Privacy Policy

Last updated: August 5, 2025

1. Introduction

Dupe Anarchy ("we", "our", or "us") operates the Minecraft server and website at dupeanarchy.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our services, submit support tickets, or interact with our Discord community.

This policy complies with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal information is:

3. Information We Collect

We collect the following categories of personal information:

3.1 Information You Provide Directly

  • Username / Minecraft IGN — when you submit a support ticket or create an admin account.
  • Email address — when you submit a support ticket, contact us, or register for an admin account. Used for ticket notifications and correspondence.
  • Support ticket content — the subject and message you write when contacting us.
  • Password — stored as a bcrypt hash for admin authentication. Never stored in plaintext.

3.2 Information Collected Automatically

  • IP address — collected when you submit a support ticket or access admin pages. Your IP address is hashed using SHA-256 with a secret salt before being stored in our database. The raw IP address is not retained long-term.
  • Browser and device information — user agent, browser type, and operating system (via server access logs).
  • Cookies and localStorage — we use cookies for session management, remember-me functionality, and theme preference (dark/light mode). See Section 7 for details.

3.3 Information from Third Parties

  • Cloudflare — provides DNS, proxy, and DDoS protection. Cloudflare may log your IP address and browser information. See Cloudflare's Privacy Policy.
  • Resend — our email delivery provider. Resend processes your email address to deliver transactional messages. See Resend's Privacy Policy.
  • mcstatus.io / api.mcsrvstat.us — used to display server player count and status on our homepage. These services may see your IP address when you load the page.

4. Purposes of Data Processing

We process your personal data for the following purposes:

  • Support tickets — to receive, process, and respond to your inquiries (legal basis: consent under GDPR Art. 6(1)(a)).
  • Admin authentication — to manage staff accounts and access to admin tools (legal basis: legitimate interest under GDPR Art. 6(1)(f)).
  • Email notifications — to send you ticket updates and replies (legal basis: consent under GDPR Art. 6(1)(a)).
  • Server status display — to show live player counts and server information (legal basis: legitimate interest under GDPR Art. 6(1)(f)).
  • Security — rate limiting, session management, and abuse prevention (legal basis: legitimate interest under GDPR Art. 6(1)(f)).

5. Data Retention

We retain your personal data for no longer than is necessary for the purposes outlined above. Our specific retention periods are:

  • Support tickets — retained for 12 months after closure. You may request earlier deletion at any time (see Section 9).
  • Hashed IP addresses — retained alongside tickets for the same 12-month period. Deleted when the associated ticket is deleted.
  • Access logs — retained for a maximum of 90 days for security and debugging.
  • Session data — server-side sessions expire after 24 hours of inactivity. Remember-me tokens expire after 30 days or upon logout.
  • Admin account data — retained until the account is deleted by a superadmin or the admin requests deletion.
  • Chat history — in-memory only (last 2000 messages), lost on server restart. Not persisted to disk.

5.1 Session Data

When you access admin pages, we store session data on our server, including:

  • Session identifier (randomly generated)
  • Admin ID (numeric, non-personal)
  • 2FA verification status
  • CSRF token (regenerated per session)

Session data is stored server-side using express-session with an in-memory store. It expires after 24 hours of inactivity and is destroyed upon logout. We use the cookie name __session (prefixed to indicate it is not PII) with SameSite: None and Secure: true in production.

6. Your Rights

Depending on your location, you may have the following rights:

6.1 GDPR Rights (EU/UK Residents)

  • Right of Access — request a copy of the personal data we hold about you.
  • Right to Rectification — request correction of inaccurate data.
  • Right to Erasure — request deletion of your data ("Right to be Forgotten").
  • Right to Restrict Processing — request that we limit how we use your data.
  • Right to Data Portability — receive your data in a structured, machine-readable format.
  • Right to Object — object to processing based on legitimate interest or direct marketing.
  • Right to withdraw consent — withdraw consent at any time where processing is based on consent.

6.2 CCPA/CPRA Rights (California Residents)

  • Right to Know — request disclosure of categories and pieces of personal information collected.
  • Right to Delete — request deletion of personal information collected.
  • Right to Opt Out of Sale or Share — opt out of the sale or sharing of your personal information. Use the Do Not Sell or Share My Personal Information link.
  • Right to Correct — request correction of inaccurate personal information.
  • Right to Limit Use of Sensitive Personal Information — limit how we use sensitive personal information.
  • Non-discrimination — we will not discriminate against you for exercising your rights.

To exercise any of these rights, contact us via the Contact Us form or through our Discord server. We will respond within 30 days.

7. Cookies and Local Storage

We use the following cookies and local storage items:

  • Session cookie — required for admin authentication. Secure, HTTP-only, SameSite-enabled.
  • Remember-me cookie — stores a secure token for persistent admin sessions. Set with sameSite: "none", secure: true, and a 30-day expiration.
  • preferred-theme (localStorage) — stores your dark/light mode preference. Does not contain personal information.
  • Cookie consent (localStorage) — stores whether you have accepted our cookie policy.

Third-party services (Cloudflare, Resend, mcstatus.io) may set their own cookies. Refer to their respective privacy policies for details.

8. How We Protect Your Data

  • Passwords are hashed using bcrypt with a unique salt per user.
  • IP addresses are SHA-256 hashed with a secret salt before database storage.
  • The server runs behind Cloudflare for SSL/TLS encryption and DDoS protection.
  • Helmet.js enforces security headers (CSP, HSTS, X-Frame-Options, etc.).
  • Rate limiting is applied to all API endpoints to prevent brute-force attacks.
  • Admin accounts support Two-Factor Authentication (2FA) via TOTP.

9. How to Exercise Your Rights or Delete Your Data

To request access, correction, deletion, or portability of your data:

Include your email address and the specific action you would like us to take. We will respond within 30 days.

10. Do Not Sell or Share My Personal Information (CCPA)

Dupe Anarchy does not sell or share your personal information with third parties for advertising purposes. California residents may still wish to opt out. To submit a "Do Not Sell or Share My Personal Information" request, use the Contact Us form with the subject "Do Not Sell My Data".

11. Children's Privacy

Our services are not directed to children under 16 (or 13 in the United States). We do not knowingly collect personal information from children under these ages without parental consent. If you believe we have collected data from a child, contact us via the Contact Us form.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be announced on our website or via Discord.

13. Contact

If you have questions about this Privacy Policy or our data practices: