Privacy Policy

Introduction

MCWorldTools ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you visit mcworldtools.com.

Data Controller

MCWorldTools is run by an individual based in the United Kingdom, who is the data controller for the personal data described here. For privacy questions or requests, please use our contact form.

Information We Collect

Account Information

• Email address and username (required to create an account)
• Password (stored securely using industry-standard hashing — we never store or have access to your plain-text password)
• Minecraft UUID (optional — you can link your Minecraft profile to display your skin)
• Saved content (armor builds, banner designs, skin files, favourited items)

Other Information You Provide

• Contact form submissions (email address, message content, and the IP address the message was sent from — kept to detect and block spam)
• Feature suggestions sent from the Suggest a feature page (you must be signed in: we store your idea with your account email and username, and the sending IP address). Suggestions are seen only by us, never published, and are kept and deleted in the same way as contact form submissions
• Minecraft usernames entered in the UUID Lookup tool (used to query the public Mojang API)

Automatically Collected Information

• Usage data via Google Analytics (page views, session duration, device type, browser, operating system, referring website). Analytics cookies are only set with your consent; before you consent, Google still receives basic, cookieless signals (see Cookies below)
• Aggregate tool usage statistics (e.g. number of commands copied, files opened) — anonymous counters with no personal information. If you are signed in, individual tool-usage events may also be associated with your account so we can understand how members use the site; logged-out visitors' tool usage is recorded without any link to who they are
• If you are signed in, we also record how many times you have visited, when you last visited and which page you signed up from, so we can see how members use the site
• Error reports when something on the site breaks: the error message, the page address and your browser type. These are not linked to your account or IP address
• IP addresses in server logs for security and rate limiting purposes. Our authentication provider also logs the IP address and browser used for each sign-in, for security

UUID Lookup Data

When you use the UUID Lookup tool, we query the public Mojang API with the username you enter. The returned player UUID, username, and skin URL are stored in our lookup cache so subsequent lookups for the same player don't hit the Mojang API again. UUIDs are stable public identifiers issued by Mojang and the cache is kept indefinitely; if you would like your entry removed you can request erasure via our contact form.

The same cache is also filled when you open a player save file in one of our editors. Your world and save-file contents are never uploaded — that part is processed entirely in your browser — but the player UUID contained in the file is sent to us so we can show the correct username and skin alongside your data, and that lookup is cached in the same way. If you would rather that entry was not kept, you can request its removal using the same contact form.

What We Do NOT Collect

• Your Minecraft world files (level.dat, player.dat, etc.) — these are processed entirely in your browser and never uploaded
• Player inventory contents, world data, or save files
• Payment information

Community Designs

If you have an account you can publish a design (a banner, shield or skin) to the public Community Designs gallery. Publishing is always your choice — nothing you save is shared unless you publish it.

• What becomes public — once a moderator approves it, the design itself, the title you give it, your username and the date appear in the gallery, where anyone can view, download or copy it. Your email address is never shown.
• Moderation — every design is reviewed by a moderator before it appears, and may be removed later with an optional reason that only you and moderators can see.
• Likes, copies and reports — when you like, copy or report a design we store that against your account (and the reason you give for a report), so each person counts once and moderators can act on reports. Who liked, copied or reported a design is never shown publicly — only the number of likes and copies is.
• Removing it — you can unpublish your own design at any time unless a moderator has removed it or it is hidden pending review of reports. Deleting your account deletes all of your published designs, likes, copies and reports. Copies that other people already saved to their own accounts before then stay in their saves. A design a moderator has removed is kept (hidden from everyone but you and moderators) until you delete your account; you can ask us to erase it sooner via the contact form.

Share Links

When you create a share link, the design you are sharing (including any text in it, such as sign or book text) is stored on our servers so the link works. Anyone with the link can view it. Share links are not tied to your account, so they are not deleted when you delete your account; to remove one, send us the link via the contact form.

