Refract SMPPrivacy policy
This policy covers the Refract SMP website at refract-smp.com, the Minecraft server and the Discord server. It lists what data is collected, why, who receives it, and how to get it removed. The server sells nothing and runs no advertising, so none of this data is sold or used for ads.
Who runs this
Refract SMP is run by its Owner and volunteer staff. For any privacy question or request, email owner@refract-smp.com, or contact an Admin in the Discord at discord.gg/KRrKVEdMFy by ticket or direct message.
Data collected
| Data | Source | Purpose |
|---|---|---|
| Discord user ID, username, display name, avatar link | Sign in with Discord on this site. The only permission requested is identify. | Attach staff applications to your account and show who is signed in. |
| Staff application: Minecraft username, your answers, weekly hours | The application form or the /apply command | Review your application. Posted to a private staff channel in Discord. |
| Linked Minecraft username and UUID | DiscordSRV, when you run /discord link | Account linking, election eligibility, moderation. |
| IP address, username, UUID, join and leave times, chat, commands, in-game actions | The Minecraft server | Run the server, enforce the rules, investigate griefing and ban evasion. |
| Discord messages, roles, join date | The Discord server | Community moderation. Stored by Discord, and quoted by staff in moderation logs where needed. |
| Election candidacy and ballots | Discord and the election bot | Run Head Admin elections. Ballots are anonymous and cannot be changed. |
| Vote and playtime counts | Voting sites and the server | Give rewards. |
| IP address and request headers | Cloudflare, which serves this site | Deliver the site and block abuse. Held in Cloudflare's logs. |
We do not ask for your real name, email address, phone number, date of birth or payment details, and the server takes no payments.
Cookies
The site sets two cookies, both HttpOnly, Secure and SameSite=Lax. Neither tracks you across sites.
- oauth_state is a random value that makes the Discord sign-in safe from forgery. It lasts 10 minutes and is cleared when sign-in finishes.
- sid is a random session ID that keeps you signed in. It lasts 7 days or until you sign out. The matching session record holds your Discord ID, name, username and avatar link, and is deleted at expiry or on sign out.
The site runs no analytics, advertising or tracking scripts. You only send data to Discord through this site if you press the sign-in button.
What the site shows publicly
- The Head Admin's Discord display name and avatar, and the names and avatars of staff in the public admin log.
- The latest messages from the public #general channel, with each author's display name and avatar. These messages are already public in Discord. When one is deleted there, it leaves the site on the next refresh.
- Counts of Discord members, linked accounts and staff.
Staff applications, ballots, IP addresses and moderation records are not shown on the site.
Third parties
- Discord receives your sign-in and hosts the Discord server, under the Discord Privacy Policy.
- Cloudflare hosts this site and a key-value store that holds sessions, rate-limit markers and cached server status.
- Google Fonts serves the fonts on this site. Your browser requests them from Google, which receives your IP address.
- Mojang and Microsoft authenticate Minecraft accounts and hold your account data under their own policies.
- Voting sites receive whatever you give them, under their own policies. We receive your Minecraft username and the fact that you voted.
- The hosting provider runs the Minecraft server and the bot that connects it to this site.
We do not sell or rent your data. We share it only with the services above, or when a lawful request from authorities requires it.
Retention
- Site session record: up to 7 days, or until you sign out.
- Application rate-limit marker: 5 minutes.
- Staff applications: kept in the staff channel during review and while you serve as staff. Staff can delete them after a decision.
- Minecraft logs, including IP addresses and chat: kept while needed for moderation. Ban records stay as long as the ban is in force.
- Admin log entries: kept permanently, because the log is public and staff cannot edit it.
Your choices
You can email owner@refract-smp.com or ask an Admin to show you the data we hold about you, correct it, or delete it. We answer within 30 days. Some data stays while it is needed to enforce an active ban, to keep the admin log intact, or to meet a legal duty. We tell you which, and why.
You can also sign out in the staff section of the home page, remove this site's access in your Discord settings under Authorized Apps, and unlink your Minecraft account with /discord unlink.
Security
Session IDs are random 256-bit values in HttpOnly cookies, the site is served over HTTPS only, and the connection between this site and the bot uses a secret token. Only Admins and the Owner can read staff channels and server logs. No system is perfectly secure. If we learn of a breach that affects your data, we announce it in the Discord.
Children
Discord requires users to be at least 13, or the minimum age in their country if higher, and Minecraft accounts carry their own age rules. We do not knowingly collect data from anyone below those ages. If you think a younger person is using the server, tell an Admin and we will remove their data and account.
Changes
We update this page when the data we collect changes, and the date at the top changes with it. Material changes are announced in the Discord.