Privacy
What we collect, and what we never hold.
MineServer Admin is a control panel for a Minecraft server you already have. We are not a host. Your worlds, your backups and your server files stay where they are and are never on our side. This page says what does reach us, why, how long it is kept and who else sees it.
Last updated 19 September 2026.
Who we are
The service is MineServer Admin, operated by [OPERATING ENTITY]. Where this page says "we" or "us", that is who it means.
Write to us at [CONTACT ADDRESS] about anything here, including a request to see, correct or delete what we hold about you.
What this website collects
- Your email address, if you leave it. The signup form on the front page adds your address to our launch list and sends you one confirmation. We use it to send one message the day MineServer Admin is ready and one when Pro opens, and nothing else. The list is held by Resend, who also send the mail.
- Request logs. Cloudflare serves this site and keeps its own request logs, which include the connecting IP address. Those logs are kept for 30 days.
- No analytics scripts, no advertising, no third-party trackers. There are none on this site, and it sets no cookies. The web panel sets one cookie, the sign-in session cookie, which keeps you signed in.
What the web panel and the plugin collect, and why
The plugin you drop into your server opens one connection out to us and sends: console lines, chat, player names and UUIDs, server stats (players online, TPS, memory, CPU and uptime), the server's software and version, and the token that proves the server is yours. It is a control panel, so everything it shows has to travel to your browser through us.
Never on our side: your worlds, your backups, your server files, the jars themselves, your host's login and any password. There is no password anywhere in this service, and there is no copy of any world.
| What | Why we have it | Where it is kept |
|---|---|---|
| Your email address | Signing you in with a magic link, sending invitations, and reaching you about the service | Our database, in plain text. There is no way to send a link or an invitation without it. |
| Passkey public keys | Signing in without a password | Our database. Only the public half; the private half never leaves your device. |
| Two-factor secrets and backup codes | Checking your second factor when you have switched it on | Our database, encrypted. |
| Sessions | Keeping you signed in, and listing every signed-in browser so you can end one | Our database, and one signed cookie in your browser. |
| Server names, software, Minecraft version, state and when each was last seen | Showing the server in the panel, filtering Modrinth to builds that fit it, and checking plugins before a Minecraft version move | Our database. |
| Console lines from your server | Showing the console in the browser, including the lines printed before your browser joined | In memory, in the live connection for that server: the last 500 lines. Never in a database and never written to a file. |
| Chat | Showing the chat screen and sending your replies back to the server | It passes through the same live connection, and the recent lines sit in the same memory as the console. |
| Player names and UUIDs | The Analytics screen: who joined, playtime, sessions and deaths | Our database. |
| Server stats: players online, TPS, memory, CPU and uptime | The gauges and the readouts on the Overview screen | They pass through the live connection to your browser. We do not write them to the database. |
| Pairing codes | Connecting a server to your account the first time | Our database. A code lasts ten minutes, works once, and is then gone. |
| The plugin's token | Proving the server is yours each time it reconnects | Our database as a SHA-256 hash only. The token itself lives in your server's config/mineserveradmin/agent.json and nowhere else here. |
| An audit row for each change | Showing who changed what, when, and from which address | Our database, redacted as it is written: console commands in full, a webhook address as its host only, tokens never. |
| A Discord webhook address, if you set one | Sending the alerts you asked for | Our database, inside your automation settings. |
Console text and chat pass through our servers in readable form today, so the operator of this service can see a console line. End-to-end encryption between your browser and the plugin is the next thing being built, and this page will say so when it ships.
How long each thing is kept
- Console lines and chat: the last 500 lines per server, in memory. A newer line pushes an older one out. They are never written to a database or a file, and they go when the server is removed.
- Audit entries: 90 days. A nightly job deletes rows older than that. The panel shows you the last 7 days on the free plan and 90 days on Pro.
- Analytics events: kept while the server exists. The panel shows the last 30 days on the free plan, and the whole history for as long as you subscribe on Pro. Deleting a server deletes its analytics and its audit log with it.
- Pairing codes: ten minutes, and one use. Invitations expire and are then deleted by the same nightly job.
- Account data (your email address, passkeys, two-factor, sessions and your servers): until you delete the account.
- Website request logs: 30 days, at Cloudflare.
- Your address on the launch list: until you ask to come off it.
- Backups of the database: we keep copies so the service can be restored after a failure. Cloudflare's own point-in-time restore covers the last 30 days; any export we take is encrypted and older copies are deleted.
Who else sees it
- Cloudflare hosts this site, the panel and the database, and their request logs hold connecting addresses.
- Resend sends our email (magic links, invitations and the launch confirmation) and holds the launch list.
- Modrinth receives your searches and project lookups when you use the plugin and mod manager. Your server then fetches the file from Modrinth itself, so the jar never passes through us.
- Discord receives an alert only if you have set a webhook, and only the alerts you asked for.
Nobody else. We do not sell your data, we do not share it for advertising, and we do not hand it to anyone for their own purposes. We would disclose data where the law requires it, and we would tell you unless we are forbidden to.
Your choices and your rights
- Delete a server, and its analytics and its audit log go with it.
- Delete your account, and your email address, your passkeys, your two-factor secrets and your sessions go with it.
- End a browser session from account settings, where every signed-in browser is listed.
- Stop sending us anything by removing the plugin: delete the jar and the
config/mineserveradminfolder, or type/msa unpair. - Come off the launch list by replying to the confirmation mail, or by writing to us.
- Ask us at [CONTACT ADDRESS] for a copy of what we hold about you, a correction, or deletion. Depending on where you live, data protection law may also give you the right to object, to take your data elsewhere, and to complain to your local regulator.
How it is kept safe
- There is no password to leak. You sign in with a passkey or a magic link. A passkey is bound to this site and cannot be phished, and the private half never leaves your device.
- Two-factor. An account with an authenticator app switched on cannot be entered by a magic link alone. Adding or removing a passkey, or switching two-factor on or off, ends every other session the account holds.
- Tokens are hashed. The plugin's token, the desktop app's token and invitation tokens are stored as SHA-256 only, so they cannot be read back out of our database.
- Every request is checked. Roles are enforced on our side on every call, refusals are written down, and request rates are limited.
- Coming. End-to-end encryption between your browser and the plugin, so that a console line is unreadable to us. It is the first item on the list after launch.
Children
MineServer Admin is not for children under 13, and we do not knowingly collect anything from one. If you believe a child under 13 has given us their email address, write to [CONTACT ADDRESS] and we will delete it.
Changes to this policy
This page changes as the service does, and the date at the top says when it last changed. If a change matters to you, such as a new company processing your data or a new use of something we already hold, we will email account holders before it takes effect.
Questions about any of this go to [CONTACT ADDRESS]. The terms of use are on the Terms page.