In short

We collect what is needed to run your account, your purchases and the game, and to protect the community (security, cheating, moderation).
We do not sell your data and we use neither targeted advertising nor audience measurement tools.
Your card number never goes through us: it is handled by PayPal or Stripe.
You can view, correct or have your data deleted by writing to [email protected].

Who is responsible for your data

The data controller is MYROLAME, EURL, a French company with its registered office at 10 avenue Maréchal Foch, 21000 Dijon, France, registered with the Dijon Trade and Companies Register under number 930 377 262, represented by its manager (hereinafter « Excalia » or « we »).

For any question about your data: [email protected].

This policy applies to the website excalia.fr, the Excalia launcher and Excalia's Minecraft game servers.

The data we collect

Your website account

Your Minecraft username and identifier (UUID), obtained when you link your account from the game.
Your registration date, your last logins and the number of days you logged in.
Your rank, your badges, your referral code and the related referrals.
If you enable your public profile: your bio and the sections you choose to display.

Your purchases

Your orders, their amount, their in-game delivery, your wallet, and the gift cards and promo codes used.
Your billing details (first name, last name, email, address), stored encrypted in our database.
For saved payment methods: only a reference provided by PayPal or Stripe and a label (for example « Visa •••• 4242 »). Card numbers are entered and kept by them, never by us.
If you enable two-factor authentication for payments: its secret, stored encrypted.

Votes, forms and exchanges with the team

Your votes: voting site, date, and the IP address used, to check the vote and prevent cheating.
Your answers to forms (applications, surveys), with the IP address and browser used, to fight spam.
Your support tickets, bug reports, comments, likes and price alerts.
The notifications we send you and whether you have read them.

The launcher

Signing in to your Microsoft account happens on Microsoft's side. Sign-in tokens stay on your computer; we never see your password.
For online features (profile, friends, presence, chat), the launcher sends our server your username, your UUID and your Minecraft session token. We have it checked by Microsoft and only keep a fingerprint of it, for 10 minutes.
What you fill in your launcher profile: bio, status message, social links, birthday (optional), banner, displayed badges, as well as your friends list and your chat messages.
Your game session history (server or modpack, duration) and your online status.

The game servers

Your username, your UUID and your connection IP address (security, protection against attacks, fight against cheating and multiple accounts).
Your chat messages and the commands you use, for moderation.
Your in-game actions (blocks placed or broken, trades, in-game purchases), to investigate theft, cheating or bugs.
Your game statistics (island, jobs, dungeons, fishing, rankings…), some of which appear on the website's public statistics pages.

Cookies

The website only uses cookies that are necessary for it to work: your login session, protection against fraudulent requests, tracking of a referral link and your display preferences. Our provider Cloudflare also sets a security cookie against bots. No advertising or audience measurement cookies: these cookies therefore do not require your consent, but you can delete them from your browser (you will then be logged out).

Why we use them

To run your account, your purchases and the game (performance of the contract): account, orders, in-game delivery, wallet, launcher, support.
To comply with the law (legal obligation): invoices and accounting records, answers to requests from the authorities.
To protect Excalia and its players (legitimate interest): account security, fight against fraud, cheating and multiple accounts, chat moderation, in-game investigations, public statistics and rankings.
What you choose to share (consent): public profile, launcher profile details, birthday, news communications. You can withdraw your consent at any time.

Who can access them

Your data can be accessed by the Excalia team, each according to their role (for example, moderators see chat logs, but not your billing details). We also use service providers, who only use it for the service provided:

PulseHeberg (website hosting, France);
Cloudflare (website delivery and protection);
PayPal and Stripe (payments);
TCPShield (protection of the game servers against attacks);
Microsoft (sign-in to your Microsoft and Minecraft account);
our email delivery service (invoices, notifications).

What is public by nature remains visible to everyone: your username and your statistics in the rankings, and your public profile if you enabled it.

We neither sell nor rent your data. We only share it with a third party without your consent when the law requires it or to fight fraud.

Transfers outside the European Union

Some providers (Cloudflare, PayPal, Stripe, TCPShield, Microsoft) may process data outside the European Union, in particular in the United States or Canada. These transfers are covered by the safeguards provided by the GDPR: an adequacy decision of the European Commission (including the EU-US Data Privacy Framework) or standard contractual clauses.

How long we keep them

Account and profile: as long as your account is active, then 3 years after your last login.
Orders and invoices: 10 years, as required by law.
Billing details: for the life of your account, or until you delete them.
IP addresses, login and vote logs: 1 year.
Chat and in-game action logs: 1 year, or the duration of an ongoing investigation or sanction.
Tickets, forms and reports: 3 years after they are closed.
Fingerprint of the launcher session token: 10 minutes.

Your rights

Under the GDPR and the French Data Protection Act, you can at any time:

access your data and receive a copy of it;
have it corrected;
have it deleted, except what the law requires us to keep (invoices);
object to processing based on our legitimate interest, or ask for it to be restricted;
receive the data you provided us in a readable format (portability);
withdraw your consent where it was requested;
give instructions on what happens to your data after your death.

Write to us at [email protected] with your Minecraft username, from the address linked to your account or with proof of your identity. We answer within one month at most.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country of residence.

Players under 15

If you are under 15, ask a parent for permission before creating an account, filling in your public profile or making a purchase. A parent can exercise the rights above on your behalf by writing to the same address.

Security

We protect your data with appropriate measures: encrypted connections (HTTPS), billing details and two-factor authentication secrets encrypted in the database, team access limited by role, regular backups.

Changes

This policy may change, for example when a new feature collects new data. The date of the current version is shown at the top of this page; in case of a significant change, we let you know on the website or in the launcher.

See also the terms and conditions (in French). The French version of this policy is the reference version.

Privacy policy