Privacy and cookie policy
Last updated: 10 October 2026
This is a translation: if it differs from the Italian version, the Italian version prevails.
This policy explains what personal data we process when you use itaprac’s websites and services, why we do it, how long we keep it and what rights you have. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”).
In short: we use no analytics, no advertising, no tracking pixels and no profiling cookies. We only use technical cookies, needed to sign you in and to keep forms safe. That is why there is no cookie banner: there is nothing to accept.
1. Who is responsible for your data
The data controller is itaprac Studios, the group that runs the itaprac Minecraft server and its websites.
- Email: itapracstudios@gmail.com
- Discord: open a ticket on our Discord server
We have not appointed a Data Protection Officer (DPO), as we are not required to.
2. What this policy covers
- itaprac.xyz: the public website, with the server status, the leaderboard, player profiles, the staff and the reviews;
- itaprac.xyz/applications: staff applications;
- dashboard.itaprac.xyz: the staff-only panel;
- api.itaprac.xyz: the interface that feeds the server’s public data to the website;
- the itaprac Minecraft server (Java and Bedrock);
- purchases of the VIP and Host ranks and donations, handled through Discord tickets and PayPal.
3. What data we process and why
3.1 Visiting the websites
When you open a page, the web server automatically logs your IP address, the date and time, the page requested, the response code, your browser and operating system (user agent) and the referring page.
- Why: to run the websites, protect them from abuse and attacks, and fix technical problems.
- Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).
- Retention: 14 days, after which the logs are deleted automatically.
3.2 Signing in with Discord
To apply, or to open the dashboard if you are on the staff, you sign in with Discord. We only ask Discord for the
identify permission, so we receive your Discord ID, username, display name and
avatar, plus the public parts of your profile (avatar decoration, server tag, nameplate). We do not
receive your email, your servers or your messages. We also store when you first and last signed in, and we update
your name and avatar from Discord when they change.
- Why: to recognise you, show you your applications and, for the staff, control who can access the dashboard.
- Legal basis: providing the service you ask for (Art. 6(1)(b) GDPR).
- Retention: for as long as you have applications or active access with us, or until you ask us to delete your account.
3.3 Staff applications
If you send an application we store the answers you write, the form you chose, the date you sent it and your Discord ID. The staff adds the outcome (accepted or rejected), who decided it, when, and an optional note. We also keep a log of staff actions (who decided what, and when).
- Why: to assess your application and manage the team.
- Legal basis: handling the request you make by applying (Art. 6(1)(b) GDPR); for the action log, our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).
- Minimum age: you must be at least 15 to apply.
- Retention: applications are kept until you ask us to delete them or the service shuts down. You can ask for deletion at any time (see section 9).
Do not put data we do not ask for in your answers, especially sensitive data (health, political opinions, religion and the like).
3.4 Reviews on the home page
The home page shows reviews from some of our players. For each review we publish the text, the star rating, the name, the avatar and the Discord profile cosmetics (avatar decoration and nameplate) of the person who wrote it. The staff adds them from the Discord ID, and the name and avatar update on their own when you change them on Discord.
- Legal basis: your consent, which you give when you ask us to publish your review (Art. 6(1)(a) GDPR).
- Retention: until you ask us to remove it. You can withdraw your consent at any time and we take the review off the site.
3.5 Staff dashboard
For staff members we store the Discord ID, username and display name, avatar, the Discord profile cosmetics shown in the dashboard, the access level, who granted access and when, and the actions taken in the dashboard (for example commands sent to the server console or changes to reviews). The dashboard also records technical metrics of the machine and the game servers (CPU, memory, players online), which are not personal data.
- Legal basis: our legitimate interest in running the server securely and knowing who did what (Art. 6(1)(f) GDPR).
- Retention: while you are on the staff. When your access is removed, its data is deleted.
3.6 Minecraft server
When you play, the server processes your Minecraft username and UUID (or your Xbox gamertag/XUID if you play on Bedrock), your IP address, your chat messages and the private messages between players, the commands you use and your game statistics (kills, deaths, wins, losses, ELO and how it changes over time). We also handle any punishments (bans, mutes) and their reason. The staff can read chat and private messages to enforce the rules.
- Why: to run the game, enforce the rules, and protect the server from cheats, attacks and alt accounts.
- Legal basis: providing the service (Art. 6(1)(b) GDPR) and our legitimate interest in security and moderation (Art. 6(1)(f) GDPR).
- Retention: server logs (which contain IPs, chat and private messages) are deleted after 90 days. Punishments are kept while they are active, plus the time needed to deal with repeat offences. Statistics are kept for as long as the server exists.
Attack protection: the server’s firewall counts, for a few minutes, how many connections each IP address opens, so it can block anyone who opens too many. These counters live only in memory and are never saved.
3.7 Country you connect from
While you are connected, we work out the country you connect from using your IP address and a database installed on our own server (IP Geolocation by DB-IP), without sending it to any outside service. The IP is used only for this lookup and then thrown away: we do not store it. We keep only the country, a pseudonymous code derived from your UUID in a way that cannot be reversed (so we count you once), the date of your first and last visit and, in aggregate, how many players were online per country. The staff only sees totals and trends per country, never an individual player. On the public website the globe shows only the list of countries, with no player counts.
