Privacy Policy

Thorium is sold to the people who run Minecraft servers, not to the people who play on them. That makes the distinction below the most important thing on this page.

Account data is the information about you as a Thorium customer: your email address, your organisation, your billing. We decide what to do with it, so under the GDPR we are the controller and this policy governs it.

Player data is the information Thorium sees about people playing on a customer’s server. We handle it on that customer’s instruction: they are the controller and we are the processor. If you are a player and want your data removed or explained, the server operator is who you ask first.

There is one exception, described under Preventing ban evasion and abuse: comparing identifiers across networks to stop banned players and abusers moving between servers. For that we are a controller in our own right.

When you create an account and use the dashboard, we store:

• Identity: email address, username, display name, optional first and last name, optional phone number.
• Credentials: a salted one-way hash of your password — never the password itself — plus two-factor settings and lockout counters.
• Discord link, if you connect one: your Discord user ID, username, avatar and the OAuth tokens needed to keep the link working.
• Sessions: for each sign-in, the IP address, user agent, device name, and the country and region derived from that IP, with timestamps. This is what powers the active-sessions list and lets you revoke a session you do not recognise.
• Organisation and billing: organisation name, members and their roles, plan tier, and the customer identifier issued by our payment provider.
• Audit trail: a record of security-relevant actions in your organisation — who invited whom, who changed a role, who deleted a server — with the IP address the action came from.
• Support and correspondence: what you send us by email or in our Discord support channels.
• Request logs: when you use the website or API, our servers log the request, its IP address, browser and country, as every web service does.

We do not see or store card numbers. Checkout happens on PayNow’s infrastructure and all we receive back is a customer identifier, a plan and a subscription status.

When a server operator installs the Thorium plugin, the plugin sends us gameplay telemetry from that server. For each player we may hold:

• Identifiers: the Minecraft username and account UUID.
• Connections: when each session began and ended, the IP address the player connected from, the client brand the game reports, and whether the session ended in a kick and why. Operators can switch IP sharing off.
• Gameplay telemetry: movement, rotation, combat interactions, block changes and inventory actions, as the server itself observes them, and the terrain around the player needed to interpret them.
• Activity log: where the operator turns on Advanced Analytics, a record of each block mined or placed, kill, death, shot, damage dealt or taken, distance travelled, time played and item used, crafted, dropped or picked up, and any game stats the operator’s own plugins send, with the time, place and session.
• Public stats: where the operator publishes a Thorium stats site, a player’s username, skin, when they were first and last seen, their daily playtime over the last 90 days and the stats the operator chooses to show are published on it. Skin images are stored by Thorium, keyed by the image itself rather than by player.
• Detections: which checks flagged the player, with a confidence score and a violation level, plus a short recording of the gameplay around the detection kept as evidence so an operator can review a flag instead of trusting it blindly.
• Moderation state: flags, kicks, bans, ban reasons, reports made by other players and a trust score, where the operator uses those features.

What the plugin never does: it does not run on the player’s computer. It has no client-side component, reads no files, inspects no memory, takes no screenshots and enumerates no processes. Everything above is derived from packets the game server already receives.

• To provide the service — running detections, showing dashboards, delivering alerts. Performance of our contract with the customer.
• To keep accounts secure — session records, rate limiting, audit logs, brute-force lockouts, bot checks at sign-up. Legitimate interest in securing the platform.
• To bill you — plan and subscription state. Performance of contract and legal obligation for tax records.
• To prevent ban evasion, fraud and abuse — described in the next section. Legitimate interest.
• To improve detection accuracy — aggregate statistics about false positive and true positive rates, and review of individual evidence recordings when a check misfires. Legitimate interest.
• To run and debug the platform — request and application logs. Legitimate interest.
• To email you about your account: confirmation, password resets, invitations, billing, and notices about these policies. Performance of contract. We do not send marketing email without your consent.

A cheater banned on one server usually comes back on another account, and sometimes on another server. To catch that, Thorium compares Minecraft account UUIDs and connection IP addresses across the networks that use it, and links accounts that share them. We also use this to stop people signing up to probe, test or get around the service.

For this purpose we are an independent controller, and our lawful basis is our legitimate interest — and our customers’ — in preventing cheating, fraud and abuse, which is what the service exists to do. You can object to this processing by emailing privacy@thorium.ac; we will stop unless our grounds for continuing outweigh your interests.

Thorium produces detections; it does not decide what happens to a player. Operators on a paid plan can choose to kick or ban automatically when a player crosses thresholds they set. Where they do, the operator is making that decision, and questions or appeals about it go to them.

