Privacy Policy

This policy explains what information TulipSMP collects when you play on the server or use tulipsmp.com, why we collect it, who else sees it, how long we keep it, and what you can do about it. The short version: we only collect what we need to run and protect the server, we never sell your information, and the only ads are from Google, on the Vote page.

Who we are

TulipSMP is a Minecraft server run by whiscey (whiscey.net). whiscey is responsible for the information described on this page. If you have a question or request about your information, email admin@tulipsmp.com or open a ticket in our Discord.

When you play on the server

Like most Minecraft servers, TulipSMP records:

Your Minecraft username and UUID, so the server knows who you are.
Your IP address, to keep the server safe: stopping banned players and alt accounts from coming back, and protecting against attacks.
Your sessions: when you join and leave.
Chat messages, commands and block changes, so staff can handle reports, undo griefing and enforce the rules.
Gameplay stats such as playtime, first join date, kills, deaths, blocks broken and placed, fish caught, votes and skill levels.
Your in-game progress, like your inventory, money, claims, homes, quests and ranks.

This game data is also sent to whiscey.net, which runs TulipSMP's moderation and staff tools. To help spot ban evasion, VPNs and alt accounts, whiscey.net looks up the rough location of IP addresses using ip-api.com: the country, region, city, internet provider, and whether the address belongs to a VPN, proxy or hosting company. This is only shown to staff, on staff-only pages.

What's shown publicly

Supporters: the Supporters page lists the usernames of players who have supported the server, in order of support, plus the top 10 for the current month. How much anyone has spent is never shown, and never leaves our database. Ask us if you'd rather not be listed.
Staff: the Staff page shows our staff members' usernames, and any nicknames and pronouns they've chosen to share.
Punishments: bans, mutes and other punishments, including the player's username and the reason, are posted to a #punishments channel in the TulipSMP Discord.
Player heads: skins and heads are loaded from public Minecraft skin services using your username.
Things you do in game, like chat and builds, can be seen by other players, and may appear in screenshots or videos.

When you use this website

You don't need an account to use tulipsmp.com. Here's what the website does with your information:

Cloudflare, which hosts the website. Cloudflare processes basic request information, such as your IP address and browser, to deliver the site and block attacks. See Cloudflare's privacy policy.
Ads from Google. Google AdSense runs only on the Vote page. When you open that page, Google may show ads and set cookies. No other page loads Google ads. Google and its partners use cookies to show and measure ads, and may show ads based on your visits to this and other websites. Where the law requires it (in the EEA, the UK and Switzerland), Google asks for your consent first. You can turn off personalised ads in Google's Ad Settings and read how Google uses data from sites that use its services.
Free gift video ads (optional, when available). On the Vote page you can choose to watch a short video ad from Google to get a free in-game gift. The video ad only loads when you press the button. When you do, Google and its partners may use cookies to show and measure the ad, and possibly to personalise it. To give you the gift we send the Minecraft username you type, the server and the time to whiscey.net, which runs the gift system, along with a one-way hash of your IP address that changes every day, to stop abuse. Gift records are deleted after 60 days.
Page-view counts. Every page sends a small message to whiscey.net with the page you're on, the page that linked you there (the referrer) and your screen width. From the request, whiscey.net works out your country, device type and browser. To count visitors without tracking them, it stores a one-way hash of your IP address and browser, mixed with a secret and the date, so you can't be followed from one day to the next. Your IP address itself isn't stored, and no cookies are used. Daily visitor hashes are kept for 100 days, and page-view totals for 400 days.
Google Fonts. The website's font (Quicksand) is loaded from Google on every page, so Google receives your IP address and browser details. See Google's privacy policy.
Local prices on the Ranks page. To show prices in your currency, your browser sends a request to ipapi.co, which uses your IP address to guess your currency, and then gets exchange rates from open.er-api.com. Both services can see your IP address.
The Fishing minigame. The Fish page saves your progress in a cookie called tulip_fishing, which lasts one year, and in your browser's local storage. Every fish you catch also adds one to the site's "fish caught" counter. To stop scripts from inflating the counter, we store a one-way (SHA-256) hash of your IP address with the time of your last catch. The hash isn't deleted automatically.
Other storage on your device. The website saves a few small things in your browser's local storage: your light, dark or pride theme (tulip.theme), the username you typed on the Vote page or for the free gift (voteUsername, giftUsername), which list you picked on the Supporters page, and drafts in our Markdown preview tool. If you used the old Stats page, it may also have saved the last username you looked up (lastStatsUser). These stay on your device, and you can clear them at any time in your browser settings.
Server status. The home, Join and Analytics pages ask mcstatus.io whether the server is online, straight from your browser.
Player count history. We record how many players are online over time for the Analytics page. This is just a number and doesn't include who was online.
Images from other services. Player heads come from Minotar, MC-Heads, Crafatar, CreeperNation and TydiumCraft; voting site icons on the Vote page come from Google's favicon service; flags on the Bedrock page come from flagicons.lipis.dev; and changelog posts and emoji come from Discord. When your browser loads these, those services can see your IP address, like any website you load an image from.

