Data Privacy Policy

Last updated: 1 November 2026

1. Data Controller

Borna Smital (sole proprietorship)

operating as ManasMods

Lütticher Straße 155, 52074 Aachen, Germany

This privacy policy explains how personal data is processed in connection with this website and related services (Tebex, Patreon, Discord, YouTube, Twitch).

2. General Information

This website is used exclusively for the presentation of ManasMods.

Personal data processed in connection with payments, purchases, or communication are handled through external third-party providers that are subject to the GDPR.

Personal data processed in connection with our Minecraft servers, in particular the data described in sections 4.4, 4.7, 4.9, 4.11, and 4.12, are processed on our own server infrastructure.

3. Data Processing by Third Parties

Tebex Ltd.

All purchases, donations, and payments related to our Minecraft servers are processed through Tebex Ltd. ManasMods does not process payment data directly.

Legal basis: Contract performance in accordance with Art. 6(1)(b) GDPR

Data transfers: governed by Standard Contractual Clauses (SCCs)

Data processed: name, email address, IP address, in-game username, transaction amount

Patreon Inc.

Memberships and support payments are handled through Patreon Inc. Patreon acts as an independent data controller under the GDPR.

Legal basis: Contract performance in accordance with Art. 6(1)(b) GDPR

Agreement: Patreon Creator Privacy Promise (DPA)

Data processed: username, email address, membership tier, shipping address (if applicable)

Discord roles tied to Patreon memberships are assigned through Patreon's official Discord integration, which operates under Patreon's own terms.

PayPal Europe S.à r.l.

Payments to contractors are processed via PayPal, which acts as an independent data controller under the GDPR. Data processing is carried out in accordance with PayPal's privacy policy.

Discord, YouTube & Twitch

Community interactions and communication occur via these platforms. They act as independent controllers and process data according to their own privacy policies:

Discord Privacy Policy: https://discord.com/privacy

YouTube Privacy Policy: https://policies.google.com/privacy

Twitch Privacy Policy: https://www.twitch.tv/p/legal/privacy-policy

4. Cookies and Server Log Files

4.1 Technically Necessary Cookies

This website uses only technically necessary cookies that are required for proper operation and functionality. These include, for example:

- Session cookies to maintain navigation and security

- Cookies for storing language or display preferences

- Security cookies for protection against misuse (e.g. CSRF protection)

These cookies do not contain personal data that allow direct identification and are generally deleted at the end of the browser session.

Legal basis: Art. 6(1)(f) GDPR in conjunction with § 25(2) TDDDG (legitimate interest in secure and functional operation of the website)

Purpose: ensuring technical functionality, stability, and system security

Retention period: for the duration of the session

4.2 Server-Side Logging (Log Files)

When visiting this website, certain technical information is automatically stored in so-called server log files. The following data may be collected:

- IP address

- Date and time of access

- Accessed pages or files

- Browser type and version

- Operating system used

- Referrer URL (previously visited page)

This information is used exclusively for technical monitoring, security, and troubleshooting. No combination with other data or profiling takes place.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in system security and fault prevention)

Retention period: Log files are rotated daily and deleted from the server after 14 days. Copies in server backups are kept for up to one month, as described in section 4.11.

4.3 No Analytics or Marketing Cookies

No analytics, audience-measurement, or marketing cookies are used. Third-party tools for user analytics or advertising, such as Google Analytics or Meta Pixel, are not implemented. No profiling for advertising or analytics purposes takes place. This does not affect the use of Google reCAPTCHA described in section 4.6, which serves solely to protect the contact form against automated abuse.

4.4 Server Data and In-Game Logs

When connecting to our Minecraft servers, certain data are automatically processed for technical operation, security, and moderation purposes. The following data may be collected:

- Minecraft username and UUID

- IP address and connection timestamps

- Chat messages and in-game interactions (for moderation and anti-cheat purposes, and for relay to Discord as described in section 4.12)

- Playtime, statistics, inventory data, and progression

Purpose: ensuring server functionality, preventing abuse, maintaining fairness, and enforcing community rules.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure and fair multiplayer network).

Retention period: technical log data are automatically deleted or anonymized after a maximum of 90 days. By way of exception, the longer retention periods stated in section 4.7 apply to the alt-account detection system (ManasIP) described there. Disciplinary records (e.g., suspensions or bans) may be retained longer if necessary for the investigation of abuse cases.

Recipients: server hosting partners LilyPad (United Kingdom) and Hetzner (Germany). Both process data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

4.5 Contact Form

If you contact us via the contact form provided on this website, the data you enter will be processed. This includes in particular:

- Name

- Email address

- Message content

- Any files submitted (attachments)

The data is processed solely for the purpose of handling your request and any necessary follow-up communication.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

The data will not be shared with third parties unless this is necessary to process your request.

Storage: The data is stored either on the server of this website or within the associated email system.

Retention period: The data will be deleted within 60 days after your request has been fully processed, unless statutory retention obligations require longer storage.

4.6 Google reCAPTCHA

To protect the contact form (4.5) against automated submissions and spam, we use Google reCAPTCHA. For users in the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Data processed: reCAPTCHA evaluates various technical and behavioural signals in order to distinguish automated access from human users. These may include: IP address, browser, device and operating system information, screen resolution, time spent on the page, and mouse, keyboard, and touch movements. Cookies or comparable technologies may be set on or read from your device in this process.

Purpose: protection against abuse, automated requests, and spam.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting our systems against abusive automated use).

International transfers: Data may be transferred to Google LLC in the United States. Such transfers take place on the basis of Standard Contractual Clauses pursuant to Art. 46 GDPR.

Further information is available in Google's privacy policy at https://policies.google.com/privacy.

4.7 ManasIP - Alt-Account and Ban Evasion Detection

To detect multiple accounts ("alt accounts"), circumvention of bans ("ban evasion"), and other forms of abuse, we operate a purpose-built, purely server-side tool named ManasIP on our Minecraft servers. ManasIP is not installed on player clients; players are not required to download or install anything.

Data processed: When connecting to the server, the following is stored:

- Minecraft username

- Minecraft UUID

- Current and previously used IP addresses

- Timestamp of the first and the most recently recorded login

Purpose: exclusively server security, alt-account checks, and investigation of ban evasion. The data is not used for advertising, analytics, or profiling.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure, fair, and rule-compliant multiplayer network).

Storage: The data is stored locally on the respective server and is not shared with third parties. The only infrastructure recipients are the hosting partners named in section 4.4.

Access restrictions and permission tiers:

Access is tiered and limited to the minimum required in each case:

- Viewing stored IP addresses: only individuals with access to server files (currently approximately eight people).

- Comparison function (manasip.compare): authorised moderators and administrators (currently approximately ten people) can check two players against each other. No IP address is displayed, only whether a match exists.

- Single lookup (manasip.check): displays a player's most recently stored IP address. This requires a separate, more narrowly granted permission.

Regular players and unauthorised team members have no access.

Logging of every query: Every use of the comparison or lookup function requires a mandatory reason to be entered. Every successful query is logged. The log records the timestamp, the team member performing the action, the type of action, the affected players, the result, and the stated reason. The IP address itself is not written to the log.

Retention:

- Player records are deleted once the last login is more than six months in the past.

- The query log is retained for 6 months and deleted thereafter.

Your rights: The rights listed in section 8 apply, in particular the right of access (Art. 15 GDPR), erasure (Art. 17 GDPR), and the right to object under Art. 21 GDPR, as this processing rests on legitimate interest. Please direct requests to privacy@manasmods.com or via the main Discord server's support tickets.

4.8 Processing via Email Services

Data submitted through the contact form is typically forwarded to and processed within an email inbox. For this purpose, Microsoft (e.g. Microsoft 365 / Outlook) is used as a data processor. Processing is carried out solely on our behalf and on the basis of a data processing agreement in accordance with Art. 28 GDPR. Data may also be processed in third countries (e.g. the United States). In such cases, data transfers are based on Standard Contractual Clauses pursuant to Art. 46 GDPR.

