Privacy policy個人

Version of 02 Nov 2026.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

For anything about your data, write to the email address above.

2. The short version

• We store your Minecraft name, a scrambled form of your password and what you do on the site (medals, requests, contributions).
• We do not store your IP address, your email address, your real name or anything about your Discord account.
• There is no tracking, no analytics, no advertising and no third-party cookies. Fonts are served by this site itself, not by Google.
• You can download all your data and delete your account yourself, any time, under Me → Settings.

3. What we process and why

Your account

Minecraft name; password, stored only as a one-way scrypt hash that cannot be turned back into the password; nation role, market role (if any) and rank; account status; dates (created, approved, last sign-in, password changed); the date you accepted the rules and terms and confirmed the age question; your sign-up code until your account is approved.

Purpose: to give you an account and the functions of the site. Legal basis: Art. 6(1)(b) GDPR (the terms of use you accept when signing up).

What you do on the site

Requests and contributions you send (text, links, coordinates), nominations and reports, medals and rank changes, tasks and quests you take on (including the steps of questlines: which steps you finished follows from your approved quest completions, so nothing more is stored for them), and messages the site shows you. Your public profile shows only your name, rank, medals and when you became a citizen; requests and contributions are visible to you and to staff (Admins and the Emperor) only.

Purpose: running the nation's medals, ranks, quests and requests. Legal basis: Art. 6(1)(b) GDPR. Reports about another person are processed on the basis of Art. 6(1)(f) GDPR: our legitimate interest in a safe community where the rules are enforced. The person reported is not told who reported them.

Achievements, seasons and the nation’s story

To make the nation feel alive, the site also keeps:

