Privacy Policy

This Privacy Policy explains how the operator of PharoGames ("we", "us", "our") collects, uses, shares, and protects your personal information when you use the PharoGames network.

PharoGames is a cloud-native Minecraft minigames network operated by an individual based in Canada. PharoGames is not a formally registered company; legal references to a controller mean the operator of PharoGames. Our hosting and processing infrastructure is a self-hosted Kubernetes cluster located in the United States, so your data is stored and processed in the US.

This policy covers the entire PharoGames network:

• Website — pharogames.net (accounts, forums, store, support).
• Game servers — Java IP play.pharogames.net.
• Discord — discord.gg/u3RwhRBwv3 (as it relates to account linking).

PharoGames is not affiliated with Mojang or Microsoft.

Privacy contact: For any privacy question or data-rights request, email privacy@pharogames.net. For general or billing help, email support@pharogames.net.

1. Privacy at a Glance

We built PharoGames to be genuinely privacy-respecting. In plain terms:

• No advertising. We run no ad networks, ad pixels, or marketing trackers.
• No analytics or behavioral tracking. We do not use analytics cookies or third-party tracking technologies.
• We never sell or share your personal data for advertising or cross-context behavioral purposes — to anyone, for any purpose.
• Only three cookies, all strictly necessary — they exist solely to keep you logged in and to protect against cross-site request forgery. No consent banner is required because none of them are optional tracking cookies.
• Concrete retention limits — match history auto-deletes after 90 days; security audit logs (the only place we keep IP addresses) auto-delete after 30 days.
• Chat & voice are moderated. In-game text chat, direct messages, and voice chat may be logged, recorded, retained, and reviewed — including by automated/AI moderation — for safety and rule enforcement (see Section 2). We never use them for advertising and never sell them.
• Card data never touches our servers. All payment card handling is done exclusively by Stripe (PCI-DSS certified).
• Passwords are never stored in plain text — only as a bcrypt hash.

2. Information We Collect

We collect only what we need to run the network, secure it, and process purchases. Below is a complete, honest inventory by category.

2.1 Account & Login

2.2 Social Login (OAuth) — only if you choose it

If you sign in with a social provider, we receive and store:

• Google — sub (subject) id; GitHub — numeric account id; Discord — snowflake user id.
• The email address and display name supplied by that provider.
• The linked-at timestamp.

Your password and login credentials for these providers stay with the provider — we never see them.

2.3 Minecraft & Discord Linkage

• Minecraft UUID and username, and short-lived one-time link codes used to verify the link.
• Discord user id and username when you link Discord.

2.4 Gameplay & Profile

Your player profile may include:

• Per-game stats (kills, wins, deaths, etc.), XP, Coins, Gems.
• Owned cosmetics, owned/selected kits, ranks, battle-pass progress, max killstreaks, vote stats.
• An optional display nickname ("nick" / disguise).
• Join and last-played timestamps.

2.5 Match History

• Per-match records of games you play.

2.6 Leaderboards

• Leaderboards are computed in Redis and are ephemeral — they are derived rankings, not a durable personal record.

2.7 Community

• Forum threads and posts — these are public and are also indexed in Elasticsearch to power search.
• Poll votes.
• Support tickets and their messages — these may contain whatever personal information you choose to type.
• In-app notifications.
• Friend relationships, blocks, and online/offline presence.

About presence and social data: Your online/offline presence is transient, real-time state — we surface it live to other users (for example, to your friends) and do not maintain it as a historical log. In-app notifications, friend relationships, and blocks are kept with your account until you delete it (see Section 7).

2.8 Moderation & Audit

• Moderation records — bans, mutes, kicks, warnings, and player reports, including reason text and the identities of both the target and the moderator.
• Audit events — a security/admin event log of sensitive web actions (login, password reset, account linking) and staff/moderator actions, including the actor's IP address.

About IP addresses: We collect IP addresses only for security audit events (web authentication actions and staff/moderator actions). We do not collect or log IP addresses for ordinary in-game connections.

2.9 Purchases & Payment

• Order records — internal user id, Minecraft UUID, gift-recipient Minecraft UUID (for gifts), items purchased, amounts, currency, coupon code, status, and timestamps.
• Stripe identifiers — checkout session id, payment-intent id, subscription id, refund id.
• Refund requests — reason, your message, and admin notes.

Card data is handled solely by Stripe. Full payment card data is processed exclusively by Stripe under PCI-DSS and never touches PharoGames servers. Your billing email is given to Stripe and is not stored by PharoGames.

2.10 Chat, Direct Messages & Voice

To keep the community safe and enforce our rules, in-game text chat, direct messages, and in-game voice chat may be logged, recorded, retained, and reviewed — including by automated and AI-assisted moderation systems. We may use this content to detect and act on abuse, harassment, cheating, and other rule or legal violations, and to handle reports and appeals.

We keep this moderation content only as long as needed for those safety purposes. We do not use the content of your messages or voice for advertising, and we do not sell it.

