Privacy statement

Minecraftstore.io is a platform on which owners of Minecraft servers run a webshop. It is operated by TMDProject, registered with the Dutch Chamber of Commerce (KvK) under number 83543937. For anything about your personal data, mail hello@minecraftstore.io.

This statement covers three groups: visitors of minecraftstore.io, owners who have an account, and players who buy in a store on the platform. We follow the General Data Protection Regulation (GDPR, in Dutch the AVG).

We count visits ourselves, without cookies and without anything from a third party. For each page someone opens we keep the page, the language, the website that linked to it (only its domain), the campaign tags in the address (utm), and whether it was a phone, tablet or computer.

To count a visitor once a day, we make a code from the IP address and the browser, mixed with a value that changes every day and is never stored. The IP address and the browser are not kept. Tomorrow the same visitor gets a different code, so we can not follow anyone over days.

When you go from our site to the sign-up page, the site remembers for that browser tab (in sessionStorage, not a cookie) only where you came from, like "search engine", so we know which sources bring in owners.

Why: to see which pages and sources work, which is our legitimate interest. How long: 13 months.

We also use Google Search Console. That shows us which searches led to our site, in totals per search and per page. It holds no data about you as a person.

What: your name, email address, password (only as a secure hash), two-factor and passkey details if you turn them on, your stores with their settings and products, the servers you connect, support tickets, and where you came from when you signed up. When you set up payouts, Stripe asks for your identity and bank details; we only keep the id of your Stripe account and its status.

Why: to provide the platform you signed up for (performance of a contract). Mails about the platform, like new features, are sent because you are a customer (legitimate interest); you can turn them off in your profile or with the link in every such mail. Payments and fees are kept because the law requires bookkeeping (legal obligation).

While you are logged in to the dashboard, your session keeps your IP address and browser, to keep the login safe; it ends after two hours without activity.

How long: as long as you have an account. When you delete it, or ask us to close it, we remove your personal data within 30 days, except what the tax rules make us keep for seven years, such as orders and fees.

When you buy in a store on Minecraftstore.io, the store owner is the seller. We run the store and the checkout for them.

What: your Minecraft name and UUID (we check the name with Mojang before you pay), your email address, what you bought, the amount and the order status. You pay with Stripe; we never see your card or bank details. If you link Discord from your order page, we keep your Discord user id and username, and put you in the store's Discord server with the permission you give at Discord. Your IP address is used for a moment to protect the checkout against abuse and is not kept with your order.

Why: to deliver your purchase in the game, to send you the receipt and, for a product that lasts a limited time, a reminder before it ends (performance of the contract with the store), and to keep the bookkeeping the law requires.

How long: orders are kept for seven years, because of tax rules. A Discord link stays until you or the store owner remove it.

Questions about a purchase go to the store you bought from; you can also always mail us.

We only share what is needed, with these services:

• Stripe (payments and payouts to owners). Stripe is also responsible itself for the payment and identity data it collects.
• DigitalOcean (our server, in Amsterdam, the Netherlands).
• Amazon Web Services (sending email, from Stockholm, Sweden).
• Cloudflare (the domain names of the platform).
• Mojang / Microsoft (checking a Minecraft name), and the public skin services mc-heads.net and nmsr.nickac.dev, which receive a player's UUID to draw their head.
• Discord, only when a store uses it and a player links their account.
• Google, only for the Search Console totals described above.

Some of these are based in the United States. Transfers there are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

We never sell personal data, and we do not use it for advertising.

• minecraftstore.io sets no cookies.
• The stores set no cookies. The shopping cart is kept in your browser (localStorage) so it is still there when you come back; it holds only the products and amounts.
• The dashboard (app.minecraftstore.io) uses a session cookie to keep you logged in and a security cookie against forged requests. Both are strictly necessary, so no permission is asked.

Everything runs over HTTPS. Passwords are stored as a secure hash, secrets like tokens and webhooks are encrypted, and you can protect your account with two-factor authentication or a passkey. A backup of the database is made every night and kept for 14 days.

You may ask us to see, correct or delete your personal data, to limit what we do with it, to receive it in a usable form, and you may object to processing based on legitimate interest. Mail hello@minecraftstore.io; we answer within a month. If you think we handle your data wrongly, you can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

When this statement changes, we update the date below. If a change matters for owners, we mail them before it applies.

Last updated: 12 October 2026.