Privacy and cookies policy
Version 2026-09. Compliant with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act. This English translation is provided for convenience: the French version prevails in case of difference.
Data controller
Boumendil, 657 Av 1er BIMP — contact@craftrank.fr.
Data processed, purposes and legal bases
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Username, email, password (hashed) | Creating and managing the account | Performance of the contract | Until the account is deleted |
| Server information and images | Publishing server pages | Performance of the contract | Until the server or account is deleted |
| Voter's Minecraft username | Counting votes, public voter leaderboard, in-game reward | Legitimate interest (running the ranking) | As long as the server exists (the ranking resets every month) |
| Encrypted fingerprints (HMAC) of the voter's IP address and network (/24) | Limiting to one vote per 24 h, detecting vote farms | Legitimate interest (ranking integrity) | 48 hours, then deleted automatically |
| Password reset link (only a fingerprint is stored) | Account recovery, sending an email | Performance of the contract | 1 hour |
| Anonymous counters per server and per day (page visits, “Copy IP” clicks), and per traffic source | Statistics for server owners | Legitimate interest | About 13 months; no personal data is stored |
| Technical identifiers of linked Discord servers and channels (no data about their members) | Bot commands and vote reminders | Performance of the contract | Until unlinked or the server is deleted |
| Favourite servers, votes made while logged in, saved Minecraft username (optional) | Player area: tracking your votes and favourites, monthly challenges | Performance of the contract | Until removed or the account is deleted (votes: as long as the server exists) |
| Minecraft username, number of votes, achievements, streaks, most voted servers, month joined | Public player profile /joueur/<username> (optional, off by default) | Consent, which you can withdraw at any time in “My player area”: the page disappears immediately | As long as the public profile is on |
| Who invited you (when you sign up with a friend's link) | Referral achievements | Performance of the contract | Until the account is deleted |
| Email address, chosen time | Vote reminder by email (optional, off by default) | Consent, which you can withdraw at any time (link in every email or “My player area”) | Until consent is withdrawn or the account is deleted |
| Staff application to a server (message, availability, optional Minecraft and Discord usernames) | Sent to the team of the server concerned, the only one who can see it | Performing the service requested by the applicant | 6 months |
| Email address, favourite servers | News from favourite servers: day before an event, Monday summary (optional, off by default) | Consent, which you can withdraw at any time (link in every email or “My player area”) | Until consent is withdrawn or the account is deleted |
| Email address, language | Monthly letter: Server of the month, awards, new servers, events and challenges (optional, off by default) | Consent, which you can withdraw at any time (link in every email or “My player area”) | Until you unsubscribe or delete your account |
| Owner's email address, statistics of their page | Monthly report and tips for a listed server's page (at most one tip a month, 3 in total) | Legitimate interest (follow-up of the service used), you can object at any time (link in every email or Report page) | Until you object or the account is deleted |
| Email address, username, language | Occasional emails announcing new site features, to server owners or to all members | Legitimate interest (information about the service used), you can object at any time (link in every email, Report page or “My player space”) | Until you object or the account is deleted |
| Published reviews (rating, text, date, account username) and a fingerprint of the connection used | Publishing reviews, detecting fake reviews | Performance of the contract; legitimate interest (review integrity) | Until the review or account is deleted |
| Username and public link of the manager of a Minecraft server contacted to present the site, follow-up notes | Outreach to servers | Legitimate interest (making the site known) | 1 year after the last exchange in case of refusal or no answer; you can ask for deletion at any time |
| Reason for an account suspension | Moderation, informing the user | Legal obligation (Digital Services Act) | Until the account is reactivated or deleted |
| Orders (amount, date, email, description) | Invoicing, accounting | Legal obligation | 10 years (art. L123-22 of the French Commercial Code) |
| Reports (reason, description, optional email) | Content moderation | Legal obligation (Digital Services Act) | 1 year after they are handled |
| Anonymous audience measurement: visits and page views per day, pages viewed, referring site, share of mobiles, page speed (no cookie, no IP address or identifier kept) | Site traffic statistics | Legitimate interest (audience measurement exempt from consent, CNIL guidelines) | Daily totals kept about 13 months (speed measures: 30 days) |
| IP address (in memory only) | Limiting login and sending attempts | Legitimate interest (security) | A few minutes, never stored |
We do not sell any data, do not use any third-party audience tool (Google Analytics…) or targeted advertising, and do not do any profiling. Our own visit counting stores nothing on your device and only keeps daily totals. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, your visits are not counted at all.
Recipients and processors
- Host: o2switch SAS (SIREN 510 909 807), Chemin des Pardiaux, 63000 Clermont-Ferrand, France — www.o2switch.fr.
- Stripe Payments Europe Ltd. (Ireland) for payments: your card details are entered directly at Stripe and never go through our servers. Stripe's policy.
- Email: emails (password reset, vote reminders and news if you turned them on, report and tips for server owners) are sent from our mailbox hosted by our host (o2switch SAS (SIREN 510 909 807), Chemin des Pardiaux, 63000 Clermont-Ferrand, France — www.o2switch.fr).
- Discord Inc. (United States, EU–US Data Privacy Framework), only if a server owner adds our bot to their Discord: we post the server's public information there (name, rank, votes, vote link).
- mcstatus.io, mcsrvstat.us, mcapi.us and minetools.eu: to show the number of players online, our server may query these services, sending them only the Minecraft server address. No visitor data is sent to them.
- The Minecraft server concerned: if the owner turned on vote rewards, only your username is sent to it (never your IP address).
Third-party content
All site resources (fonts, images, scripts) are hosted on our servers. Only the YouTube videos of Premium pages use a third party: they are loaded only after you click, via the youtube-nocookie.com domain. YouTube (Google Ireland Ltd.) may then set cookies and receive your IP address; transfers to the United States may take place under the EU–US Data Privacy Framework. If you tick “Always allow”, this choice is remembered in your browser (local storage) and you can withdraw it here:
Cookies
The site only uses one cookie, connect.sid, which is strictly necessary for it to work (login session and protection against CSRF attacks). It is exempt from consent (art. 82 of the French Data Protection Act) and expires after 30 days at most. No advertising or audience cookie is set (our visit counting works without cookies), which is why no consent banner is shown. Your language choice and a few display preferences (e.g. a closed banner) are kept in your browser's local storage only. Your display preferences (theme, text size, contrast, animations) are saved in your browser's local storage, at your request, and are never sent to the site.
Security
Hashed passwords (bcrypt), pseudonymised IP addresses, encrypted connection (HTTPS), strict security headers, limited login attempts.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability. From your account, you can directly download your data and delete your account. For any other request, write to contact@craftrank.fr: we answer within one month. You can also lodge a complaint with the CNIL or the data protection authority of your country.
Minors
Creating an account is reserved for people aged 15 and over, or younger people with permission from their parent or guardian (art. 45 of the French Data Protection Act). Voting does not require an account and only collects the Minecraft username.