Privacy Policy

Last updated: November 4, 2026

mygameplatform.com is a non-commercial community project. We run it in our free time, everything on it is free to use, and we have no interest in collecting more data than we need to keep the servers running. This page explains what we do collect, why, and what you can do about it.

Unless defined otherwise here, the terms used on this page have the same meaning as in our Terms of Service.

Who is responsible

The Service is operated by the mygameplatform.com community. As a non-commercial community project we do not have a company behind us, so there is no commercial register entry and no postal address. You can always reach the people responsible here:

E-Mail: contact[at]mygameplatform[dot]com
Discord: our Discord server

What we collect and why

Account data (email address, password): We need this so you can have an account and log in.
Why we are allowed to: we need it to provide the account you asked for (Art. 6(1)(b) GDPR).
Discord account ID: Only if you take part in the free-server service. We use it to confirm you are one person with one account, which is what keeps the free servers fairly distributed.
Why we are allowed to: to provide the free-server service you signed up for (Art. 6(1)(b) GDPR) and to prevent abuse (Art. 6(1)(f) GDPR).
Log data: Whenever you visit the Service, your browser sends technical information: IP address, browser type and version, which pages you opened, and when. The same happens on the game panel.
Why we are allowed to: we need it to operate the Service securely and to investigate abuse and technical problems (Art. 6(1)(f) GDPR).
Search queries: The search on this wiki runs on our own server, so your search terms reach us rather than a third party.
Why we are allowed to: to make the search work (Art. 6(1)(f) GDPR).
Ko-fi payments: Only if you support us on Ko-fi. Ko-fi notifies us of every payment, one-off donations included, and we store: transaction ID, date and time, type of payment, amount and currency, membership tier, the email address you used on Ko-fi, your display name there and, if you connected Discord in your Ko-fi account, your Discord name and ID. We match a payment to your mygameplatform account through the confirmed email address of your account; if that does not match, you can claim the payment yourself under Connections with the transaction ID from your Ko-fi receipt, or an administrator assigns it by hand. While a monthly subscription is active — up to 36 days after its last payment, because Ko-fi does not tell us when a subscription ends — your account has the subscriber role. Under Connections in the account area you can see this status. If you want the connection to Ko-fi removed, contact support at any time; the role is removed as soon as we unlink it.
Every Ko-fi payment we can match to your account this way — a one-off donation just as much as a subscription payment — also gives your account a supporter role. It records that you have supported the project at some point, and it stays on your account. As a thank-you, it currently raises the rate limits of the User API for your account. Supporting us is voluntary: the role is a thank-you for a donation, not something you buy; we promise nothing in return for it and may change or end this thank-you at any time. Under Connections it shows as Ko-fi Donation.
Why we are allowed to: we have a legitimate interest in recognising those who voluntarily support the project: giving you the subscriber role while your monthly Ko-fi support is active, noting who has supported the project, and assigning payments correctly and keeping track of who held the role when (Art. 6(1)(f) GDPR).
User API: Only if you use the User API.
For each API token we store its name, its scopes, its lifetime, when it was created, last used, paused, resumed or revoked, your account ID and user name, and whether its last request ran with the free or the supporter rate limits. To let you recognise a token, we keep its first 12 and its last 4 characters. The token itself is never stored, only a one-way hash of it (SHA-256). So that the User API can act on your behalf, we also keep a sign-in credential from our own login service (an offline token) for each token, encrypted. A history records when a token was created, paused, resumed, revoked or expired, and whether you, an administrator or the system did it.
For each request our server logs record the time, the operation, the path with secrets removed, the status, the duration, the token and account ID, your IP address and the client identifier your application sends (user agent). Console commands you send are never logged. From the requests we also keep statistics: per hour the number of requests per operation, status, account and token, with their duration; per day and token the IP addresses it was used from, with the number of successful and failed requests and the first and last request; per hour the IP addresses that sent requests without a valid token, with the reason; and the last 50 errors (time, account ID, operation, status, error code). Administrators use these figures as a usage history per token and account. If an administrator blocks your access, sets a different limit for you or exempts your account, a token or an IP address from the rate limits, we store that with an optional note and end date. When tokens are paused because they were not used for 30 days, we send you a notification.
Why we are allowed to: we need the token data and the requests to provide the User API you asked for (Art. 6(1)(b) GDPR). We use the logs, the statistics and the usage history to enforce the rate limits, to keep the User API secure, to detect and stop misuse and to investigate technical problems (Art. 6(1)(f) GDPR).

We do not sell your data, and we do not use it for advertising or profiling.

Cookies

Cookies are small files a website stores in your browser. We only use the ones we need:

Login and session cookies — so you stay logged in on the website and in the game panel. Without these, logging in does not work.

We do not use analytics or tracking cookies on this wiki.

