Privacy notice

Who and what

This notice covers Trapping Client's online features (parties, shared waypoints, party chat, the trap kill leaderboard, cloud profiles) and this website. They are run by trapping.xyz. We don't sell data, show ads or use trackers. The terms of service cover the rules.

What we keep, and for how long

• Your Minecraft: uuid, name, when the client first and last signed in, and its version. Kept while you use the client. The leaderboard and your player page show your name.
• Sign-ins: a hash of the client's 24-hour token, deleted when it expires. Website sessions last 30 days. Website login codes are deleted after a day.
• Where you play: which server you are on (trapping.xyz, hoplite.gg and so on) and whether private mode is on. Held in memory only, gone 90 seconds after the client stops reporting it, and forgotten after a restart.
• Parties: members, invites and shared waypoints (name, colour, coordinates, dimension). Invites expire after 2 minutes, waypoints after an hour, a party once nobody has used it for 2 hours.
• Party chat: the last 50 lines of each party, in memory only, never written to disk.
• Trap kills: killer, victim, server, cause and time, and for kills the client reports, the death message it saw. Kept for the leaderboard.
• Cloud profiles: the mod settings you upload, until you delete them.
• Terms: which version of the terms was in force when your client first signed in, and when.
• Abuse records: bans with their reason, which account's ban an alt ban came from, and automatic flags when an account looks like it is collecting data (many players looked up at once, many server changes in an hour, a client that fails our release check). Flags are deleted after 90 days, bans 90 days after they end.
• IP addresses: never stored as they are. We keep a keyed hash of the address with kill reports, website logins and mod downloads, to limit abuse and count downloads. When the client signs in, we keep a keyed hash of its network (the IPv4 address, or the first half of an IPv6 one) for 30 days after its last sign-in from there. A banned player who signs in on another account from the same network gets the same ban, as an alt; we lift it when it turns out to be someone else. Rate limits hold the address in memory for up to 20 minutes. Server logs record the request path, not the address, and roll over after 30 MB.

Why

We use this data to run the features you turn on, and to keep the service from being abused: rate limits, bans and release checks. Under the GDPR that is our legitimate interest in providing and protecting the service, and for the features themselves, what you asked for by using them. Player heads on this website are loaded from mc-heads.net, which sees your IP address when your browser loads them.

Who sees it

• Your party sees your name, your waypoints, your chat lines and which server you are on.
• Other client users on your server can find you to invite you, unless private mode is on.
• Everyone sees the leaderboard and player pages.
• Mojang's session server confirms your account when you sign in.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it or delete it, or object to how we use it. You can also complain to your data protection authority. In the client, private mode keeps you out of other players' lookups, and deleting a cloud profile removes it at once. For anything else, ask in the trapping.xyz Discord and we will prove the account is yours with a code the client shows you, the same way website login works.

Changes

When this notice changes, the version at the top changes.