• Your profile choices: the title you show after your name, the three things in your profile showcase, the languages you speak (only if you tick any, at sign-up or later), your Discord name (only if you enter one; you can hide it) and your sound setting. Staff who mark themselves away also store that last day, which only staff see. If you take the nation-history questionnaire, the site keeps only whether you passed and the date of each attempt, never your answers.
• Homes in the Lands: which home you live in (a house or street in a town) and since when, any requests for a home you send (with the short note you write, who answered and why), and your leave mode date if you set one. Who lives in which home is shown to signed-in citizens, because the nation is a village. A town’s mayor or governor, Admins and the Emperor see when a resident is on leave and receive a short heads-up if a resident has not been active for the set number of days (30 unless the Emperor changes it); the heads-up only tells them, nobody is removed because of it. You can move out whenever you like. Map pictures that staff upload are kept in the database and are shown to signed-in citizens only.
• Community features: shops you list (name, what they sell, an optional note and coordinates); polls you vote in — the site remembers that you voted, so you cannot vote twice, but it keeps the counts per choice separately and nothing connects you to your choice. Results are live, so in a very small poll a result can still show how few people chose something. Suggestion-box ideas you write (plain text) and the upvotes you give; resource-drive deliveries (a request with an amount and one proof link); apprenticeships you take part in as master or apprentice (craft, skills ticked, the staff decision); and the clan you belong to, with the invitations you received. All of this is shown to signed-in citizens only.
• Plans and “Needs a hand”: the up to three quests, bounties or events you pin under “My plans” (only you and the Hub page you see show them) and, on the “Needs a hand” board, the short plain-text requests you post (shown with your name to signed-in citizens, taken down by themselves after seven days and deleted a month after that). A “Looking for group” post is the same kind of request with a number of places (1 to 20) and, if you give one, a start time; it comes down by itself at that time, or after 24 hours without one, and is kept and deleted in the same way. Pressing “I’m in” counts as offering to help, the fact that you offered to help with a request (the person who asked sees your name; others only see a number) and the reports you make about other posts (never shown to the person reported). Staff only see who posted a request that was reported. The weekly report, Hall of Fame, nation calendar and anniversaries only combine records described elsewhere in this policy; the Hall of Fame names season winners, the helpers of finished civic works, medal holders and the founders of Prosperity levels to signed-in citizens. Staff may add pictures of the progress of a civic work in the game; they are checked, stripped of hidden data, kept in the database and shown to signed-in citizens only; they show buildings, not people.
• Picture and banner: if you choose them under Me › Settings, the key of a premade emblem, a colour and a banner from the nation’s own set (nothing is uploaded). They are shown on your profile and next to your name in the header to signed-in citizens, deleted with your account and included in the data download.
• Uploaded profile picture: if you upload your own picture under Me › Settings (PNG or JPEG, at most 2 MB and 1024 × 1024 pixels), it is checked and stored without camera data or other hidden information. Staff (Admins and the Emperor) look at it first; until they approve it nobody else sees it, and your emblem or earlier approved picture stays. An approved picture is shown on your profile and next to your name at the top of the pages to signed-in citizens only. A picture that is turned down is deleted at once; only the reason is kept for you to read until you upload again. You can remove your picture at any time and it is deleted at once. A photo can show a person, so please do not upload one of a real face. Your pictures are deleted with your account and included in the data download.
• Newspapers and editors: the Emperor can appoint citizens as editors; that you are an editor (and since when) is shown on your profile. Editors publish newspaper issues under History › Newspapers: a title, a date, a short description and up to twelve pictures (pages) with a short description and caption each. Pictures are stored without hidden data and shown to signed-in citizens only; the editor’s name is shown with the issue. Issues are not checked before they appear, but Admins and the Emperor can hide or remove any of them, and every upload, hiding and removal is recorded in the audit log. Editors must not publish anything that identifies a real-life person. If an editor deletes their account, their issues stay and are shown as by “a former citizen” unless the Emperor removes them; the data download lists the issues you published (titles and dates). The weekly Gazette is written by the site from records described elsewhere in this policy (Chronicle entries that are not hidden, event titles, place and landmark names, and totals such as the number of medals awarded and thank-yous given); it names nobody beyond what the Chronicle already says, and once written it is kept as it was.
• Ministries: which ministries you serve in and your inside rank, requests to join (with the short note you write, who answered and why), tasks you took and finished, and, if you are on the War roster, your PvP tier (set by the Minister of War; you can take yourself off at any time). Ministers and their deputies can post announcements, which show their name. All of this is shown to signed-in citizens.
• Achievements and titles you have unlocked, with the date; season points and milestones per season and Prosperity points you added to the nation, each with the action they came from (for example "bounty claim #12") the district of the town it built and the state or town it helped (the one you named, otherwise your home town; staff can set the place of a quest, an event or a landmark). Civic works and the town picture are worked out from these totals; nothing more is stored about you for them.
• Days active: a count of the days on which you opened the site while signed in, and the date of the last one. Not the times, not the pages, not how long you stayed. Admins and the Emperor can open a read-only list of citizens who have not opened the site for the set number of days (30 unless the Emperor changes it), with their rank, ministries and home town, to say hello; nobody is removed, locked or told because of it, and people on leave mode are listed apart.
• Thanks you give and receive (who, to whom, the short message, when); events you answer (going, maybe, can’t make it) and whether the host recorded you as present; bounty claims with their one proof link.
• Calendar link: the Calendar page shows signed-in citizens one address (the same for everyone) that a phone or computer calendar can subscribe to. It holds a long random code, kept in the site settings; the Emperor can make a new one, and the old one then stops working. Anyone who has the address can read the feed without signing in. The feed holds only the title, time, place name and state (cancelled or not) of the events of the last year and the next ones: no names, no answers, no attendance, no hosts and no coordinates. The site does not store who asks; an address can ask 30 times an hour (counted in memory only, for a short time), and the code never appears in the request log.
• “Save as picture”: on a profile and on an event page, a button makes a picture card from what the page already shows, in your own browser, and saves it on your device. Nothing is sent to the site and nothing is stored. Anyone you send the picture to will see it.
• Accessibility reports: if you tell us about a barrier (see the accessibility statement), you do so by email to the address in the Impressum; the site itself stores nothing about it. We keep the email only as long as we need it to answer and fix the problem.
• Public front page: the Emperor can switch on a public page that shows visitors who are not signed in only text the operator wrote (a motto, a few paragraphs, the steps to join and links to the rules and legal pages). It shows no member data, no numbers and no names, uses no cookies beyond the form-protection cookie described above, and loads nothing from other sites. The operator can let search engines list this one page; all other pages stay closed to them.
• Mentoring: who mentors whom, when it started and ended, and a reason if a mentor or newcomer asked for a change; your first steps (which are done, and the screenshot link and coordinates of your home if you share them).
• Landmarks you built and Chronicle entries that name you (for example "Alice_Bee was raised to the Nobility").
• Search: the words you type in the search field are used to answer that one request and are then forgotten. They are not stored, not written to the log and not kept as a list of recent searches; the site only looks through what you are allowed to see anyway. The page asks the browser not to keep it, and search engines are told not to list it.
• Pop-ups and progress bars: which celebration pop-ups you have already seen, and how full each progress bar was when you last saw it, so it can move from there. Seen pop-ups are deleted after a year.

