Privacy Policy

Last updated 6 September 2026

1. Who is responsible

The data controller for Bonut (play.bonut.lol and bonut.lol) is the operator of the server, contactable at akkez0r2@gmail.com.

Our servers are hosted in the European Union with Contabo GmbH, so this policy is written around the UK/EU General Data Protection Regulation. If you are outside the EU, we apply the same standard to you anyway.

2. What the game server records

Connecting to a Minecraft server necessarily reveals some information. We store:

• Your Minecraft username and UUID. Your UUID is how every record below is keyed. It is issued by Mojang, not by us.
• Your IP address. Recorded in the server's connection log, used to enforce bans and to block brute-force and denial-of-service attempts.
• Gameplay and economy data. Your balance, shards, kills, deaths, playtime, first join and last seen timestamps, rank, badges, personal settings, and totals such as money earned and spent, mobs killed and blocks mined.
• Things you make and do in the world. Builds, chest contents, homes, team membership, auction listings, market orders and trades.
• Chat messages and commands. Written to the server log, and visible to staff. Private messages sent with /msg are not end-to-end encrypted and can be read by staff — treat nothing typed in game as confidential.
• Moderation records. Warnings, mutes and bans, with the reason, the staff member who issued it, and when it expires. Reports you file about other players, and reports other players file about you.
• Anticheat records. Our anticheat writes a line when a check is triggered, containing your name, which check fired, and your coordinates at the time.

We do not ask for or store your real name, your postal address, your date of birth, your Minecraft password, or your Microsoft account credentials. We could not read your password if we wanted to — authentication happens between your client and Mojang.

3. What this website records

This site is deliberately plain:

• No cookies. None at all, so there is no cookie banner to click.
• No analytics and no tracking pixels. No Google Analytics, no Meta pixel, nothing equivalent.
• No third-party requests. Every font, style and script is served from bonut.lol. Loading this page contacts no other company.
• No account, no sign-up, no forms. There is nothing here to submit.

The web server keeps a standard access log for security and debugging: your IP address, the time, the page requested, the HTTP status, your browser's user-agent string, and the referring page if your browser sends one.

The live player count you see on the front page is an aggregate number. It does not contain or reveal who is online.

4. Why we hold it

Under the GDPR we rely on these legal bases:

• Performance of a contract — your UUID, username and gameplay data. Without them there is no way to give you an account, a balance, or your builds back when you log in.
• Legitimate interests — IP addresses, logs, anticheat records and moderation history, so that we can keep the server secure, stop cheating, enforce bans and diagnose faults. We think this is what any player would reasonably expect from a game server.
• Legal obligation — keeping records of purchases where tax or accounting law requires it.
• Consent — for anything optional, which we would ask for separately. Nothing currently depends on it.

We do not carry out profiling or automated decision-making with legal effects. Our anticheat can automatically kick an account, but it does not make decisions about you outside the game, and every automated punishment can be appealed to a human.

5. Who else sees it

We do not sell your data, and we do not share it for advertising. It is disclosed only to:

• Mojang Studios / Microsoft — the server verifies every login against Mojang's session servers, which is what stops people impersonating your account. Their handling of that is covered by Microsoft's own privacy statement.
• Contabo GmbH — our hosting provider, which necessarily stores the server's disks and handles its traffic.
• Our payment processor — if you buy a rank. Payment is handled entirely by the store's processor; card numbers never reach us and we never see them. We receive only confirmation that a purchase succeeded and which account to apply it to.
• Other players — your username, rank, statistics, auction listings and anything you type in public chat are visible in game by design. Your IP address never is.
• Law enforcement — only where we are legally required, or where it is necessary to investigate a serious threat.

6. How long we keep it

• Account and gameplay data — while your account exists on the server, and then for up to 12 months after your last login, so that returning players get their progress back.
• Server and website logs — typically rotated out within 30 days.
• Anticheat records — kept while relevant to an ongoing investigation, and routinely pruned.
• Ban and moderation records — kept while a ban is in force and afterwards for as long as needed to enforce it against evasion. Permanent bans keep a permanent record; that is the only way a permanent ban means anything.
• Purchase records — for as long as tax and accounting law requires, typically several years.

7. Your rights

If the GDPR applies to you, you have the right to:

• Access a copy of what we hold about you.
• Rectify anything inaccurate.
• Erase your data ("right to be forgotten").
• Restrict or object to processing based on legitimate interests.
• Port your data to yourself or another service in a machine-readable form.
• Withdraw consent at any time, where consent was the basis.
• Complain to your national data protection authority.

Email akkez0r2@gmail.com from an address we can tie to your account, or ask in game so we can confirm you control the account. We will respond within one month.

One honest limit on erasure. If you are banned, we will delete your gameplay and economy data on request, but we will keep the minimum needed to keep the ban enforceable — typically your UUID and the reason. Erasure is not a route back in. We may also refuse to delete records we are legally required to keep, such as purchase receipts.

Deleting your data does not automatically remove builds you left in the shared world, because those are part of the map rather than part of your record. Tell us if you want a specific build removed and we will consider it.

8. Children

Bonut is not directed at children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account with us, email us and we will delete it. Where local law sets a higher age of digital consent, that age applies.

9. Security

This website is served over HTTPS. The server runs behind a firewall with only the game port and the web ports exposed, with automated blocking of repeated failed logins, and administrative access restricted to the operator. Backups are taken regularly.

No system is perfectly secure and we cannot guarantee absolute security. If we discover a breach affecting your personal data, we will notify the relevant supervisory authority and, where the risk to you is high, tell you directly.

10. Changes

We will update this policy as the server changes. The date at the top always reflects the current version, and material changes will be announced in game or on this site.

11. Contact

Privacy questions, access requests and deletion requests: akkez0r2@gmail.com.