If you have an account
- Your username, which other players can see: it's shown in game when you link your Minecraft account.
- Your email address, to confirm it's yours, to reset your password if you forget it, and for important notices about your account (such as a change of address). We don't send newsletters, and we don't email you when you sign in.
- Your password, only as a salted scrypt hash: nobody, us included, can read it back. We also count wrong passwords in a row, and when the last one was, to lock the account for a while after too many.
- When you created the account, when you confirmed your address, and when you last changed it.
- Your linked Minecraft account, if you link one (it's optional): its UUID and player name, and when it was linked. The game server keeps the link itself, together with your web account's number, your username and your address in masked form (for example
Cole (j***@gmail.com)), so you can see in game which account a player is linked to. Purchases made on the website are logged on the game server with your account number and player. - Your sign-ins: for each browser you're signed in on, a hash of its session token (never the token itself), and when it was created, last used and will end. A sign-in ends 30 days after you last use it, or 180 days after you signed in.
An account whose address isn't confirmed within 48 hours is deleted, with everything above.
When we email you a link
- We email a link and a 6-digit code when you create an account (valid 24 hours), reset your password (30 minutes) or change your address (24 hours, sent to the new address). Both are kept only as keyed hashes, with the number of tries and, for a change of address, the new address, until they're used or run out. These records are deleted within a day after that.
- Rate-limit counters: to stop abuse we count sign-ins, emails and code tries per address, per account and per network address (IP). The counters are keyed by hashes, never by the address or IP itself, and are deleted within two days.
- If the site's bot check is on, the forms that send email use Cloudflare Turnstile, which runs in your browser and sees your IP address; we send Cloudflare the check's result and your IP address to confirm it.
Who else is involved
- Netlify hosts the website, and keeps short-lived request logs.
- Neon hosts the database that holds the account records above.
- Resend delivers our emails, so it sees your address and the email we send.
- Pages show your player's head from mc-heads.net and the server's status from mcsrvstat.us; your browser asks those sites directly, so they see your IP address.
- The game server and its API sit behind Cloudflare, which sees requests to them.
In your browser
- One cookie,
__Host-codexcraft_session, that keeps you signed in. It can't be read by scripts on the page. - Your music on/off choice, in local storage. While you wait to confirm your address or link, the username or address you typed and a link code from the game are kept in this tab's session storage until you're done.
Deleting it
Delete your account from your account page: after you enter your password, we delete your username, address, password hash, sign-ins and emailed links, and ask the game server to drop the link to your Minecraft account. You can also unlink your Minecraft account at any time on that page or with /web unlink in game. Your lots, Crowns and everything in game stay as they are.
Questions, or can't sign in any more? Write to support@codexcraft.com.
Last updated October 2026.