Legal Basis for Processing (GDPR)

We process personal data on the following legal bases:

• Consent — Analytics cookies are only set after you accept them via the cookie consent banner. In the UK, EEA and Switzerland, advertising cookies are only used after you agree via the consent message shown on our site (see Advertising). You can change or withdraw your choices at any time using the Privacy and cookie settings link at the bottom of every page.
• Contract — When you create an account, we process your email, username, and saved content to provide the account features you signed up for (saving builds, favourites, syncing across devices).
• Legitimate interest — We use IP-based rate limiting and server logs to protect the site from abuse. Contact form data is processed to respond to your inquiries. UUID lookups are cached so the lookup feature works without exceeding third-party API limits. Member activity (visit counts, last visit, sign-up page) and account-linked tool usage are used to understand how the site is used. You can object to any of this processing (see Your Rights below).

How We Process Your Minecraft Files

Your files never leave your device. All Minecraft world files (level.dat, player.dat, etc.) are processed entirely within your web browser using JavaScript. We do not upload, store, or have any access to your world data.

When you download a modified file, it is generated locally in your browser and saved directly to your device.

Your Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following data protection rights under the GDPR:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate or incomplete data.
• Right to erasure — Request deletion of your personal data where there is no compelling reason for continued processing.
• Right to restriction — Request that we restrict processing of your data in certain circumstances.
• Right to data portability — Request transfer of your data in a structured, machine-readable format.
• Right to object — Object to processing based on legitimate interests.
• Right to withdraw consent — Where processing is based on consent (e.g. analytics cookies), you can withdraw consent at any time using the Privacy and cookie settings link at the bottom of every page, which reopens the cookie banner (and, in the UK, EEA and Switzerland, Google's ad consent message). Withdrawing analytics consent also deletes the Google Analytics cookies from your browser. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using our contact form. We will respond to your request within 30 days.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.

Data Retention

• Account data — You can delete your account at any time from your account page. This immediately deletes your profile, saved designs, favourites, community designs, likes, copies, reports and any messages you sent through the contact form from that email address. Tool-usage events linked to your account are kept with that link removed. We keep a security log entry recording that the deletion happened, including the IP address and browser used.
• Contact form submissions — The message, your email address and the sending IP address are retained while we handle the enquiry and for a period afterwards so we can recognise follow-ups and repeat spam. You can ask us to delete a submission at any time via the contact form.
• Google Analytics data — Retained for the period set in our Google Analytics settings (at most 14 months), then automatically deleted.
• UUID lookup cache — Player UUID, username, and skin URL are retained indefinitely so repeat lookups don't hit the Mojang API. Individual entries can be removed on request via the contact form.
• Aggregate usage statistics — Anonymous tool usage counters (e.g. total commands copied) are retained indefinitely as they contain no personal information.
• Rate limiting — IP addresses used purely for rate limiting are held in memory only and cleared when the server restarts. They are not written to the database.
• Stored IP addresses — Two places do store an IP: contact form submissions (see above) and admin audit logs, which record administrative actions for security purposes. Both are retained until no longer needed for those purposes.
• Share links — Kept until you ask us to remove one via the contact form.
• Error reports — Kept while we investigate and fix the problem.
• Cookie preferences — Stored locally in your browser until you clear your browser data.

Third-Party Services

We use the following third-party services:

• Google Analytics — Website analytics (with consent) (Privacy Policy)
• Google AdSense — Advertising (non-personalised ads) (How Google uses cookies in advertising)
• Vercel — Website hosting and deployment (Privacy Policy)
• Supabase — Database, sign-in and accounts, hosted in the EU (Ireland) (Privacy Policy)
• Resend — Delivers contact-form messages to our inbox (Privacy Policy)
• Mojang API — Player UUID and skin lookups; skin images load from textures.minecraft.net (Privacy Policy)
• mc-heads.net — Shows Minecraft avatars on your account page; your browser loads the image directly, so mc-heads.net sees your IP address (mc-heads.net)

International Data Transfers

Our database provider, Supabase, stores data in the EU (Ireland). Google, Resend and Vercel may process data in the United States or other countries outside the UK and European Economic Area. These providers maintain appropriate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) where applicable. By using our site, you acknowledge that your data may be transferred to and processed in these locations.

Children's Privacy

You must be at least 13 to create an account. If you are under 18, please check with a parent or guardian first. We don't ask for your real name, and your email is never shown publicly; only your username appears if you publish a design. If you believe a child under 13 has an account or has contacted us, tell us through our contact form and we will delete their data.

Contact Us

If you have any questions about this Privacy Policy, your data, or wish to exercise your data protection rights, please contact us through our contact form.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this page periodically.