In short
- The tools run in your browser. What you type stays on your device, unless you look up a server or a spark profile.
- No accounts, no cookies, no analytics, no ads and no browser storage.
- Cloudflare hosts the site, so it sees your IP address when a page loads. The only other site your browser contacts is spark.lucko.me, and only when you analyze a spark profile.
- Server lookups are logged for up to 7 days to keep the service working and free of abuse.
- For Bedrock servers, our server passes the address you check on to mcstatus.io. Your IP address isn't sent.
Who runs EndyStudio
EndyStudio (studio.endydev.com) is run by EndyDev ([TODO: controller name]), the controller of the personal data described on this page. EndyDev is based outside the European Union. For any privacy question or request, write to [TODO: contact email].
What stays in your browser
Every tool runs on your device. The text you write, the colours you pick and the settings you change are handled by your browser and are not sent to us. In particular:
- Share links keep the whole design after the
#in the address (#d=…). Browsers don't send that part of a link to the server, so we never receive it. Anyone you give the link to can read the design in it. - Copy buttons put the text on your clipboard, on your device.
- A server icon you upload in the MOTD tool is read and resized in your browser, and the 64×64 download is made there too.
- A spark profile you analyze is downloaded by your browser straight from spark.lucko.me, the site of the spark profiler, which we don't run. spark.lucko.me receives that request with your IP address and the profile's code, as when you open the link yourself. The profile is analyzed in your browser and never reaches our server.
EndyStudio sets no cookies, doesn't use localStorage or any other browser storage, and loads no analytics, advertising or tracking scripts.
Hosting
The site is hosted by Cloudflare, Inc. As with any web host, every request your browser makes reaches it with the usual technical data: your IP address, your browser's user agent, the page requested, the page you came from and the time. Cloudflare uses it to deliver the site and protect it from attacks. Everything a page loads, fonts included, comes from studio.endydev.com itself, so no other company receives a request while you browse. The one exception is the spark analyzer, which downloads the profile you ask for from spark.lucko.me (see above). We only see aggregated traffic figures that don't identify anyone.
We don't log page views ourselves. Cloudflare may set a strictly necessary security cookie if it has to check that a visitor is not a bot, for example on a challenge page. Cloudflare describes how it handles this data in its privacy policy.
Server lookups
Two tools look up real servers: the server status checker, and Load in the MOTD tool. They are the only features that send something you type to us. When you enter a server address and press Check or Load, your browser sends that address to our server.
- Java Edition: our server asks the Minecraft server for its status itself, as the in-game server list does. When the address has no port, its SRV record is looked up first through Cloudflare's DNS service.
- Bedrock Edition servers answer over UDP, which our host can't send. For these, our server passes the address and port to mcstatus.io, a public Minecraft status service, which asks the server and sends the answer back. mcstatus.io receives the server address and port from our server; it doesn't receive your IP address or anything else about you.
The Minecraft server sees our address or mcstatus.io's, not yours. The answer holds only public information the server gives anyone who asks: version, players (on Java, also the player names the server chooses to list), MOTD and icon. Our host keeps each answer in its cache for 60 seconds, so the same lookup within a minute isn't repeated.
To prevent abuse, each IP address can only make a limited number of lookups, and that count is kept for a minute at most. Our hosting logs record each lookup, with the server address, your IP address and technical details of the request, and are deleted automatically after at most 7 days. A server address can be personal data too, for example if it's your own domain or your home IP address.
What is kept, and for how long
| Data | Where | How long |
|---|---|---|
| Server lookups: server address, IP address, request details | Hosting logs | Up to 7 days |
| Number of lookups per IP address, to prevent abuse | Hosting provider | 1 minute at most |
| Server status answers (public data), by server address | Hosting provider's cache | 60 seconds |
| Bedrock lookups: server address and port | mcstatus.io | Under mcstatus.io's own terms |
| Technical data of every page request | Cloudflare, as host | Under Cloudflare's privacy policy |
| What you type in the tools, share links | Your device only | Not kept by us |
Legal basis
Under the GDPR and similar laws, we handle this data on the basis of legitimate interest (Article 6(1)(f) GDPR), for two purposes:
- Running the site: delivering the pages and doing the server lookup you ask for.
- Security: limiting lookups stops the tool being used to flood servers, and short-lived logs let us spot abuse and fix errors.
We don't use your data for advertising or profiling, and we don't sell it. You can object to this processing at any time; see your rights.
Data outside your country
Cloudflare is based in the United States and handles requests in data centres around the world. It is certified under the EU-U.S. Data Privacy Framework, which covers transfers of personal data from the EU to the United States.
mcstatus.io is an independent service and may handle the Bedrock server addresses it receives outside your country. It only receives a server address and port, never data about you.
Affiliate links
Some links to Minecraft hosting providers on EndyStudio may be affiliate links. If you follow one and buy something, EndyStudio may earn a commission from the provider, at no extra cost to you. Affiliate links are marked as such where they appear. The provider may use a code in the link or its own cookies to credit the sale; that happens on its site and under its privacy policy, not ours.
Your rights
You have the right to:
- know what personal data we hold about you and get a copy of it (access and portability);
- have it corrected or deleted (rectification and erasure);
- restrict how we use it, or object to its use, including use based on legitimate interest (restriction and objection).
Write to [TODO: contact email]. Our logs aren't linked to names, so to find your entries we may need the time of your lookup and the IP address you had then. After 7 days the logs are gone and there is nothing left to find.
If you are in the EU, the EEA or the UK and think we have handled your data wrongly, you can complain to the data protection authority where you live or work.
Changes
When the site starts handling data in a new way, this page and the date at the top will change with it.