Signed-in citizens see titles, showcases, achievements, season standings, thanks (on the profile and the Thanks wall), who said they are going to an event, landmarks and the Chronicle. Only you and staff see your bounty claims, your first steps and mentor change requests; your mentor also sees your first steps. Staff can hide a thank-you message. Purpose: recognising what citizens do and keeping the nation’s history. Legal basis: Art. 6(1)(b) GDPR (the functions of the site under the terms of use). Nothing here is used for advertising or profiling, and none of it has any effect outside this site.

The market (only if you have a market role)

Production you log, sales, commission earned and payouts. Legal basis: Art. 6(1)(b) GDPR.

Security

• Sign-in sessions: a random token in a cookie (see section 4) and, on our side, its expiry and a rough device label such as "Firefox on Windows" so you can see where you are signed in. Never the full browser string, never the IP address.
• Failed sign-ins are counted per account to stop password guessing, and deleted after 3 days.
• Audit log: which account did what, and when (for example "approved a request"). It keeps staff accountable and helps after mistakes or abuse. It contains no IP addresses.
• IP addresses: to slow down attacks on the sign-in and sign-up forms, the server counts attempts per connection. It does this only in its working memory, with the address scrambled by a key that exists only in memory. Nothing is written to disk, and the counts are dropped after at most about an hour or when the server restarts. The site's own log lines contain no IP address and no account name.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in protecting accounts and the site; for sessions also Art. 6(1)(b).

Hosting

The site runs at Hetzner. To deliver pages, the host's servers necessarily receive your IP address and the address of the page you request. We ask the host to keep such server logs off or as short as possible. The host processes data on our behalf under a data processing agreement (Art. 28 GDPR). Legal basis: Art. 6(1)(f) GDPR.

Discord

The site can post short messages (Minecraft names and events) to the nation's Discord server. This is currently switched off.

Links you add

The site never loads links you add as proof. Pictures from other websites are not shown inside the site, so viewers' devices do not contact those websites unless they click a link. Links open without telling the other website which page they came from.

4. Cookies and storage in your browser

The site uses only what it needs to work, so no consent banner is needed (§ 25(2) TDDDG):

• sw_session: keeps you signed in. Deleted when you sign out; ends after 12 idle hours and at the latest after 7 days.
• sw_anon: protects the sign-in and sign-up forms against forged submissions (for visitors who are not signed in). Ends after 12 hours.
• sw-theme (browser storage, not a cookie): remembers day or night colours if you switch them. It never leaves your device.
• sw-music, sw-music-mood, sw-music-vol and sw-music-told (browser storage, not cookies): remember whether you want the music, its mood and volume, and the day the “Music is playing” notice was last shown. You set them yourself with the music switch in the header or under Me › Settings. The music is made by your browser; no sound is loaded from anywhere and nothing about it is sent to the server.
• sw-how (browser storage, not a cookie): remembers which of the “How this works” boxes you hid with “Got it”, so they stay hidden on this device. You can show them again on the page itself or under Me › Settings › Help boxes. It never leaves your device.
• sw-keys (browser storage, not a cookie): remembers that you switched off the ? shortcut on this device (Me › Settings › Keyboard shortcuts). It holds only the word “off”, is set only by you, and never leaves your device.
• sw-digest (browser storage, not a cookie): remembers the day on which you pressed “Got it” on the “While you were away” card on the Hub, so it stays hidden for the rest of that day. It holds only a date and never leaves your device. The card itself is worked out when you open the Hub from records the site keeps anyway and from the day you were last here; for that the site keeps, in memory only (not in the database) and only for the current day, the date of your previous visit. Restarting the site forgets it.
• sw-cabinet (browser storage for the current tab only, not a cookie): remembers that the doors of the medal cabinet have already opened once, so they do not open again on every visit. It is gone when you close the tab.

