Privacy policy

Who is responsible

Eric Mollenthiel, sole trader, publisher of nimblock.com (legal notice). For any question about your data: team@nimblock.com.

There is no data protection officer: the business is a sole trader and is not required to appoint one. The publisher answers directly.

What is processed, and why

Your account

• Your email address: used to sign you in, confirm your registration, reset your password and tell you about your servers. Legal basis: performance of the contract, which is the terms of use.
• Your password: never stored in the clear, only a digest computed by a hashing function designed for it. Nobody, the publisher included, can read it.
• The dates of account creation, address confirmation and last sign-in, plus the date and version of the terms you accepted. Legal basis: performance of the contract, and the legitimate interest in being able to prove that acceptance.

Your servers and your plugins

• Your servers' names, their configuration, their memory and disk usage: without which there is no service.
• The IP address from which you accept the Minecraft EULA, with the date. That acceptance is what makes you the operator of the server; it has to be provable. Legal basis: legitimate interest, and an obligation arising from Mojang's licence.
• The plugins you build in the studio and their successive versions.
• Your servers' worlds, as they exist on disk.

The site itself

• The web server's technical logs contain, as on any site, visitors' IP addresses, the page requested and a timestamp. They serve security and fault diagnosis, never audience measurement. Legal basis: legitimate interest.
• Per-IP counters limit the number of sign-ups, password requests and sign-in attempts. They protect existing accounts and expire on their own after an hour.

There is no analytics, no advertising, no resale and no profiling, and no data is used to train an artificial intelligence model. Fonts are served from our own servers: loading this page calls no third-party site.

The players on your servers

A Minecraft server writes into its logs the username and IP address of every player who connects, along with whatever is written in chat. Those lines appear in the panel's console and are kept in the server's volume.

For that data, you are the controller: you are the operator of the server, you decide who plays there and what you do with it. NimBlock acts as your processor, and uses those logs for nothing other than running your server and showing them to you. Nobody but you can reach them from the panel.

In practice: if one of your players asks for their data to be erased, the request is yours to answer. Write to us if you need help with it.

A server's console is broadcast on a private channel, reserved for its owner. Servers are also isolated from one another: none can read another's files or console.

Who else sees this data

• OVH SAS (France) hosts the physical server and carries the platform's email. Processor, data in France.
• Mojang Studios / Microsoft: when a player joins your server, it queries Mojang's authentication servers to check the account is really theirs. That check, imposed by the game, involves a transfer outside the European Union, covered by Microsoft's safeguards.

Apart from those two, nobody. No data is transferred, rented or sold. It would only be disclosed to an authority under a judicial order.

For how long

• Account: as long as it exists. An account closed, at your request or after twelve months without a sign-in, is erased along with its servers and their worlds.
• Game server logs: they live in the server's volume and disappear with it.
• Web server logs: 14 days, then automatic deletion.
• Password reset requests: one hour, then deletion.
• Proof of acceptance of the terms and of the EULA: kept for the duration of the relationship, then for the applicable limitation period.

Cookies

This site only sets cookies that are strictly necessary for it to work, which is why no banner asks for your consent:

• a session cookie, which keeps you signed in from one page to the next;
• a "remember me" cookie, so you are not signed out between two evenings of play;
• a form anti-forgery token, which stops another site from submitting a form in your name;
• a temporary authorisation to receive the live console of the server you are looking at.

No advertising cookie, no analytics cookie, no third-party cookie.

Security

• The whole site is over HTTPS, passwords are hashed, and confirmation and reset tokens are single-use and short-lived.
• Every game server runs in an isolated container, on its own network, with no access to other servers or to the rest of the machine, and can only reach outside what a game server needs.
• The component that drives the containers runs under a system account separate from the site's: the site only hands it intentions.

Your rights

You can request access to your data, its rectification, its erasure, the restriction of its processing, object to processing based on legitimate interest, and receive your data in a reusable format (portability).

One address for all of it: team@nimblock.com, from your account's address. Answer within a month. If you are under 18, your parents can exercise these rights for you.

If the answer does not suit you, you can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (cnil.fr), 3 place de Fontenoy, 75007 Paris.

Under-15s

NimBlock is not open to children under 15; that is the minimum age set by the terms of use. If we learn that an account belongs to a younger child, it is closed and its data erased. A parent who finds that such an account exists can write to us: it will be handled as a priority.

Changes to this document

This policy may be updated. Any substantive change is announced by email to your account's address before it takes effect. The date shown at the top of this page is that of the version you are reading.