Privacy policy

1. Who is responsible

Velyra Digital (Eenmanszaak), Herengracht 320, 1016 CE Amsterdam, Netherlands, KVK 42168180, is the controller for the personal data described here. Questions and requests: privacy@smpforge.com.

2. What we process, and why

Visiting the store (anonymous statistics)

To see which templates people look at and where the checkout loses them, the store records simple events: pages viewed, templates viewed, opening the Forge, modules added or removed, saving a build, adding to cart, reaching checkout and purchases. Each event carries a random visitor ID and session ID that your browser creates, the device type (mobile or desktop) and, on your first page, the domain of the website that sent you, the campaign tags in the link you followed (such as utm_source), if any, and the country your visit comes from. We don't record your name, email address or IP address with these events and don't combine them with other data.

If your browser sends a Do Not Track or Global Privacy Control signal, no events are recorded at all. Basis: our legitimate interest in improving the store (Article 6(1)(f) GDPR). Events are kept for at most 25 months.

Prices in your currency

To show prices in your currency, apply regional prices and check that we can sell where you are, our host tells the store which country your visit comes from, looked up from your IP address; we use the country only, and don't store the IP address. If you choose a currency yourself at the bottom of a page, we remember your choice in a cookie (see section 4). Basis: our legitimate interest in showing you prices you can read at a glance (Article 6(1)(f) GDPR).

Orders and downloads

When you place an order we store your email address (for the receipt and download link), the build you ordered (server name, message of the day, settings and modules), the order number, amounts and any discount code used, status, times, how often each package was downloaded, the time you accepted our terms and waived your right of withdrawal, and the anonymous visitor ID so the purchase can be counted in our statistics. We need this to deliver your package and to meet accounting obligations. Basis: performing our agreement with you and our legal obligations (Article 6(1)(b) and (c) GDPR). Dutch tax law requires us to keep order records for 7 years, also if you delete your account.

Your account (optional)

You can shop as a guest. If you create an account, at sign-up or at checkout, we store your email address, the name you choose (if any), a password hash if you set a password (scrypt; nobody can read your password), when you created the account, confirmed your email and last signed in, and which orders belong to it. Servers are activated (downloadable) once their order belongs to an account, so at checkout the "create my account" box is ticked for convenience; untick it and we only use your email for the order until you create or sign in to an account yourself. An account lets you sign in with a one-time email link or your password and see your purchases on any device. If you claim an order that was bought with a different email address, we email that address a one-time confirmation link (valid for 24 hours) and only link the order once it's used. Orders placed with your email show up in your account only after you've confirmed that address. Basis: performing our agreement with you (Article 6(1)(b) GDPR). We keep your account until you delete it, which you can do yourself under My Forge → Profile, along with downloading a copy of your data.

Forge Insiders (marketing emails)

If you tick the Forge Insiders box or sign up at the bottom of a page, we send you news, new templates and offers by email. This is always your choice: the box is never ticked for you, and your subscription only starts after you confirm it from the email we send (double opt-in), unless you're signed in with an address you've already confirmed. We store your email address, where you signed up, the exact wording you agreed to and when you confirmed, as proof of your consent. As a thank-you you get a personal one-time discount code, linked to your email address. Basis: your consent (Article 6(1)(a) GDPR). You can withdraw it any time with the unsubscribe link in every email or under My Forge → Profile; we then stop straight away. Order and account emails (receipts, sign-in links) aren't marketing and keep coming.

Payments

You pay on the checkout page of Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). Stripe collects your payment details there, such as your card or account details, name, email address and billing country, to process the payment, prevent fraud and meet its own legal obligations; for that it is a controller in its own right, under Stripe's privacy policy. We never receive your full card details. From Stripe we get the payment's status and reference, the amount, the VAT charged and your country (which decides the VAT), and we keep those with the order for the same reasons and as long as the order record. Basis: performing our agreement with you and our legal obligations (Article 6(1)(b) and (c) GDPR).

Emails we send

We keep a copy of the emails we send you (receipts, sign-in and reset links, confirmations) so we can help if one goes missing. Sign-in and reset links are stored only as a fingerprint, expire within an hour and work once.

Emails and calls

If you contact us, we use what you send us to answer you, and keep it as long as needed to handle your question. Basis: our legitimate interest in helping you, or performing our agreement if it's about an order.

Technical logs

The servers that run the store may briefly keep technical logs (such as IP addresses and request times) to deliver the website and keep it secure. Basis: our legitimate interest in a working, secure service.

3. Stored in your browser, not by us

Your cart, Forge drafts, saved builds, list of orders and sound setting are kept in your browser's local storage so they're still there next time. They stay on your device and only reach us when you place an order. You can delete them by clearing this site's data in your browser.

4. Cookies

The store doesn't set cookies for visitors who aren't signed in, except one you ask for: if you choose a currency at the bottom of a page, the smpforge_currency cookie remembers it for a year (choose "automatic" or clear your cookies to remove it). Our statistics use the random IDs in local storage described above; they are first-party, not shared and have little impact on your privacy. When you sign in we set one strictly necessary session cookie that keeps you signed in for up to 30 days; signing out removes it. Our own administrators get a similar cookie when they sign in to manage the shop.

5. The SMPForge Dashboard

The dashboard you download runs on your own computer and doesn't send anything to us. It contacts other services only when you ask it to: Mojang's API to look up a player's account when you add an operator or whitelisted player, and api.ipify.org when you click "Show" to see your public IP address. On the first start, the included installer downloads the server software from PaperMC (fill-data.papermc.io) or PurpurMC (api.purpurmc.org), and for builds with voice chat Simple Voice Chat from Modrinth (cdn.modrinth.com); the server software then downloads Mojang's server files from Mojang. If your computer has no suitable Java, the launcher downloads the Eclipse Temurin runtime from GitHub (github.com/adoptium). Those sites see your IP address like any download site.

6. Who else sees your data

We don't sell personal data or use advertising or third-party analytics. These service providers process data on our behalf under a data processing agreement:

• Vercel (hosting the store, run from Frankfurt, Germany);
• Google Cloud (our database, Cloud Firestore, in Frankfurt, Germany);
• Resend (sending our emails).

Stripe handles payments as described in section 2. Vercel, Google and Resend are US companies, so data may reach the United States; where it does, appropriate safeguards are in place, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We share data with authorities only when the law requires it.

7. Your rights

You can ask to see, correct or delete your personal data, to restrict or object to its use, and to receive it in a portable format. With an account you can download your data and delete your account yourself under My Forge → Profile. Otherwise, email privacy@smpforge.com. Because our statistics are anonymous, we can only find events linked to you if you send your visitor ID (stored in your browser's local storage as smpforge:vid) or your order link. We respond within one month.

If you're unhappy with how we handle your data, please tell us first. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.

8. Security

We protect data with access restrictions, encrypted connections and by storing as little as possible. Report security issues to safety@smpforge.com.

9. Young players

SMPForge is meant for people who run Minecraft servers. If you're under 16, please ask a parent or guardian before placing an order.

10. Changes

We'll update this policy when the way we process data changes. The date at the top shows the latest version.