offering public information about Minecraft servers, limited to data that is already public (Article 6(1)(f) GDPR).

•To reply to your messages and handle your requests: our legitimate interest in responding to you and, where applicable, the performance of the contract or compliance with a legal obligation.

•To remember your preferences (language, theme and cookie notice): our legitimate interest in showing you the website the way you have set it up (Article 6(1)(f) GDPR).

•To comply with legal obligations and respond to requests from competent authorities: compliance with a legal obligation (Article 6(1)(c) GDPR).

If in the future we use non-essential cookies, analytics or advertising, or send commercial communications, we will only do so with your consent where the law requires it (Article 6(1)(a) GDPR), and you will be able to withdraw it at any time.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Automatic checks, such as hiding listings that report more than 100,000 players until they are verified, apply to servers and are reviewed by a person.

7. Who we share data with

We do not sell your personal data or share it for advertising purposes. We only share it with:

•Service providers that act on our behalf (processors), under contracts that require them to protect it: Cloudflare, for content delivery, security, DNS, anti-bot protection and forwarding the emails sent to [email protected]; a transactional email provider, to send account emails; a cloud hosting provider, where the website and the database run; and the email service we use to receive and answer your messages.

•Google, only if you choose to sign in with Google; in that case Google processes your data in accordance with its own privacy policy.

•The public avatar service mentioned in section 2, to which your browser connects directly on some pages.

•Public authorities, judges and courts, when we are legally required to disclose data or when it is necessary to establish, exercise or defend legal claims.

Server listings and statistics are public. We never publish your email address.

Within MineRanks, access to personal data is limited to the team members who need it to operate and moderate the service.

8. International transfers

Some of our providers, such as Cloudflare and Google, may process data outside the European Economic Area, for example in the United States. In those cases, transfers are covered by the safeguards provided for in the GDPR, such as adequacy decisions of the European Commission (including the EU–U.S. Data Privacy Framework, for certified companies) or the standard contractual clauses approved by the Commission. You can ask us for more information at [email protected].

9. How long we keep data

•Account data: for as long as your account exists. When you delete it, we delete or anonymise your data within a reasonable period, except for data we must keep, blocked, to comply with legal obligations or to deal with possible claims, and only for the applicable limitation periods.

•Links to confirm your email address expire after 24 hours, and password reset links after 1 hour.

•Session: up to 30 days, or until you sign out.

•Technical data and security logs: for a short period, only as long as necessary for the purposes described, unless we need them to investigate a specific incident.

•Messages sent to [email protected]: for as long as necessary to handle your request and any follow-up.

•Statistics about public servers: they may be kept indefinitely, as they form the historical record that the service offers. Any personal data they may include (such as usernames in store statistics) is deleted when you ask us to remove it or when it is no longer needed.

Servers you have added may remain listed after you delete your account, because the listing describes a public server rather than you.

10. Your rights

You can exercise the following rights at any time, free of charge:

•Access: to find out whether we process your data and obtain a copy of it.

•Rectification: to correct inaccurate or incomplete data.

•Erasure: to have your data deleted, for example when it is no longer needed or you withdraw your consent.

•Restriction: to have processing restricted in certain cases, for example while we check the accuracy of data you have contested.

•Objection: to object, on grounds relating to your particular situation, to processing based on our legitimate interest.

•Portability: to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller where technically feasible.

•Withdrawal of consent: where processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of the processing carried out before.

To exercise them, write to [email protected], preferably from the email address associated with your account, stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for additional information. We will reply within one month, which may be extended by two further months for complex or numerous requests; in that case we will let you know.

If you believe that we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with the supervisory authority of the EU country where you live or work. We would appreciate it if you contacted us first so that we can try to resolve it.

11. Minors

You must be at least 14 years old to create an account. Children under 14 may only do so with the consent of their parents or legal guardians. If we learn that an account belongs to someone under 14 without that consent, we will delete it. If you are a parent or guardian and believe that your child has given us data without your consent, contact us at [email protected].

12. Security

We apply technical and organisational measures appropriate to the risk to protect your data: HTTPS-encrypted connections, passwords stored only as secure hashes, confirmation and reset links that expire, protection against bots and attacks through Cloudflare, and access to data limited to the people who need it.

No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify the AEPD and, where the risk is high, the affected users as well, as required by law.

You can help too: use a strong password that you do not use anywhere else, protect access to your email account and sign out on shared devices.

13. Cookies and similar technologies

Cookies are small files that a website stores in your browser; local storage is a similar browser feature. MineRanks only uses the cookies and local storage that are necessary for the website to work or to remember the choices you make, and does not use analytics, advertising or social media tracking cookies. These are the ones we use:

•mr_session: keeps you signed in. Strictly necessary. Up to 30 days or until you sign out.

•lang: remembers the language you have chosen. 1 year.

•theme: remembers whether you prefer light or dark mode. 1 year.

•cookie_notice: remembers that you have already seen the cookie notice. 1 year.

•Cloudflare security cookies (for example, cf_clearance or those used by Turnstile): help detect bots and protect the website against attacks. Strictly necessary. Their duration is set by Cloudflare and is usually short.

Under Article 22(2) of the LSSI, these cookies do not require your consent because they are strictly necessary to provide the service or store preferences you have chosen yourself; that is why we show an informative notice rather than asking for consent.

If you use Google Sign-In, Google may use its own cookies when you interact with its sign-in button or window, in accordance with its own policy.

You can delete or block cookies and local storage in your browser settings at any time. If you block the strictly necessary ones, some features, such as signing in, may stop working.

If we decide to use analytics or advertising in the future, we will update this policy and put a consent mechanism in place before using any cookie that requires it.

14. Changes to this policy and contact

We may update this policy to reflect changes in the service or in the law. We will publish the new version on this page with its update date and, if the changes are significant, we will let registered users know by email or through a notice on the website.

For any question about this policy or about your data, write to [email protected].