Privacy Policy

MCCompanion is developed and operated by MCCORG. If you have any questions about this Privacy Policy or your data, you can reach us at [email protected] or via our Discord community.

When you create an account, we collect the following information:

• Email address: used to identify your account and send important notices
• Password: stored securely and encrypted by Firebase Authentication; we never have access to your plain-text password
• Username: a unique name you choose (3–20 characters)
• Display name: an optional name shown to other users
• Profile avatar: an optional profile picture URL you provide
• Biography: an optional short text you write about yourself

If you choose to link gaming accounts, we collect the following. Linking is entirely optional and you can unlink accounts at any time.

• Xbox / Bedrock: Xbox Gamertag and Xbox User ID (XUID)
• Java Edition: Minecraft Java username and UUID

To provide social features, we collect and store:

• Friends list: the users you have added, accepted, blocked, or been blocked by
• Online presence: your last seen timestamp and, when actively playing, the server IP and port you are connected to (only visible to accepted friends, unless you enable Appear Offline)

When you enable push notifications, we store a Firebase Cloud Messaging (FCM) token linked to your account. This token is a device identifier used solely to deliver push notifications (new messages, friend requests, friends coming online) to your device. It is removed when you delete your account or uninstall the app.

When you use the relay feature to connect to a Minecraft server, we record the following:

• Your public IP address: held in a Redis cache for up to 15 minutes so we can route your connection back to you, and then discarded. It is not written to our connection log and it is not linked to your account.
• The address of the server you connected to, and the time you connected. This is stored for 90 days.
• Aggregated connection counts per server address.

The connection log records which server was reached and when, not who reached it: it holds no user identifier, no device identifier and no player IP address. Rows older than 90 days are deleted automatically. We use it to monitor reliability, detect abuse, and produce the public numbers described below.

MCCompanion publishes a public directory of Minecraft servers at mccompanion.net/servers, together with a metrics page of the most-connected servers. A server enters the directory because players reached it through our relay; we then contact it ourselves every thirty minutes and record what it broadcasts. For each server the directory may show:

• Its hostname and port, and the name, message of the day, version and icon the server itself broadcasts to anyone who queries it
• Player counts, peak players and uptime, measured by us rather than reported by the server
• How many connections we have handed to that address, aggregated and never per player
• Anything the owner added after claiming the listing: a description, banner, links and tags
• How to be removed: mail [email protected] and we take the listing off, no account and no proof of ownership needed. Or make an account, prove the server is yours with a DNS record or your MOTD, and remove it yourself from your dashboard.
• Removal is permanent. The listing does not come back, not even when our relay sees that address again later, and we stop querying the server altogether.

Two rules limit what appears. We do not list bare IP addresses, only hostnames, so a server running on a home connection is not published. And a server only appears once we have measured at least five players online at the same time in the past week, which keeps private and small friends-only worlds out. The directory contains no information about individual players: we never publish who connected to what. If you operate a server and want it removed, or you believe it was listed in error, write to [email protected] and we will delist it.

MCCompanion handles resource pack data in several ways depending on the feature used:

• Relay caching: packs downloaded automatically from servers you connect to are stored in Cloudflare R2. We store the pack file, UUID, version, file size, and a SHA-256 hash for deduplication. These packs are not publicly listed or browsable.
• User-uploaded packs: if you upload a resource pack, the file is stored in Cloudflare R2 under a hash-based path and is accessible to anyone with the direct URL. You can delete your uploaded pack at any time from within the App.
• Pack editor: the in-app RP editor processes packs locally on your device. No pack content is sent to our servers unless you explicitly upload the result.
• Community browser: pack listings include the pack name, author, download URL, and description as submitted. We do not collect personal data in connection with browsing packs.

Cached relay packs are retained indefinitely. User-uploaded packs are retained until you delete them in-app.

When you use the Skin Workshop to upload and publish a skin, we store the following data:

• The skin texture file (stored in Cloudflare R2 cloud storage)
• Skin name as you entered it
• Your user ID and username, stored as the creator of the skin
• A public URL pointing to the texture file
• Like count: the number of users who have liked your skin (individual liker identities are stored to prevent duplicate likes but are not publicly visible)
• Upload timestamp

Published skins are publicly visible on your profile and in the skin gallery. Anyone can view and download the texture via the public URL. You can delete your skins at any time from within the App/Website, which permanently removes the texture file and all associated metadata.

If you submit feedback (bug reports or feature requests) through the App or Website:

• You need to be logged in, so your feedback is linked to your MCCompanion account.
• The content of your feedback (title, description, platform, and app version) is stored privately in our database and is only visible to you and our admins. It is not published anywhere.
• We reply in the report itself, which you find back in your account under your reports, not by email. You can answer there too.

Feedback submitted before July 2026 was posted as a public issue on our GitHub repository. Those issues stay public unless you ask us to remove them. To request removal of older feedback, contact us at [email protected].