How long we keep it

We do not archive data for its own sake and we do not build up stockpiles of old data. Whatever we still hold, we hold because we still need it for one of the purposes above — and no longer than that. Instead of fixed periods, the following criteria decide how long something stays:

Account data: For as long as your account exists. If you delete your account, the personal data belonging to it is deleted with it.
What we need in order to enforce our own rules: Our Terms of Service allow one participation in the free-server service per person, and the Anti-Abuse System enforces that. A rule like this only works if a returning account can still be recognised — otherwise anyone affected by a measure could simply register again. We therefore keep the smallest amount of information that makes this possible, for as long as the rule it protects still applies, and we use it for nothing else.
Log data: Only for as long as we need it to run the Service and to look into technical problems or abuse. After that it is deleted. IP addresses and browser details recorded at sign-in, which the Anti-Abuse System uses to recognise returning accounts, are deleted after 12 months at the latest.
Ko-fi payments: Payments we could not assign to an account: 90 days. Payments assigned to an account: 13 months after the payment. After that we remove everything in a payment that relates to you — your email address, Ko-fi display name, Discord name and ID and the link to your account — and replace the transaction ID with a one-way hash that only serves to recognise duplicates. What remains (amount, currency, type of payment, tier, date) is anonymous and is kept for our statistics. The link between your account and Ko-fi: 13 months after the last payment or after you unlinked it. The record of who linked or unlinked an account and when: 24 months; it holds IDs only, no email address. The supporter role stays on your account until you delete the account. If you delete your account, its Ko-fi link is deleted and its Ko-fi payments are anonymized the same way right away.
User API: Server logs of the requests: up to about 40 days, after which they are deleted automatically. Statistics, IP addresses per token, requests without a valid token and the list of recent errors: 90 days (the list of recent errors also never holds more than the last 50). The history of each token: 365 days. The encrypted sign-in credential of a token: deleted when the token is revoked or paused, and within about one day after it expires. The entry of a token itself: as long as the token is active or paused; once it has been revoked or has expired (whichever happens first), it stays in the archive of your API tokens for 12 months and is then deleted together with its history, its statistics and its IP addresses.
If you delete your account, everything the User API holds about it — your tokens and their sign-in credentials, their history, your statistics and IP addresses per token, your entries in the list of recent errors and any block, limit or exemption set for your account or its tokens — is deleted as part of the account deletion. Only the server logs run out as described above, and figures that are not linked to any account, such as requests without a valid token per IP address, remain for their normal period. Data from the User API is not passed on to anyone beyond our hosting provider.
Legal obligations: Where a law requires us to keep something for a certain time, we keep it for that time and delete it afterwards.

Who else sees your data

We keep the number of parties involved as small as we can. Data may reach:

Our hosting provider — the servers behind the Service currently run at Hetzner in Germany. We reserve the right to move to or add another provider, in which case we choose one bound to comparable data protection standards.
Email — account and notification emails are sent from our own mygameplatform.com and mygameplatform.eu domains.
Discord — if you use the Discord integration, in the sense that the connection between your Discord account and your mygameplatform account exists on both sides.
Ko-fi — if you support us there, Ko-fi handles the payment under its own privacy policy. We only receive the details listed under What we collect and why.

We do not pass your data to anyone else unless we are legally required to, for example in response to a lawful order.

Data outside the EU

We host with Hetzner and use server locations within the EU, so the data we hold ourselves stays within the EU.

The one exception is the Discord integration: if you connect your Discord account, the data exchanged through that connection is processed by Discord, which may process it outside the European Union, including in the United States. The same applies to payments on Ko-fi, which Ko-fi processes under its own privacy policy. Apart from that, we do not intentionally transfer personal data outside the EU.

Your rights

You have the following rights regarding your personal data, and you can use any of them by writing to us at the contact address above. Just ask — you do not need a form or a formal letter.

Access: You can ask us what data we hold about you (Art. 15 GDPR).
Rectification: You can ask us to correct data that is wrong (Art. 16 GDPR).
Erasure: You can ask us to delete your data (Art. 17 GDPR). You can also just delete your account in the account area.
Restriction: You can ask us to stop using your data while something is being clarified (Art. 18 GDPR).
Data portability: You can ask for a copy of the data you gave us, in a machine-readable form (Art. 20 GDPR).
Objection: You can object to processing that we base on our legitimate interest (Art. 21 GDPR).
Withdrawing consent: Where we asked for your consent, you can take it back at any time. That does not affect what happened before you withdrew it.

Security

We take reasonable care to protect your data, but no transmission over the internet and no method of electronic storage is completely secure, so we cannot promise absolute security.

Links to other sites

The Service links to sites we do not run. If you follow such a link, that site's own privacy policy applies. We have no control over their content or their handling of your data.

Children's Privacy

Our Service does not address anyone under the age of 16 ("Children").

We do not knowingly collect personally identifiable information from children under 16. If you are a parent or guardian and you are aware that your child has provided us with Personal Information, please contact us. If we discover that a child under 16 has provided us with Personal Information, we will delete such information from our servers immediately.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we post the new version on this page and update the date at the top. Changes take effect once they are posted.

Contact us

If you have any questions about this Privacy Policy, or if you want to use one of your rights, write to us at the contact address above — email or Discord, whichever you prefer.

12 November 2026