Controller
The controller within the meaning of the GDPR is the person named in the <a href="/impressum">Imprint</a>.
Data we collect
When you visit the site we process technical access data (truncated IP, browser, referrer). When you log in via Discord we store display name and avatar URL. When you vote or submit a server we store timestamps and (for 30 days) IP/User-Agent hashes for fraud detection.
Legal basis
Processing rests, depending on the case, on Art. 6(1)(a) (consent, e.g. reminder notifications), (b) (contract, e.g. Discord-based server claim) or (f) GDPR (legitimate interest, e.g. security and spam protection).
Storage duration
Server status data 365 days, IP/User-Agent hashes 30 days, session tokens 14 days of inactivity, backups 7 days. Votes remain as anonymous counters indefinitely.
Third-party services
Cloudflare Inc. (CDN, USA) processes edge requests including truncated IP addresses. Discord (Discord Ireland Ltd.) processes logins via OAuth. Google AdSense (Google Ireland Ltd.) serves ads after your consent, see the “Google AdSense and consent” section.
Cookies and local storage
We set one required session cookie (mcvote_session). The reminder banner uses optional local storage and the browser Notification API (opt-in). Advertising cookies are set by Google AdSense only after your consent; without consent no ads are loaded.
Google AdSense and consent
On server detail, wiki and plugin pages we embed Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The AdSense script is loaded with the page; for visitors from the EEA, the UK and Switzerland, Google shows its certified consent message (banner) before any ad is displayed. Without consent, no ads are served and no advertising cookies are set. With consent, Google processes your IP address, device and browser data and cookie/local-storage identifiers to deliver and measure ads and to detect invalid traffic. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw consent at any time via the re-displayable Google consent message or Google's ad settings.
Your rights
You have the right to access, rectify, erase, restrict, object and data portability (Art. 15–21 GDPR). Consent can be withdrawn at any time. Contact via the <a href="/impressum">Imprint</a>.
Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority, especially in your member state of habitual residence or at the place of the alleged infringement.