4.9 ManasCosmetics and Cosmetic Content Data

ManasCosmetics is a cosmetic content system used on Minecraft servers. How cosmetic data are handled depends on how and where the software is run:

On our own Minecraft servers: When you use cosmetic features on servers operated by ManasMods, the following data are processed for functionality:

- Minecraft UUID (to associate cosmetics with your account)

- Equipped cosmetic items and active cosmetic slots

- Saved cosmetic presets and loadout configurations

- Cosmetic entitlement records (which cosmetics you have unlocked or purchased)

Purpose: providing, rendering, and synchronizing cosmetic content; saving cosmetic configurations; and verifying entitlement to purchased or restricted items.

Legal basis: Art. 6(1)(f) GDPR for freely available cosmetic functionality, and Art. 6(1)(b) GDPR for content linked to a purchase.

Storage: Cosmetic data on our servers are stored locally within the respective server instance. These data are not transmitted to ManasMods as a separate recipient and are not centrally collected, aggregated, or used for any purpose beyond operating the cosmetic features on that server.

Important: software used on third-party servers. Where the ManasCosmetics software is installed and operated by independent third parties on their own Minecraft servers, those server operators determine independently how cosmetic data are stored and processed (for example, locally or in a database of their own choosing). In those cases, the respective server operator is the data controller for any such processing. ManasMods does not receive, collect, or have access to cosmetic data from third-party servers and is not responsible for the data processing carried out by independent operators.

Retention period: On our servers, cosmetic configuration and entitlement data are retained while your account remains active on our network. Purchase-linked records required for accounting are retained per the statutory periods in Section 9.

4.10 Website Hosting and Site Builder (GoDaddy)

This website is operated on GoDaddy infrastructure and built using the GoDaddy Website Builder. GoDaddy provides the web space, page delivery, the technically necessary cookies described in 4.1, and the server log files described in 4.2, and acts as a data processor on our behalf in this respect.

Data processed: in particular IP address, time of access, pages accessed, browser type and version, operating system, referrer URL, and the information submitted through the contact form (4.5), which initially passes through GoDaddy's systems before being forwarded to our email inbox (4.8).

Purpose: technical operation, delivery, and security of the website.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable and secure web presence).

Basis of processing: data processing agreement pursuant to Art. 28 GDPR (GoDaddy Data Processing Addendum).

International transfers: As GoDaddy.com, LLC is established in the United States, personal data is transferred to a third country. GoDaddy.com, LLC is certified under the EU-U.S. Data Privacy Framework. Transfers therefore take place on the basis of the European Commission's adequacy decision pursuant to Art. 45 GDPR. Where a transfer does not take place under the Data Privacy Framework in an individual case, GoDaddy additionally relies on Standard Contractual Clauses pursuant to Art. 46 GDPR.

Processor: GoDaddy.com, LLC, 100 S. Mill Ave, Suite 1600, Tempe, AZ 85281, USA, legal@godaddy.com

4.11 ManasWiki Accounts

Testers and community members can create an account for the ManasWiki, our mod documentation website, by using a command on our Discord server. You then log in with your nickname. We do not collect an email address for this purpose.

Access to an account depends on your Discord role. Every 10 minutes, our bot checks whether you still hold the role. If you no longer hold it, your wiki account is deleted at that check.

Data stored in the wiki database:

- Account: username, role on the wiki, account creation date, edit count, and password stored as a bcrypt hash with cost factor 12

- For accounts created through the Discord command: your Discord user ID and the ID of the Discord server on which the command was used

- Edits: username, date and time of each edit, edit summary, and a copy of the page as it was after the edit

- Admin log: account creation, account deletion, and role changes. For accounts created through Discord, this also includes your Discord username and Discord user ID.

Data not stored in the wiki database: IP addresses and login history.

Web server logs: Access and error logs record IP addresses, the pages you request, and your browser type. They are rotated daily and deleted from the server after 14 days.

Purpose: providing your account and access to the wiki, checking that you still hold the required Discord role, protecting accounts from misuse, and keeping an accurate record of edits and administrative actions.

Legal basis: Art. 6(1)(b) GDPR (performance of the account relationship you requested) and Art. 6(1)(f) GDPR (security and integrity of the wiki, and the record of edits and administrative actions).