3. How We Use Your Information

We use your information for the following purposes, and only these:

4. Legal Bases for Processing (GDPR / UK-GDPR)

If you are in the EU or UK, we rely on the following legal bases for each purpose:

• Performance of a contract — to create and secure your account, run the games you play, process purchases and auto-renewing Rank subscriptions, and deliver the services you request. Social login is also processed on this basis: when you choose to sign in with Google, GitHub, or Discord, that identity check is part of providing the account you asked for. (If you withdraw a social-login connection, that sign-in method will stop working and you may need an email/password login to keep access — the account itself does not rely on ongoing consent.)
• Legitimate interests — to secure the network; moderate the community; prevent fraud, payment abuse, and ban evasion; maintain audit logs; and retain anonymized order and ban records after account deletion for chargeback defense, fraud prevention, and ban-evasion prevention. We balance these interests against your rights.
• Legal obligation — to retain order and tax-related records for the period required by law and to respond to lawful requests.
• Consent — for the limited cases where the law requires it (for example, optional features you choose to enable). Where consent is the basis, you may withdraw it at any time.

PIPEDA (Canada): For Canadian users, we collect, use, and disclose personal information based on your consent (express or implied, as appropriate) and for purposes a reasonable person would consider appropriate in the circumstances. By using PharoGames you consent to the practices described in this policy. Cross-border handling of Canadian personal information is described in Section 10.

5. Cookies & Similar Technologies

PharoGames uses only three cookies, all strictly necessary:

We use no analytics cookies, no advertising or marketing cookies, and no third-party tracking pixels or technologies.

Because every cookie we set is strictly necessary to deliver the service you request, no cookie consent banner is required under EU/UK rules — there is nothing optional to consent to.

6. How We Share Information

We do not sell or share your personal data for advertising or cross-context behavioral purposes. We share data only with the service providers (sub-processors) needed to run PharoGames, and only the minimum required. Otherwise, we disclose personal information only where necessary to comply with the law, enforce our terms, or protect the safety of our users and the network.

6.1 Sub-Processors & Data Recipients

These recipients act as our service providers/processors: they process the data only to perform the service we have engaged them for, not for their own independent purposes.

6.2 Internal Infrastructure

The following components run on our own US Kubernetes cluster and process data on our behalf — they are part of PharoGames, not independent third-party recipients:

• MongoDB — primary data store.
• Redis — ephemeral state and leaderboards.
• NATS — internal messaging.
• Elasticsearch — forum/search indexing.

6.3 Legal & Safety Disclosures

We may disclose information when we reasonably believe it is necessary to comply with a legal obligation, enforce our terms, investigate fraud or abuse, or protect the rights, property, or safety of our users, the public, or PharoGames.

7. Data Retention

We keep personal information only as long as needed for the purpose it was collected, then delete or anonymize it. Concrete limits:

When you delete your account, we erase your personal data and keep only the legal minimum described above.

8. Your Rights & Choices

Depending on where you live, you have some or all of the following rights. We honor these rights for all users wherever practical.

• Access & portability — request an export of the personal data we hold about you.
• Deletion / erasure — delete your account. We erase your personal data and retain only the legal minimum (for example, anonymized order records for tax and chargeback purposes, and ban records keyed to a Minecraft UUID for ban-evasion prevention).
• Correction / rectification — fix inaccurate or incomplete data.
• Objection / restriction (GDPR/UK-GDPR) — object to or restrict certain processing based on legitimate interests.
• "Do Not Sell or Share" (CCPA/CPRA) — PharoGames does not sell or share personal data for advertising or cross-context behavioral purposes, so there is nothing to opt out of; we honor the right regardless.

How to exercise your rights: Use your account settings for self-serve actions (export and deletion), and/or email privacy@pharogames.net. We respond within 30 days (see Section 8.1 for California's 45-day standard). We will never retaliate or discriminate against you for exercising your rights. If we cannot fulfill a request, we will explain why, and you may appeal by replying to our response or contacting privacy@pharogames.net.

Payment data held by Stripe. Some payment information — your billing email and your card data — is held by Stripe under Stripe's own privacy policy, not by PharoGames. We cannot access, export, or delete data we never store. To exercise rights over that data, please contact Stripe directly. We can still act on the order records we keep (described in Section 2.9).

8.1 California Privacy Rights (CCPA / CPRA)

This section provides the disclosures required for California residents and serves as our Notice at Collection.

Categories of personal information we collect. In the past 12 months we have collected the following CCPA categories. For the specific data points in each, see the inventory in Section 2.

Business / commercial purposes for collection. We use these categories to authenticate you, run the games, process payments and subscriptions, deliver and restore purchases, moderate for safety, prevent fraud and ban evasion, send transactional email, and provide support — as detailed in Section 3.

Sensitive personal information. We use sensitive PI (your login credentials) only for the permitted purpose of providing and securing the service. We do not use or disclose sensitive PI to infer characteristics or for any purpose that would trigger the right to limit beyond these permitted uses, and we do not sell or share it.

Categories disclosed to service providers (past 12 months). We disclosed identifiers, customer/account information, commercial information, and internet/network activity to service providers strictly to perform services for us (see the sub-processor table in Section 6.1 — Stripe, the OAuth providers, Resend, Mojang/Microsoft, and mc-heads.net). We disclosed these for the business purposes in Section 3.