If you submit a report about another user, we store the reporter's user ID, the reported user's ID, the reason, any optional context you provided, and the date of the report. This information is retained to protect the integrity of our community.

We use your information exclusively to:

• Provide and operate the App: account management, relay connections, skin workshop, resource packs, the server list, player lookup, server tracking
• Enable social features: friend requests, online presence, push notifications
• Ensure security: detecting abuse, rate-limit violations, and enforcing our Terms of Service
• Improve the App: aggregated, anonymised analytics on relay usage and popular servers
• Respond to reports: moderating content and enforcing community rules
• Communicate with you: feedback confirmations, admin replies, and important service notices

We do not use your data for advertising purposes, and we do not sell your data to third parties.

The following information is visible to other users within the App:

• Your username, display name, and avatar
• Your online status and, if applicable, the Minecraft server you are currently connected to: visible only to accepted friends unless Appear Offline is enabled
• Your linked Gamertag and Java username (shown on your public profile)

We use the following third-party services that may process your data. These providers act as data processors and are bound by their own privacy policies.

• Google Firebase: authentication and push notifications (firebase.google.com/support/privacy)
• Microsoft / Xbox: Bedrock account linking via device code flow (privacy.microsoft.com)
• Mojang / Microsoft: Java account linking and player lookup (privacy.microsoft.com)
• RevenueCat: in-app subscription management and receipt validation (revenuecat.com/privacy). Payment card data is managed by RevenueCat and your device's app store; we never receive or store your card details.
• Cloudflare: cloud storage (R2) for resource packs and CDN delivery (cloudflare.com/privacypolicy)
• Zoho Mail: transactional email delivery for feedback confirmations and support replies (zoho.com/privacy)
• GitHub: public issue tracker for user-submitted feedback (docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement)

We do not share your personal data with any other third parties.

We retain your data for the following periods:

• Account and profile data: until you delete your account
• Linked gaming accounts: until you unlink them or delete your account
• Friends and social data: until you delete your account
• FCM device tokens: until the app is uninstalled or you delete your account
• IP addresses in route cache (Redis): automatically deleted after 15 minutes
• Connection logs: automatically deleted after 90 days
• Feedback contact emails: retained until you request removal at [email protected]
• Resource pack files in cloud storage: retained indefinitely for relay delivery; user-uploaded packs can be deleted in-app at any time
• Cloud skin files and metadata: retained until you delete the skin from within the App/Website
• Skin like records: retained until you delete your account
• Abuse and report records: retained indefinitely for moderation integrity

You can permanently delete your account at any time from within the App (Profile → Settings → Delete Account). Upon deletion, the following data is permanently and irreversibly removed:

• Your account and profile data
• All your friend connections and requests
• All your linked gaming accounts
• All your FCM device tokens
• All your tracked servers and active sessions
• All your uploaded cloud skins and their texture files
• All your skin like records

User-uploaded resource packs are not automatically deleted on account deletion, delete them manually in-app before deleting your account if desired. Abuse and moderation reports may be retained. Connection logs expire after 90 days as normal.

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you
• Correction: update inaccurate data via in-app profile settings
• Deletion: permanently delete your account and all associated data
• Portability: request your data in a portable format
• Objection: object to certain uses of your data
• Erasure of feedback email: contact us to remove your email from our feedback records

EU/EEA users (GDPR): We process your data based on contractual necessity (to provide the services you signed up for), legitimate interests (security and analytics), and your consent (for optional features such as push notifications). To exercise any of your rights, contact us at [email protected].

The App may send you push notifications for incoming friend requests, accepted friend requests, friends coming online, replies to a report or a bug you sent us, and activity on something you posted, such as a like or a comment. You can disable push notifications at any time in your device's system settings without affecting your ability to use the App.

MCCompanion can be used by players of all ages. For children under 13 (or under 16 in the EU/EEA), the following rules apply:

• A parent or legal guardian must create the account on the child's behalf.
• By creating an account for a child, the parent or guardian confirms they have read this Privacy Policy and consents to the collection and use of data as described herein.
• Parents and guardians are responsible for supervising their child's use of the App and any content shared through it.
• Parents can view, update, or delete their child's account at any time from within the App or by contacting us at [email protected].

If we become aware that an account belonging to a child under 13 was created without verifiable parental consent, we will suspend the account and promptly delete all associated data. If you believe this has occurred, please contact us at [email protected].

We take appropriate technical and organisational measures to protect your data, including:

• Encrypted authentication tokens via Firebase Auth
• HTTPS/TLS for all API communication
• Token-based authentication for WebSocket connections
• Rate limiting and automatic IP-based abuse detection
• Encrypted at-rest storage via Cloudflare R2 for resource pack files

No method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your personal data, we will notify you as required by applicable law.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via an in-app notice or push notification. The 'Last updated' date at the top of this document reflects the most recent version. Continued use of the App after changes constitutes acceptance of the updated policy.