Deletion of the account record occurs in any of these cases:

- The required Discord role is removed. This takes effect at the next check, which runs every 10 minutes.

- You request deletion (see section 8).

What remains after deletion:

- Your account record is removed.

- Your edits remain on the wiki and are displayed under your nickname.

- Admin log entries about your account are deleted with it.

Backups: The account record is removed from the live database immediately. Copies in ManasWiki database backups are kept for up to 90 days and then deleted. Copies in server backups, which include the web server logs, are kept for up to one month and then deleted.

Storage: The account database runs on our own server infrastructure at Hetzner (Germany), see 4.4.

Recipients: Hetzner, as hosting provider under a data processing agreement pursuant to Art. 28 GDPR. Discord, which receives role-check requests and is an independent controller for its platform (see section 3).

4.12 Discord Chat Relay and Online Status

Our Minecraft servers are connected to a Discord channel by a bot that we operate. The bot relays messages from in-game chat into that channel, relays messages from the channel into the game, and shows which players are currently online.

The channel is available to members of our Discord server who hold the role for it, including Patreon supporters with the relevant access. Roles are assigned through Discord.

Data processed:

- Minecraft username and UUID

- Chat messages sent in-game or in the channel, with timestamps

- Online status (whether a player is connected) and join and leave times

- Discord user ID and display name for messages sent from Discord

Purpose: connecting players with Discord community members and showing server activity.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a connected community chat). We have weighed this interest against your interests, and you can object at any time under Art. 21 GDPR (see section 8).

Not processed by the bot: Patreon membership data or membership tiers. See section 3 for how Patreon roles are assigned.

Minimum age: 16. Users under 16 may not use the channel.

Retention: Messages in the channel are deleted at least every three months. Bot logs are kept for 90 days.

Hosting: The bot runs on our infrastructure at Hetzner, see 4.4.

Discord: Discord is an independent controller for the Discord platform, see section 3. Discord may keep copies of messages in accordance with its own privacy policy.

Please do not share personal data about other people in the chat.

5. Contractors and Team Members

Personal data such as name, Discord tag, PayPal address, and billing information are processed for the administration of staff and contracted work.

Legal basis: contract performance (Art. 6(1)(b) GDPR) and legal recordkeeping obligations (Art. 6(1)(c) GDPR)

Storage: data are stored in Google Drive (Ireland) with encryption and two-factor authentication, under a data processing agreement with Google pursuant to Art. 28 GDPR.

Retention: 10 years in accordance with § 147 AO and § 257 HGB.

6. International Data Transfers

Services such as Patreon, PayPal, and Discord may process data outside the EU (e.g., in the United States or the United Kingdom). These transfers are carried out only under recognized safeguards, particularly Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.

7. Data Security

All accounts (Google, Patreon, Tebex, Discord) are protected by two-factor authentication (2FA). Access to personal data is restricted to Borna Smital and a narrowly limited group of expressly authorised team members, who are granted access rights only to the extent required and only for their specific area of responsibility. Access to particularly sensitive data, in particular IP addresses within the alt-account detection described in section 4.7, is logged. Data are only shared with third parties on a valid legal basis. This website uses SSL/TLS encryption for secure data transmission.

8. Rights of Data Subjects

Under the GDPR, you have the following rights:

- Access to your stored data (Art. 15)

- Rectification of incorrect data (Art. 16)

- Erasure ("right to be forgotten", Art. 17)

- Restriction of processing (Art. 18)

- Data portability (Art. 20)

- Objection to processing (Art. 21)

- Withdrawal of consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal (Art. 7(3))

You also have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law (Art. 77 GDPR).

Supervisory Authority:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)

P.O. Box 20 04 44

40102 Düsseldorf

Website: https://www.ldi.nrw.de

To exercise your rights, please contact: privacy@manasmods.com

9. Retention Periods

Business and payment records are retained in accordance with legal requirements for up to 10 years and are then deleted or anonymized.

10. Changes to This Privacy Policy

This privacy policy may be updated in response to legal, organizational, or technical changes. The most current version is always available on this website.

Last updated: 1 November 2026

Data Privacy Policy

Diese Website verwendet Cookies.