Privacy, in
plain language.

Who is responsible

Data controller: MineBots. Contact [email protected] for privacy requests. Before public release, the operator must add its registered legal name, full postal address, and any required local representative here.

Information we collect

Account and sign-in information

When you create or use a MineBots account, we process your email address, an internal MineBots user ID, and, if available, your display name. If you choose Google sign-in, Google provides a Google account identifier and the profile information you authorize, such as your email address and name. We use this information to create and secure your account.

For passwordless email sign-in, we process one-time verification-code requests. The code is stored in our database as a keyed hash rather than readable text, expires after 10 minutes, and is limited to five attempts. We also store the email address, request time, expiry and consumption status, attempt count, and a keyed hash of the requester’s IP address for rate limiting and abuse prevention. Challenge records older than 24 hours are removed when a later email-code request is processed; if there is no later request, those records may remain longer. We do not collect or store account passwords.

Session and security data

To keep you signed in, MineBots processes access tokens that expire after 15 minutes and refresh sessions that expire after 30 days. The app stores session tokens using the device’s secure storage; our database stores only a hash of each refresh token, along with expiry and revocation status. Revoked and expired session records may remain associated with your account until the account is deleted. Infrastructure providers may process connection details such as IP address, request time, and diagnostic information to deliver and secure the service; their retention depends on the provider and production configuration.

Information you send us

If you contact support, we receive the email address you use, the contents of your message, and any information you choose to include. Correspondence used only to handle a deletion request is removed from the support mailbox within 30 calendar days after the request is completed, unless a specific legal or security need requires us to retain a limited record. Other support correspondence is kept only as long as needed to handle the request. Please don’t send passwords, one-time sign-in codes, or payment-card details.

Bot and session details

When you connect a Minecraft account or server, MineBots processes the account identifier, server address and port, bot/session settings, proxy details, Microsoft-linking data where used, status, and operational history needed to run and display the features you request. Proxy and Microsoft credentials are encrypted before storage.

Notifications and rewards

If you allow Android push notifications, we process your Firebase device token and app-activity timestamps to send bot status, bot-time expiry, reward availability, and inactivity reminders. You can turn notifications off in Android settings; when the app detects that permission was removed, it disables that device token. We record reward claims and cooldowns. MineBots does not currently integrate a video-ad provider, so a reward claim does not verify that an advertisement was watched.

We collect details directly from you through the app and website, from the device and accounts you connect, and from sign-in, email, push-delivery, and hosting providers. We use them for the purposes described below.

How we use information

• Create and maintain your MineBots account and authenticate your sign-in.
• Deliver requested features, including email verification and bot-session management.
• Send the push notifications you allow and maintain their delivery status.
• Protect the service against spam, fraud, unauthorized access, and abuse.
• Respond to support requests, account recovery, and deletion requests.
• Meet legal obligations and enforce our terms when applicable.

We process account, bot, and support data to provide the service you request; sign-in and abuse-prevention records to secure accounts and the service; and device tokens and app-activity timestamps to deliver notifications you allow. We retain data where required by law. Reward controls currently record reward claims but do not verify video-ad views. If advertising, analytics, or paid purchases are introduced, we’ll update this policy and relevant app-store disclosures first.

When information is shared

We share only what is needed with service providers that help operate MineBots:

• Google processes sign-in when you choose Continue with Google. Google’s own privacy terms apply to Google services.
• Firebase Cloud Messaging delivers Android push notifications and processes the device token and notification content.
• Resend delivers one-time sign-in emails and receives the recipient email address and the message, including the verification code, needed for delivery.
• Microsoft processes account-linking data when you choose to link a Microsoft account; the Minecraft server you choose receives the connection details needed to run your bot.
• Hosting and infrastructure providers process the account and service data stored on our API and database and may process connection and diagnostic logs to run and secure the app and website.

Some providers may process information outside Türkiye or the EEA. The operator must confirm and disclose the actual hosting regions, provider list, and lawful transfer safeguards before public release. We may disclose information if required by law or to protect users and MineBots. We do not sell personal information.

Retention and deletion

We keep account information while your MineBots account is active. Email codes expire after 10 minutes. Challenge records older than 24 hours are removed during later email-code requests; if there are no later requests, those records may remain longer. Refresh sessions expire within 30 days. Their hashed records, including revoked records, may remain until the account is deleted. Support correspondence and limited records needed for security, fraud prevention, legal compliance, or resolving disputes may be kept for as long as needed for those purposes.

You can request deletion of your MineBots account and associated personal data at any time. Visit our account deletion page and email [email protected]. After we verify that you own the account, we will delete the account and associated data from our active systems within 30 calendar days. We will also request deletion from service providers where available. Data that must be retained for legal, security, or fraud-prevention reasons will be restricted and kept only for the necessary period; provider logs and routine backups may take longer to expire under their configured retention schedules.

Deleting a MineBots account does not cancel a Google Play subscription. If you have a subscription, cancel it separately in Google Play before deleting your account.

Security

We use safeguards designed to protect account information, including keyed hashes for email codes, rate limits, short-lived access tokens, hashed refresh tokens, secure storage for tokens on the device, and HTTPS for communication between the mobile app, MineBots API, and email delivery provider. No online service can guarantee absolute security. Please contact us promptly if you believe someone has accessed your account without permission.

Your choices and rights

Depending on applicable law, you may ask whether we process your data and request information about purposes and recipients; access, correct, delete, restrict, or receive a copy of it; object to certain processing; and complain to a data-protection authority. Under Türkiye’s KVKK, you may also request correction or deletion to be notified to recipients and claim compensation where unlawful processing causes damage. Contact [email protected]; we’ll verify your request and respond within the legal time limit.

Children and age requirements

MineBots accounts are intended for people aged 13 or older. If you are under 18, a parent or legal guardian must review the terms and authorize your use where local law requires. In EU/EEA countries, the age for a child to consent to certain online data processing can be set between 13 and 16; where parental authorization is required, it must be obtained before consent-based processing. We do not knowingly maintain an account for a child below age 13. A parent or guardian can contact us to ask about or request deletion of a child’s account. The operator must confirm the target-age declaration and parental-consent process before publishing to app stores.

We may update this policy if our features or data practices change. The latest version and its effective date will remain available on this page.