5. Who sees your data

• Everyone signed in: your name, rank, medals and when you became a citizen; your title, showcase, achievements, season points and place in the standings, thanks you gave and received, landmarks you built, event answers and Chronicle entries that name you; whether you are a mentor, and the languages you speak if you are one. Your Discord name is shown only to signed-in citizens, and not at all if you hide it.
• Admins and the Emperor: your requests, contributions and reports, your last sign-in, and account details they need to help you.
• The hosting company (section 3) and Discord (section 3) as described.

We do not sell or give your data to anyone else.

Staff tools and technical help. Staff keep a list of ready polite reasons for turning requests down (text written by staff, no personal data; the reason you receive is stored with the decision as before) and a staff handbook written by the Emperor. The Health page shows the Emperor, and one person the Emperor may choose as technical helper, whether backups and disk space are fine and how many server errors happened; the list of errors holds only the time, the kind of error and the page address without anything typed into it (no names, no addresses, no search words) and is kept in memory only, lost when the site restarts. The technical helper sees nothing else of the staff pages, and the choice is removed when that person deletes their account. Alerts about these things are sent as messages to those two people and to the staff channel on Discord if one is set up.

6. How long we keep it

• Your account and what you did: until you delete your account. Deleting replaces your name with an anonymous one, removes the texts of your requests, ends all sign-ins and removes your messages. Medals, rank history and market records stay under the anonymous name, so the nation's records and the shop's books remain correct.
• On deletion your shops, your “voted” marks in polls (the counts stay and hold no names), the text of your ideas, your upvotes, your plans, your “Needs a hand” posts, offers and reports, your apprenticeships that are still open, your clan membership and invitations (a clan you own is closed), your ministry memberships, requests and roster entry (tasks you held go back to the ministry; announcements you wrote stay without your name), your achievements, titles, showcase, languages, Discord name, away mark, questionnaire results, rank confirmations, thanks (given and received), event answers, first steps, pop-ups, progress bars, your home, your requests for homes and your leave date are deleted (the place in the home is free again at once, and you stop leading any town or state). Season and Prosperity totals stay under the anonymous name so the nation’s totals do not change; Chronicle entries and landmarks stay, with your name replaced by “a former citizen”.
• Turned-down sign-ups: deleted after 7 days.
• Read messages: deleted after 90 days. Failed sign-in counts: 3 days. Password reset links: 24 hours.
• Nightly backups of the whole database are kept for 14 days. The Emperor can also download an encrypted copy of the database; it is made when asked, protected by a passphrase that is never stored, and is not kept on the server. After you delete your account, older backups still contain your data until they are replaced.

7. Your rights

You have the right to access your data (Art. 15 GDPR) and to receive it in a machine-readable form (Art. 20): use Me → Settings → Download my data. You can have wrong data corrected (Art. 16; for example ask an Admin to fix your name), have it deleted (Art. 17: Me → Settings → Delete my account), have its processing restricted (Art. 18), and object to processing based on legitimate interests (Art. 21). Write to the email address in section 1; we answer within one month.

You may also complain to a data protection supervisory authority (Art. 77 GDPR), for example the authority of the German state where you live or where the operator lives.

8. Young players

If you are under 16, a parent or guardian must agree to you using this site. We do not knowingly approve accounts of children under 16 without that agreement. Parents can contact us at the email address above.

9. Decisions

The site shows your progress towards the next rank automatically, but every approval, medal and promotion is decided by a person. Achievements, titles, season milestones (including the season medal) and Prosperity levels unlock automatically when you reach them; they are purely decorative and have no legal or similarly significant effect. Suggestions the site makes to staff (bounty ideas, a mentor for a newcomer, someone to recognise) are only suggestions: a person decides. There is no automated decision-making within the meaning of Art. 22 GDPR.

10. Security

Connections are encrypted (https) once the site is online. Passwords are hashed with scrypt; forms are protected against forgery; all actions are logged; and the database is backed up and checked every night.