Privacy Policy

01Introduction

This Policy describes how [TO BE COMPLETED: legal name of the BoxLabs operator] handles information when you use the BoxLabs website, Discord sign-in, Minecraft account linking and related Services.

[TO BE COMPLETED: operator address, privacy contact, and—if applicable—data protection representative.] This draft contains marked fields that must be confirmed before publication as a final policy.

02Information We Collect

Depending on the feature you use, the website database stores your Discord ID, username, display name, avatar hash, account creation time and last-login time. It stores Minecraft UUID, username and link time when you link a Minecraft account. For store orders, it also stores linked Minecraft UUID and username snapshots, Tebex package name and ID, basket, transaction and recurring-payment references, payment amount and currency, payment status and timestamps for each recorded charge.

The account-linking flow temporarily stores a hash of a one-time link code, its Discord account ID and expiry, and failed-attempt counters with a Minecraft UUID and time window. The raw link code is not stored. The store can send your network IP address to Tebex to retrieve market-specific package pricing; BoxLabs does not save that IP address in the order record. [TO BE COMPLETED: confirm retention periods and whether hosting or other services collect additional data.]

03Minecraft Information

The Minecraft server integration can send a snapshot containing player UUIDs and usernames, online status, balances, earnings, blocks mined, kills, deaths, playtime, vote counts, ranks, join/last-seen times and up to ten recent activity entries per player. The website keeps the latest snapshot in Cloudflare KV until a newer successful update replaces it. The homepage shows when that snapshot was received and continues displaying it if the server stops sending updates.

[TO BE COMPLETED: confirm the exact server fields sent, who can see each field, the Minecraft server operator/host, and any separate server-side retention.]

04Discord Information

When you sign in, BoxLabs uses Discord OAuth with the `identify` scope. Discord returns your Discord ID, username, optional display name and avatar hash. The website uses these details to create or update your account and show your profile. Avatar images may be requested from Discord's CDN.

BoxLabs does not receive your Discord password through this sign-in flow. [TO BE COMPLETED: confirm whether Discord bot/community features process additional information.]

05Website Accounts

A website account is created when you sign in with Discord. The database stores the account details above and a random session-token hash, creation time and expiry time. The browser receives an HTTP-only session cookie that lasts up to 30 days; the database stores the hash rather than the raw session token.

[TO BE COMPLETED: confirm the account deletion process and whether any other account preferences are stored.]

06Account Linking

Linking associates a Discord account with a Minecraft UUID and username. The Minecraft server plugin communicates with the BoxLabs website to complete the link and can receive the linked Discord ID for the requested Minecraft account.

Temporary OAuth state and one-time link codes are used to protect sign-in and linking. OAuth access tokens are used to retrieve your Discord identity and are not saved in the website database. [TO BE COMPLETED: verify plugin and server-side handling.]

07Technical Information

Cloudflare operates the website platform and may process request, device, security and network data, including IP address, timestamps, user-agent and requested URL, in its service logs. [TO BE COMPLETED: confirm which Cloudflare logging products are enabled and their retention periods.]

The application does not include an analytics or advertising tracker in the code inspected for this Policy. Recheck this if analytics or other scripts are added.

08How We Use Information

The information described above is used to provide Discord sign-in, maintain sessions, link Discord and Minecraft accounts, display server snapshots, prevent abuse of the linking flow and secure the Services.

[TO BE COMPLETED: identify the controller's chosen lawful basis for each purpose and any additional purposes.]

09Cookies

The website uses `boxlabs_session` to keep you signed in and a short-lived OAuth state cookie during Discord sign-in. These cookies support the account features you request. The cookie notice dismissal is stored in browser local storage (`boxlabs_cookie_notice_dismissed`), not in a cookie.

The inspected code contains no analytics or advertising cookies. [TO BE COMPLETED: confirm cookie lifetime/settings and any additional cookies set by hosting or third parties.]

10Third-Party Services

Discord is used for OAuth sign-in and avatar delivery. Tebex provides the store, checkout and payment processing. During checkout, Tebex receives the selected package, the Minecraft account authenticated for that basket, an opaque BoxLabs order reference and the visitor IP address used to retrieve regional prices. Cloudflare provides website hosting, request handling, KV snapshot storage and the Hyperdrive database connection. Supabase provides the PostgreSQL database accessed through Hyperdrive.

These providers process information as needed to provide their services and under their own terms. [TO BE COMPLETED: confirm processing locations, contractual roles and links to current provider privacy notices.]

11Payments

Tebex handles checkout and payment processing. BoxLabs receives verified Tebex payment events to record each one-time or recurring transaction reference, package, actual amount and currency paid, status and event timestamps in your order history. The website does not treat a browser return from checkout as proof of payment and does not receive or store card numbers.

[TO BE COMPLETED: identify the operator's lawful basis, order and webhook retention period, and link Tebex's privacy notice.]

12Data Storage

Account and link records are stored in a PostgreSQL database provided by Supabase and connected through Cloudflare Hyperdrive. The latest Minecraft server snapshot is stored in Cloudflare KV until a newer successful update replaces it; it currently has no automatic expiry.

[TO BE COMPLETED: confirm database and backup locations, international transfers, safeguards, and provider retention/deletion behavior.]

13Data Retention

Website sessions expire after 30 days. Link codes are configured to expire after five minutes by default, and expired codes and stale rate-limit counters are cleaned up during the linking flow. The latest server snapshot remains in Cloudflare KV until replaced by a newer successful update; it has no automatic deletion period.

The code does not set an automatic deletion period for user or Minecraft account records. [TO BE COMPLETED: set retention periods for account data, snapshots, logs, support records, backups and deletion requests.]

14Data Sharing

Information is shared with the service providers listed above where needed to run the Services. The Minecraft linking integration exchanges the account-linking details needed to complete a link. The website displays selected server snapshot information on public pages and account information to the signed-in account holder.

[TO BE COMPLETED: specify which Minecraft statistics and player details are publicly visible, and any other recipients or disclosures required by law.]

15Security

The website uses measures such as HTTP-only session cookies, hashed session and link codes, short-lived linking codes, request authorization and rate limiting. No online service can guarantee absolute security.

[TO BE COMPLETED: add the operator's security contact and incident-response process.]

16Your Rights

Depending on where you live, you may have rights to access, correct, delete or restrict certain personal information, object to some processing, or complain to a supervisory authority. You may also unlink your Minecraft account through the profile page.

Contact [TO BE COMPLETED: privacy email] to exercise a right. [TO BE COMPLETED: name the relevant supervisory authority and explain any complaint process.]

17Children's Privacy

The Services are not intended to override age requirements that apply to Discord, Minecraft or local law. [TO BE COMPLETED: minimum user age, parental-consent requirements, and how a parent/guardian can contact the operator.]

18Changes to this Policy

We may update this Policy when the Services, data practices or legal requirements change. The current version and update date will be shown here. [TO BE COMPLETED: how users will be notified about material changes.]

19Contact

For general privacy questions, contact the BoxLabs team through the official Discord. Formal privacy requests can be sent to [TO BE COMPLETED: privacy email].

[TO BE COMPLETED: legal operator name, postal address, country, and any required data protection contact.]