Privacy policy

1. Controller

The controller of your personal data is CodeFanatics Sp. z o.o., Litwinki 21, 13-100 Nidzica, NIP: 9840216706, REGON: 525516131 ("we").

For anything about your personal data, write to [email protected].

2. Launcher and client: data on your PC

The launcher and client contain no ads or error reporting. Settings, profiles, screenshots, skins, outfits, game logs and crash reports are saved only on your PC and never sent to us.

You sign in with your Microsoft account on Microsoft's own page, so we never see your password. The login token is encrypted on your PC with Windows' own protection and only sent to Microsoft, Xbox Live and Mojang.

Usage statistics: unless you switch off Settings → "Send anonymous usage statistics", the launcher sends our server (cosmetics.fanaticmc.com) anonymous counts: that it was installed or started, that a game was launched, crashed or closed and how long it ran, the Minecraft version, loader, graphics API and memory of the profile, which Fanatic features were turned on and how often they were used, which launcher you imported from, and the launcher version, operating system and processor type. Each message carries a random installation ID made by the launcher, never your Microsoft or Minecraft account, name or file paths. We store the installation ID only as a one-way hash.

Purpose and legal basis: understanding how the launcher is used so we can fix and improve it (our legitimate interest, Art. 6(1)(f) GDPR). You can object at any time by switching the setting off. Retention: daily totals are kept for 400 days, and the hashed installation ID is deleted 180 days after it was last seen. Your IP address is used only in the server's memory to limit requests, for at most a day, and is not stored in the database or in logs.

3. Online services: cosmetics, emotes and friends

While you play, the client connects to our server (cosmetics.fanaticmc.com) so other Fanatic Client players can see your cosmetics and emotes, and your friends can see your status. For this we process:

• your Minecraft username and UUID, and when you last connected,
• the client and Minecraft version you connect with,
• when you sign in to the launcher with a Microsoft account, and after that at most every 12 hours, the launcher confirms your Minecraft username and UUID with Mojang and tells our server, which records when you first and last did so and how often, so our staff can see when a new player starts using Fanatic Client (this does not depend on the statistics setting),
• the cosmetics you wear, their colours and the emotes you use,
• the UUIDs of players whose status your client watches, such as your Minecraft friends (the launcher gets your friend list from Microsoft; we don't store it),
• waypoints, pings and emotes you send to friends: the server only passes them on to the recipients and neither stores nor logs them.

Purpose and legal basis: providing the online services described in the Terms (Art. 6(1)(b) GDPR).

Retention: your player record (username, UUID, last connection) and the launcher sign-in record are deleted automatically after 180 days without connecting. Items assigned to your UUID are kept as described in section 4.

Your IP address is needed for the connection. We use it only in the server's memory, to limit connections and prevent abuse, and forget it within 10 minutes. IP addresses are not stored in the database or in logs, and the server logs don't contain usernames either (legal basis: our legitimate interest in keeping the service secure, Art. 6(1)(f) GDPR).

4. Store and purchases

You buy items in the store (https://store.fanaticmc.com), run by Tebex Limited. Tebex is the seller and takes the payment, so it processes the details a purchase needs, such as your name, email, address, country and payment details, as a separate controller under its own privacy policy (https://www.tebex.io).

After a payment, Tebex sends us a notification about the order. We keep only what we need to deliver the items: the transaction ID, its status (for example paid, refunded or disputed) and status history, dates, the packages bought and the UUID of the Minecraft account that receives them. We don't store your name, email, address, amounts or payment method.

Purpose and legal basis: delivering items and handling refunds, complaints and chargebacks (Art. 6(1)(b) GDPR), and establishing, exercising and defending legal claims (Art. 6(1)(f) GDPR).

Retention: the record of which items belong to which UUID is kept for as long as we run the online services. Order records are kept until claims related to the purchase are time-barred.

5. Bans

If we block an account from the online services (see the Terms), we store the UUID, the reason and the date. Legal basis: our legitimate interest in protecting the services and other players (Art. 6(1)(f) GDPR). We keep this until the ban is lifted.

6. Website and cookies

The website has no analytics, ads, tracking pixels or third-party scripts. When you open it, the server processes your IP address and technical request data (such as your browser type) to deliver the page and protect it from abuse (Art. 6(1)(f) GDPR). We don't build visitor statistics or profiles from it.

The website uses two cookies:

• lang: remembers the language you picked with the switcher; only set once you pick one, kept for a year,
• fc_admin: the admin panel session; only for administrators.

Both are strictly necessary for features you ask for, so they don't need consent. You can delete them in your browser settings.

The installer and updates are downloaded from updates.fanaticmc.com, which is served by Cloudflare. Cloudflare sees your IP address when you download.

7. Third-party services

To work, the launcher and client connect from your PC directly to the services below. Each of them sees your IP address and the data the feature needs and processes it under its own terms:

• Microsoft, Xbox Live and Mojang: sign-in, game downloads, skins, friend list,
• Fabric (meta.fabricmc.net): installing Fabric,
• Modrinth, and in some cases CurseForge: searching and downloading mods and resource packs,
• mc-heads.net: player head images, by username or UUID,
• mineskin.org: preparing skins in the skin library,
• Google Translate: chat translation. It is off until you turn it on; once on, it sends the text of the messages being translated to Google.

8. Recipients

The following may process data on our behalf: the provider of the server that runs the website and online services, Cloudflare, the backup storage provider and the email provider. Where any of them processes data outside the European Economic Area, this is based on a European Commission adequacy decision (such as the EU-US Data Privacy Framework) or standard contractual clauses.

We don't sell data or share it for advertising.

9. Backups

The server's database is backed up daily. Backups are encrypted and kept for up to 35 days, so deleted data is gone from them after that at the latest.

10. Your rights

You have the right to:

• access your data and get a copy of it,
• have it corrected,
• have it erased,
• restrict its processing,
• data portability,
• object to processing based on our legitimate interest.

To use them, write to [email protected]. Most data is linked to a Minecraft account rather than an email address, so we may ask you to confirm the account is yours. We reply within a month.

You can also lodge a complaint with the President of the Personal Data Protection Office in Poland (ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl) or with the supervisory authority in the country where you live.

Providing data is voluntary, but the online services don't work without your username and UUID, and we can't deliver items without the order data. We don't make automated decisions about you or profile you.

11. Changes

When we change this policy, we publish the new version on this page and update the date at the top. We also announce significant changes on the home page or in the launcher.

This is a translation. If it differs from the Polish version, the Polish version applies.