When you buy from the store

Payments are handled by our third-party store and payment provider. We never see or store your card or bank details.We receive your username, what you bought, how much it cost, and contact details the provider shares with us, such as your email address, so we can deliver your purchase and help if something goes wrong. The provider's own privacy policy also applies.

How we use your information

To run the server and website, and deliver ranks, rewards and purchases.
To keep players safe: moderation, handling reports, and stopping cheating, griefing and ban evasion.
To show leaderboards, the supporter list and the staff list.
To understand how the server and website are doing, like how many people play, when, and which pages are popular.
To show ads, which help pay for the server.

We never sell your information, and we don't share it with anyone except the services listed on this page that help us run TulipSMP, or when the law requires it.

Why we're allowed to use it

If you live in the UK, the EEA or somewhere with similar laws, these are the legal reasons we rely on:

Legitimate interests: running, securing and moderating the server and website, keeping players safe, and counting visits. We only use what's needed for this.
Consent: for personalised ads from Google, where the law requires it. You can change your mind at any time.
Contract: delivering things you've asked for, like purchases, voting rewards and free gifts.

Where your information goes

Many of the services we use, including Google, Cloudflare, Discord and ip-api.com, are based in the United States or other countries, and store information there. This means your information may be handled outside the country you live in, where privacy laws can be different. Where the law requires it, these providers use safeguards such as standard contractual clauses.

How long we keep it

Player and IP records (username, UUID, IP addresses, sessions, location lookups, stats and progress): kept while you play, and until you ask us to delete them. We don't delete these automatically.
Chat logs on whiscey.net: 3 days.
Moderation records, such as punishments and ban history: as long as they're needed to keep the server safe.
Free gift records: 60 days.
Page-view counts: daily visitor hashes for 100 days, totals for 400 days.
Fishing counter IP hashes: not deleted automatically.
Player count history: kept, as it doesn't identify anyone.
Purchase records: as long as needed for accounting and to handle disputes.
Cookies and local storage on your device: until they expire or you clear them.

Your rights and choices

Depending on where you live, you can:

Ask us what information we hold about you, and get a copy of it in a common format.
Ask us to correct it.
Ask us to delete it. Some information, like ban records or purchase records, may need to be kept for safety or legal reasons, and deleting your data will reset your progress.
Object to how we use it.
Withdraw your consent to personalised ads at any time, through Google's consent choices or Google's Ad Settings.
Ask to be left off the Supporters page.
Clear the website's cookies and saved data from your browser at any time.
Complain to a data protection authority, such as the ICO in the UK or the authority in your EU country. We'd appreciate the chance to sort things out with you first.

To do any of these, email admin@tulipsmp.com or open a ticket in our Discord. We may need to check that the account is yours first.

California residents: we don't sell your information for money. However, letting Google use cookies for personalised ads may count as "sharing" under California law. You can opt out by turning off personalised ads in Google's Ad Settings or through Google's consent choices. You also have the rights listed above, and we won't treat you differently for using them.

Do Not Track

Some browsers can send a "Do Not Track" signal. There's no agreed standard for it, so the website doesn't change what it does when it receives one. You can still use the choices above.

Younger players

TulipSMP is for players aged 13 and over, and many of our players are teenagers. We don't ask for real names, ages, addresses or photos, and we only collect what's needed to run a Minecraft server. Players should never share personal information in chat, and our rules forbid asking for it. If you're a parent or guardian and want your child's information removed, email admin@tulipsmp.com or open a ticket in our Discord, and we'll take care of it.

Changes to this policy

If we change this policy, we'll update the date at the top, and announce big changes on Discord.