Legal
Privacy notice
What AlloyMC's sites, accounts, API, emails and the Alloy launcher store about you, why, for how long, and your rights.
The short version: no tracking, no analytics and no ads, anywhere. An AlloyMC account is optional, stores only what it needs, and you can download or delete it yourself at any time. We never sell data.
This notice covers alloymc.dev and its subdomains, AlloyMC accounts, the AlloyMC API, the emails we send, and the Alloy launcher. It is written for the Swiss Federal Act on Data Protection (FADP/DSG) and, for people in the EU and EEA, the General Data Protection Regulation (GDPR).
Who is responsible
Krauss Software, owner Samuel Krauss (brand Elchi Studios), Im Ländli 18, 6315 Oberägeri, Switzerland. Email for privacy questions: legal@elchi.dev; for everything else: contact@elchi.dev. Full details are in the imprint.
Visiting the sites
- No analytics, no advertising, no tracking pixels, and no third-party scripts or fonts. Everything a page needs comes from alloymc.dev itself or cdn.alloymc.dev.
- No access logs. Neither our web server nor our application records the pages you visit or your IP address.
- Rate limits. To slow down password guessing and spam, the server counts recent requests per IP address in memory for a few minutes. These counts are never written to disk and disappear on restart.
- Files from cdn.alloymc.dev (images, fonts, styles, scripts, videos) are delivered through Cloudflare's network, which processes your IP address to deliver them (see Who else is involved).
- Downloads of Alloy come from GitHub, which hosts the releases. GitHub's privacy statement applies to that download.
Legal basis: our legitimate interest in running secure, working websites (Art. 6 para. 1 lit. f GDPR).
AlloyMC accounts
An account is optional. Here is everything it stores, and why.
| What | Why | Who can see it |
|---|---|---|
| Handle, display name, bio, pronouns, links, colour, sigil | Your profile at alloymc.dev/@handle | Everyone, unless your profile is private (then only handle, name and avatar) |
| Email address | Signing in, password reset, security notices | Only you |
| Password, as an Argon2id hash | Signing in. The hash can't be turned back into your password | Nobody |
| Google account ID and whether Google verified your email | Only if you use "Continue with Google" | Only you |
| Signed-in devices: a name like "Chrome on Windows", when it signed in and was last used | So you can see and end sessions under Devices | Only you |
| Who you follow | Follower and following lists | Everyone |
| Linked Minecraft accounts: UUID, name, skin | Shown on your profile unless you hide them | Everyone, unless hidden |
| Reports you send, and reports about you | Moderation | AlloyMC staff |
We don't store IP addresses or locations with your account or sessions. Session tokens are stored only as hashes.
Google sign-in. Google shares your name and email with us when you choose it; the name only fills in your display name at sign-up. We never see your Google password and get no access to anything else in your Google account.
Minecraft linking. Linking uses Mojang's own check, the one Minecraft servers use, so your Microsoft password and tokens never reach AlloyMC. To check the link and draw your avatar, our server asks Mojang's session server and loads your skin from textures.minecraft.net.
Legal basis: the contract between us that you enter by creating an account (Art. 6 para. 1 lit. b GDPR). Moderation and security are based on our legitimate interest in a safe service (Art. 6 para. 1 lit. f GDPR).
Age. You need to be at least 13 to create an account. If you live somewhere that sets a higher age for agreeing to online services on your own (in some EU countries up to 16), you need a parent's or guardian's permission until then.
Emails
We send emails only about your account: confirming your address, password reset links, notices about security-relevant changes (a new password, a changed email address), and a confirmation when you delete your account. No newsletters and no marketing. Emails come from noreply@alloymc.dev through Resend (see below), contain no tracking pixels, and links in them are not rewritten for tracking. Replies go to contact@elchi.dev.
The AlloyMC API
The API at api.alloymc.dev shows public profile data, exactly as visible on the website, to anyone who asks. It never returns email addresses or private profiles' details. Apps that act for you need you to sign in and agree first, and you can end their access under Devices.
The Alloy launcher
- Alloy collects no telemetry or analytics.
- You sign in to Minecraft on Microsoft's own page. Alloy receives sign-in tokens from Microsoft, Xbox Live and Mojang to start the game and keeps them on your PC. It never sees your password.
- To work, Alloy talks directly to Mojang (game files and Java), Microsoft and Xbox Live (sign-in), Modrinth and CurseForge (search, mods and modpacks), the mod loaders' servers (Fabric, Quilt, Forge, NeoForge), and alloymc.dev (checking for updates).
- Alloy looks in your Downloads folder for two things only: its own signed update files, and mod files you downloaded for a modpack that asked for them.
- Signing in to AlloyMC inside Alloy is optional and arrives with Alloy 0.3.
Cookies
Browsing sets no cookies. Signing in sets one cookie, which keeps you signed in and does nothing else. "Continue with Google" also sets a second cookie for up to ten minutes to check that the answer really comes from Google. Staff signing in to the admin area get a separate session cookie there. There are no consent banners because there is nothing to consent to.
Who else is involved
| Who | What for | Where |
|---|---|---|
| Tavuru | The server that runs AlloyMC and stores account data and its backups | Germany |
| Cloudflare, Inc. | DNS for alloymc.dev; delivers files from cdn.alloymc.dev | USA, global network |
| Resend, Inc. | Sending account emails (from its EU region, Ireland) | USA, Ireland |
| Google LLC / Google Ireland | Only if you choose "Continue with Google" | USA, EU |
| Mojang AB / Microsoft | Checking Minecraft links, loading skins | Sweden, USA |
| GitHub, Inc. | Hosting Alloy's releases and source code | USA |
Transfers to the USA rely on the EU-U.S. and Swiss-U.S. Data Privacy Framework where the provider is certified, and otherwise on the standard contractual clauses approved by the European Commission and recognised by the Swiss FDPIC.
We don't sell or rent data, and we don't share it with anyone else unless the law requires it.
How long we keep things
| Data | Kept |
|---|---|
| Your account and profile | Until you delete it |
| Sessions | Until you sign out or they expire: 30 days unused on the web, 90 days in Alloy, 8 hours for staff |
| Email confirmation and reset links | 24 hours and 1 hour |
| Reports | 12 months after they're resolved |
| Staff action log | 24 months |
| Daily backups of the account database (on the same server in Germany) | 14 days |
Deleting your account removes it, your profile, follows, Minecraft links and sessions at once. It disappears from the backups within 14 days. Entries in the staff action log keep only the handle you had, not your account.
Your rights
Under Swiss law you can ask what data we have about you, get it corrected or deleted, and receive it in a common format (Art. 25 to 28 FADP). In the EU and EEA you also have the right to restrict processing and to object to processing based on legitimate interests (Art. 15 to 21 GDPR).
Most of this you can do yourself: download everything as JSON under Account → Your data, edit your profile, or delete the account. For anything else write to legal@elchi.dev. We answer within 30 days.
You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC/EDÖB, Feldeggweg 1, 3003 Bern) or, in the EU, to the data protection authority where you live.
Security
Passwords are hashed with Argon2id, connections are encrypted (HTTPS only, HSTS), session tokens are stored only as hashes, forms are protected against cross-site requests, and sign-in attempts are rate-limited. Found a problem? Write to security@elchi.dev.
Changes
When this notice changes we update the version and date at the top. If a change affects what we do with account data, we email account holders before it applies.