Privacy policy

02Who is responsible

Starux GmbH runs serverlist.net and is the controller of the personal data described in this policy, under the GDPR and the Swiss Federal Act on Data Protection. Write to privacy@serverlist.net or to the postal address below.

03When you browse

For every page you open, our server records:

• the page address and the site that sent you there, by domain
• your browser, operating system and device type, read from the user agent
• your country, from our CDN, and your language
• campaign tags in the address, such as utm parameters
• actions on the page: servers shown in a list, address copies, votes, searches, filters, outbound clicks and time spent
• a visitor identifier, explained in the next section

Your IP address is used to tell bots from people and to protect the site, and is turned into a hash with a secret that changes every day. The hash cannot be turned back into the address and cannot link one day to the next.

We use this to see which pages help people find a server, to show owners anonymous totals about their listing and to keep the site fast and safe. Known bots and our own test traffic are filtered out.

04Consent and the analytics cookie

In the European Economic Area, the United Kingdom and Switzerland, and wherever we cannot tell your region, we set no analytics cookie. We do not show Google ads at the moment, so we ask for no consent and show no consent dialog.

Where consent is not required, we set the cookie slv2_v with a random ID for 13 months, so we can recognize a returning visitor, unless your browser sends Global Privacy Control or Do Not Track. We treat both as a no.

Without the cookie we count you with a hash of your IP address and browser that changes every day. The cookie policy lists every cookie we use and how to remove it.

05Accounts

If you create an account we store:

• your username, email address and display name
• your password as a one-way hash, never in readable form
• your sessions: a hashed session token, a hash of your IP address, your browser and the last time you were active
• your settings, servers, orders and the actions you take as an owner

We email you only about your account and your servers: verification, password resets, security notices and the notifications you switch on. You can delete your account in account settings. It is deleted 14 days later, so a mistake can still be undone.

06Voting and reviews

When you vote we store:

• the Minecraft name you enter and whether it is a Java or Bedrock name
• your IP address, to stop repeat votes within 24 hours, deleted after 90 days
• the cookie vote_token, so the cooldown also works on a shared IP address, for one year
• your country and the time of the vote
• the review you write, if you write one, with its rating

To check a name we ask Mojang's and Microsoft's public profile services, and for Bedrock names GeyserMC and mcprofile. They receive the name you typed. A captcha from hCaptcha protects the vote form.

Your vote is sent to the server you voted for through Votifier, which includes your Minecraft name and the IP address you voted from, because that is how the protocol works and how servers pay out rewards. If the owner connected a Discord webhook, your Minecraft name and edition also appear in their Discord. Names and reviews are shown publicly on the server's page.

07If you list a server

The listing itself is public: name, addresses, description, banner, links and the history we measure. Votifier keys and Discord webhook addresses are stored encrypted and are never shown to anyone.

Owners see totals about their listing: views, address copies, votes, countries and devices. They never see who a visitor is.

08Services we use

These services process data for us or on our pages:

• Cloudflare delivers and protects the site and sees your IP address on every request
• Google Ads measures when a visit leads to an address copy, only where consent is not required and your browser sends neither Global Privacy Control nor Do Not Track
• Ahrefs Web Analytics counts visits without cookies
• Stripe processes boost payments, see the Stripe privacy policy
• hCaptcha protects votes, sign ups and tools from bots, see the hCaptcha privacy policy
• Mojang, Microsoft, GeyserMC and mcprofile check Minecraft names when you vote or look one up

Some of these companies are based in the United States and process data there. We do not use Google Tag Manager or any other tag container.

09How long we keep data

Raw analytics, sessions and events are deleted after 13 months. Daily totals without any identifier are kept. Vote IP addresses are deleted after 90 days, the vote itself stays in the server's history. Accounts are kept until you delete them, and order records as long as the law requires for bookkeeping. Server pings are measurements of servers, not of people.

10Your rights

You can ask us to:

• show you the personal data we hold about you
• correct it
• delete it, which for an account you can also do yourself
• stop using it for analytics, which Global Privacy Control or Do Not Track in your browser already does
• give it to you in a common format

Write to privacy@serverlist.net. We answer within 30 days. You can also complain to the data protection authority where you live.

11Children

Many Minecraft players are young. Browsing and voting need no account and collect no more than described above. Accounts are for people aged 13 and older. If you think a child under 13 created an account, write to us and we delete it. Our guide for parents explains how servers handle chat, purchases and safety.

12Changes

We update this page when what we collect or who we work with changes, and change the date at the top. Larger changes are announced on the site.