Privacy Policy
Last updated: 29 August 2026
The short version
We store an email address so you can have an account, the Minecraft username and UUID you choose to link, and the order-book pages the mod uploads. We do not store your IP address. We do not use third-party analytics, we do not use advertising cookies, and we do not sell anything to anybody.
What we collect, and why
| Data | Why | Basis |
|---|---|---|
| Email address | To identify your account, confirm it is yours, and let you recover it | Contract |
| Password hash or passkey public key | To sign you in. We never hold your password or your passkey's private key | Contract |
| Minecraft username and UUID you link | To credit uploads to your profile | Contract |
| Order-book pages uploaded by the mod | To build the shared price data the site exists for | Legitimate interests |
| Session records (created, last used, a label you can read) | So you can see what is signed in and end it | Legitimate interests (security) |
| Charts you create | To show them to you, and to others if you publish them | Contract |
What we deliberately do not collect
- Your IP address. The server discards it and never writes it down. This is a design constraint in the code, not a policy we could quietly change without changing the software.
- Your Minecraft access token. The mod never reads it. You can verify this: the published jar contains no reference to the method that returns it.
- Your coordinates, chat, player list, inventory, mod list, or world seed. The mod reads the order-book screens you open and nothing else.
- Anything from third-party analytics, because we do not use any.
Cookies
One cookie, named __Host-kutils_session. It keeps you signed in and nothing else. It is strictly necessary, which is why there is no consent banner on this site: under the ePrivacy rules, a banner is required for cookies that are not. If we ever add anything that is not strictly necessary, you will be asked first.
How long we keep things
- Account data: until you delete your account.
- Price history: 90 days at full resolution, then archived.
- Raw uploads: kept so a parsing bug can be corrected by re-reading them rather than by losing the data.
- Sessions: 30 days maximum, or 14 days idle, whichever comes first.
Your rights
If you are in the UK or EU, the GDPR gives you rights of access, rectification, erasure, portability, restriction and objection. We have built the first and third into the site rather than making you ask:
- Access and portability: Account → Export my data returns everything we hold about you as JSON.
- Erasure: Account → Delete my account. This removes your email, credentials, settings and passkeys. A stripped record is retained solely to stop a banned Minecraft account being silently re-registered by someone else; it contains no information that identifies you.
- For anything else, write to the contact address below.
You may also complain to your data protection authority; in the UK, that is the ICO.
Children
This service is not for under-13s and we do not knowingly collect anything from them. If you believe a child has created an account, tell us and we will remove it.
Who we are, and where the data goes
This service is run by an individual in the United States, not a company. Write to the address below to reach us.
The site runs on Cloudflare, whose network processes data in many countries, and transactional email, when configured, goes through an email provider. Those are our only two processors. We do not sell your data, share it for advertising, or transfer it to anyone else.
If you are in the UK or EU, your data will be processed in the United States. We rely on your consent and on the necessity of the transfer to provide a service you asked for.
If something goes wrong
If a breach affects your personal information we will notify you and the relevant authorities without unreasonable delay, as the breach-notification law that applies to us requires, and as the GDPR requires where it applies to you.
Contact
contact@donutmeta.com