We do not sell personal data, and we do not share it for advertising. We share it only with the providers below that make the service work (our sub-processors, for player data). We do not send customer or player data to AI services; see the AI Usage Policy.

• Cloudflare — DNS, TLS termination, DDoS protection, the bot check on sign-up forms, the edge that serves this website, cookieless page-view analytics for this website, and storage for evidence recordings and backups. All traffic to us passes through it.
• Vultr — the servers that relay webhook deliveries to the addresses customers configure. The platform itself runs on servers we own and operate in the United States.
• PayNow — checkout, subscriptions and payment method storage.
• MXroute — to deliver account and billing email.
• Discord — where a customer has connected a guild, we send alert content to the channels they nominate, and OAuth details when they link an account.

Two other recipients are chosen by the customer or the viewer, not by us: a customer can send detections to webhook addresses they configure, and the dashboard shows player heads from mc-heads.net, which receives the player’s UUID from the viewer’s browser.

We will also disclose data where we are legally required to, and we will tell the affected customer unless we are prohibited from doing so. If Thorium is merged, acquired or sold, data may pass to the new owner under this policy, and we will tell you before it does.

• Account data: for as long as the account exists. Delete the account and we remove it, except records we must keep for tax and accounting.
• Sign-in sessions: until they expire or you revoke them.
• Detections and evidence recordings: 120 days from when they are made, on every plan. Each plan decides how much of that history its dashboard shows.
• Players, sessions and moderation state: for as long as the customer’s organisation exists. When it is deleted, they are deleted 30 days later.
• Activity log: kept while the customer’s organisation exists, to power its statistics; deleted 30 days after the organisation is deleted.
• Audit logs: one year.
• Request and application logs: 30 days.
• Backups: deleted data can remain in backups for up to four weeks, until they are overwritten on their normal rotation.

If you are in the UK, EU or another region with comparable law, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another provider. Where we rely on consent you can withdraw it at any time. You can also complain to your data protection authority.

For account data, and for the ban-evasion processing above, email privacy@thorium.ac. We will respond within 30 days, and may need to confirm your identity first.

For player data, contact the operator of the server you played on. They decide what is collected and how long it is kept; we act on their instructions. If they pass the request to us, we will carry it out. If you cannot reach them, write to us and we will pass your request on.

If you live in California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, use and disclose, to access and delete it, to correct it, and not to be treated differently for exercising these rights. In the last 12 months we have collected the categories described above: identifiers, such as name, email, account IDs and IP addresses; commercial information, such as plan and subscription status; internet activity, such as request logs; gameplay information about players; and approximate location derived from IP addresses. We collect them for the purposes above and disclose them only to the recipients listed under Who else sees it.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use sensitive personal information for anything beyond what the law permits. Send requests to privacy@thorium.ac; an authorised agent can make a request for you with your written permission. If we decline a request, you can appeal by replying to our decision.

We use only the cookies and browser storage the site needs to work: keeping you signed in, remembering your language, theme and selected network, and Cloudflare’s security checks. To count page views and measure load times we use Cloudflare Web Analytics, which sets no cookies and does not track you across sites. We use no advertising cookies and no cookie-based analytics.

• Traffic between you, your game server and us is encrypted with TLS. The origin is not reachable except through Cloudflare.
• Passwords are stored only as salted one-way hashes.
• Databases sit on a private network that is not reachable from the internet. Evidence recordings and backups are stored encrypted.
• Access to production is limited to the people who operate it.
• Two-factor authentication is available on every account and we recommend turning it on.

No system is perfectly secure. If a breach affects your data, we will tell you, and the relevant authority where the law requires it, without undue delay.

The platform runs on our own servers in the United States. Cloudflare, Discord and our other providers operate globally. If you are in the UK or EU, that means your data is transferred outside your region; those transfers rely on the UK/EU Standard Contractual Clauses, the EU–US Data Privacy Framework where a provider is certified under it, or an equivalent safeguard.

Thorium accounts are for server operators and are not offered to anyone under 16. Players on a customer’s server may be younger; where they are, the server operator is responsible for having a lawful basis to process their data, for any parental consent the law requires, and for telling them about it. If you believe we hold data about a child that we should not, email privacy@thorium.ac.

If we change this policy in a way that materially affects you, we will email the address on your account before it takes effect. The date at the top always reflects the current version, and the list of providers above is kept current.

Thorium Anti-Cheat Solutions LLC — privacy@thorium.ac. Our terms of service are at /terms.