- Legal basis: our legitimate interest in knowing where our community comes from (Art. 6(1)(f) GDPR).
- Retention: 12 months after your last visit.
3.8 What is public on the website
On itaprac.xyz anyone can see:
- the names of some players who are online, and how many are online;
- the leaderboard, with players’ names, skins and game statistics, and any player’s profile by searching their name;
- the staff list, with Minecraft name, role and skin;
- the total number of different players who have ever joined (just the number, no names);
- the name, avatar and status (online, away…) of some members of our Discord servers, taken from Discord’s public widget.
If you do not want your statistics to be visible on the website, write to us and we will hide them.
3.9 Rank purchases (VIP and Host) and donations
The VIP and Host ranks and donations are handled through a Discord ticket and paid with PayPal. In that case we process your first and last name and PayPal email address (as PayPal shows them), the amount, the date, the transaction ID, your Minecraft username and the content of the ticket.
- Why: to activate the rank, handle requests and disputes, and prevent fraud.
- Legal basis: performing the contract (Art. 6(1)(b) GDPR) and, for disputes, our legitimate interest in defending our rights (Art. 6(1)(f) GDPR).
- Retention: for as long as the law requires, where it applies, and in any case no more than 10 years after the payment.
We never see or store your card or bank details: only PayPal handles them.
3.10 Contacting us
If you write to us by email or ticket, we use what you send only to reply. We keep it for as long as it takes to deal with your request.
4. Cookies
We only use technical cookies, needed to make what you ask for work. Under the law they do not need your consent (Art. 122 of the Italian Privacy Code; Italian Data Protection Authority cookie guidelines of 10 June 2021). We use no analytics, profiling or third-party cookies.
| Name | Where | What it does | Duration |
|---|---|---|---|
itaprac_session | itaprac.xyz | Keeps you signed in after the Discord login | 30 days, or until you sign out |
itaprac_oauth | itaprac.xyz | Security check during the Discord login | 10 minutes |
itaprac_csrf | itaprac.xyz | Stops other websites from sending forms in your name | 24 hours |
itaprac_session | dashboard.itaprac.xyz | Keeps staff signed in after the Discord login | 7 days, or until you sign out |
You can delete cookies in your browser settings: if you delete the session ones you will just have to sign in again. Our fonts are hosted on our own server: nothing is loaded from Google Fonts or any other external font service.
5. Content loaded from other websites
Some images on our pages are loaded by your browser straight from outside services. When that happens, the service receives your IP address and your browser’s technical details, as with any image on the internet. We send them no other data about you.
- Discord (cdn.discordapp.com): avatars, decorations and Discord server images;
- Crafthead (crafthead.net) and Visage (visage.surgeplay.com): player skins and heads;
- Invetta (invetta.top): the server’s badge from the Invetta server list, at the bottom of the page.
6. Who we share data with
We do not sell your data or hand it over for advertising. Only these can see it:
- the itaprac staff, each only for the part they need (for example, only admins decide on applications);
- Servereasy S.r.l. (Scarperia e San Piero, Italy), which provides the server the websites and the game run on, as our data processor. The data stays in Italy;
- Discord Inc., for sign-in and tickets, as an independent controller under its own privacy policy;
- PayPal (Europe) S.à r.l. et Cie, S.C.A., for payments, as an independent controller under its own privacy policy;
- the services in section 5, limited to your IP when you load their images;
- the authorities, where the law requires it.
7. Transfers outside the European Union
We keep the data in Italy. Discord, PayPal and the services in section 5 may also process data outside the EU, for example in the United States: they do so as independent controllers, with the safeguards described in their own policies (for example the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses).
8. Children
You must be at least 15 to apply to the staff. In Italy, anyone under 14 cannot consent to online services on their own: if you are under 14, use our services only with a parent’s permission. Purchases by minors need the consent of a parent or guardian. If a parent believes we hold their child’s data without a valid reason, they can write to us and we will delete it.
9. Your rights
At any time you can ask us to:
- tell you what data we hold about you and give you a copy (access, Art. 15);
- correct it (rectification, Art. 16);
- delete it, for example your applications or your review (erasure, Art. 17);
- limit how we use it (restriction, Art. 18);
- give it to you in a machine-readable format (portability, Art. 20);
- stop processing based on our legitimate interest (objection, Art. 21);
- withdraw a consent you gave, for example for your review, without affecting what we did before.
Write to itapracstudios@gmail.com or open a ticket on Discord. We reply within one month. We may ask you to prove the account is yours (for example by writing from the Discord account concerned). Some data may be kept if the law requires it or we need it to defend ourselves in a dispute: if so, we will tell you.
If you think we are handling your data unlawfully, you can complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali) or to the authority of the EU country you live in.
10. Automated decisions and security
We make no decisions based solely on automated processing: applications and punishments are decided by people. We protect the data with encrypted connections (HTTPS), access limited to authorised staff, protected sessions, a firewall and regular server updates.
11. Changes
If we change this policy we update the date at the top. We announce important changes on our Discord server.