Legal
Privacy policy
Stonevale is built to collect as little about you as possible. This page explains exactly what we store, why, and what you can do about it.
Last updated: Sep 23, 2026
Who is responsible
The controller for this website is the Stonevale team. You can reach us at —.
What we store
Your e-mail address – only encrypted (AES-256-GCM) and as a keyed fingerprint to find your account. We use it to send login links, order receipts and important account messages. Never newsletters unless you ask for them.
Your Minecraft name and UUID – only after you link your account in-game.
What you publish – posts, comments, likes and reports.
Orders – order number, product, amount, the player it was for and the reference of the payment provider. We never see or store card or bank details.
Sessions – a hashed session token, a rough device label (e.g. "Firefox · Windows") and timestamps, so you can see and end your sessions.
We do not store IP addresses in our database. They are only used briefly, in memory and hashed, to stop abuse (rate limiting).
Why (legal basis)
To provide your account, the community features and your purchases (performance of a contract, art. 6(1)(b) GDPR).
To keep our bookkeeping as required by Dutch tax law (legal obligation, art. 6(1)(c) GDPR).
To keep the site safe and free of abuse (legitimate interest, art. 6(1)(f) GDPR).
Who else is involved
Payment providers Mollie B.V. (Netherlands) and/or Stripe Payments Europe Ltd. (Ireland) process your payment on their own secure pages.
Our e-mail provider delivers login and receipt e-mails. Our hosting provider runs the servers inside the EU.
Player heads are loaded by our server from mc-heads.net using only the public Minecraft UUID – your browser never contacts them. For gifts we look up the Minecraft name at Mojang.
We never sell your data and we do not use advertising or tracking.
How long
Login codes expire after 15 minutes and are removed within a day. Sessions end after 30 days of inactivity.
Your account and content stay until you delete them. Orders are kept for 7 years because the law requires it; when you delete your account they are detached from you.
Cookies
We only use functional cookies: your session, the login step, your language and day/night theme. No analytics, no advertising, no third-party cookies – that is why you don't see a cookie banner.
Children
Stonevale is for players of all ages. If you are under 16, please ask a parent or guardian before creating an account or buying anything. Parents can contact us at any time to see or delete their child's data.
Your rights
You can download all your data and delete your account yourself on the "Privacy & data" page of your account.
You can also ask us for access, correction, deletion, restriction or to object. You have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
Read how we protect your data on our security page. Found a problem? Please tell us at —.