No sale or sharing. In the past 12 months we have not sold and have not shared (for cross-context behavioral advertising) any category of personal information, and we do not do so. We have no actual knowledge of selling or sharing the personal information of minors under 16.

Your California rights. As a California resident you have the right to:

• Know / access the categories and specific pieces of PI we have collected, the sources, the purposes, and the categories of recipients.
• Delete the PI we have collected from you, subject to legal exceptions.
• Correct inaccurate PI.
• Opt out of the sale or sharing of your PI — though we do not sell or share it.
• Limit the use of sensitive PI — we already restrict it to permitted purposes only.
• Non-discrimination — we will not deny service, charge a different price, or provide a different quality of service because you exercised your rights.

How to submit and verify a request. Email privacy@pharogames.net or use your account settings. We verify your request by confirming control of your account (for example, via your verified email) and matching the request to the information we hold. We will respond within 45 days, and may extend once by a further 45 days where reasonably necessary, with notice to you.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof of your written permission and may still ask you to verify your own identity directly.

9. Children's Privacy (COPPA + PIPEDA)

Anyone of any age may play the Minecraft game servers (Minecraft accounts are managed by Mojang/Microsoft).

Our website — including accounts, forum posting, support tickets, and purchases — is not directed to, and may not be used by, children under 13. You must be at least 13 to create a website account; registration asks for your date of birth and blocks under-13 sign-ups.

We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you are a parent or guardian and believe your child under 13 has provided us personal information, contact privacy@pharogames.net and we will remove it.

9.1 Minors and Purchases

Users under the age of majority in their jurisdiction must have a parent or guardian's permission to make purchases. Because Ranks are auto-renewing monthly subscriptions (a recurring charge), that permission must cover the recurring charge. A parent or guardian may cancel the subscription at any time through account settings or by contacting support@pharogames.net.

10. International Data Transfers

The operator of PharoGames is in Canada, and your data is stored and processed in the United States on our self-hosted infrastructure. If you access PharoGames from outside the United States — including from Canada, the EU, or the UK — your personal information will be transferred to and processed in the US.

There is no EU or UK adequacy decision covering this transfer, and the operator is not certified under the EU-US / UK-US Data Privacy Framework. We therefore rely on the mechanisms and safeguards below.

10.1 EU and UK Transfers (GDPR / UK-GDPR, Chapter V)

For personal data transferred from the EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) as our Article 46 transfer mechanism. For personal data transferred from the UK, we rely on the UK International Data Transfer Addendum (IDTA) to the SCCs (or the standalone UK IDTA, as applicable).

We have carried out a transfer impact assessment considering the destination (US) legal environment and the nature of the data, and we apply supplementary technical and organizational measures to protect transferred data, including:

• Encryption in transit (TLS) for data moving between you, our services, and our sub-processors;
• Hashing of credentials (passwords stored only as bcrypt hashes; signed session tokens);
• Strict access controls limiting who can access personal data, and audit logging of sensitive actions;
• Data minimization and short retention windows (see Section 7).

Consent is not our primary transfer mechanism. We may rely on a derogation under Article 49 (such as your explicit consent, or necessity for performance of your contract) only in the limited, occasional cases the law permits, and never as a standing basis for systematic transfers.

You may request a copy of, or more information about, the relevant SCCs/IDTA by emailing privacy@pharogames.net.

10.2 Canadian Transfers (PIPEDA)

Under PIPEDA, transferring personal information to a service provider in another country for processing is a permitted "use," but it does not by itself reduce our accountability. We remain accountable for personal information sent to our US infrastructure, and we use contractual and technical measures to ensure a comparable level of protection while it is processed in the US. Because the data is stored in the US, it may be subject to lawful access by US authorities under US law. If you have questions about this cross-border handling, contact privacy@pharogames.net.

11. Data Security

We protect your data with industry-standard measures, including:

• bcrypt-hashed passwords (cost factor 10) — passwords are hashed at rest; we never store plain-text passwords.
• RS256-signed session tokens.
• httpOnly session cookies, so session tokens are not exposed to client-side scripts.
• TLS encryption in transit.
• Security headers — HSTS, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a strict referrer policy.

The encryption described above protects data in transit (TLS), and passwords are stored only as bcrypt hashes. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify affected users and any applicable regulators as required by law.

12. Third-Party Links & Services

PharoGames links to and integrates with third-party services — including Discord, Mojang / Microsoft, and Stripe — that have their own privacy policies. This policy does not cover their practices; please review the privacy policy of any third-party service you use.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice (for example, on the website or by email) before the changes take effect. The "Effective date" at the top reflects the latest version. Your continued use of PharoGames after an update means you accept the revised policy.

14. Contact Us

For privacy questions or to exercise your rights:

• Privacy & data requests: privacy@pharogames.net
• General & billing support: support@pharogames.net

Canadian users may also contact the Office of the Privacy Commissioner of Canada (OPC) if they have unresolved concerns about how we handle their personal information.

EU and UK users may also lodge a complaint with their local data protection authority (DPA).

PharoGames is not affiliated with Mojang or Microsoft.