Privacy Policy

Kevin van Beek, based in Gelderland, Netherlands, operates CoastMC under the CoastMC / Pyron Company branding and is responsible for the personal-data processing described in this notice. “We”, “us” and “our” refer to this operator.

For privacy questions or requests, email support@pyroncompany.com or use the contact form linked on this page. Put “Privacy request” in your message and identify the Minecraft account or support interaction concerned. Do not send passwords, authentication codes or unnecessary identity documents.

This notice covers the CoastMC website, Minecraft network, public statistics and support services. An external store, payment provider, Discord, Microsoft or another independent service also provides its own notice for processing it controls.

Support and appeal forms collect your Minecraft username, email address, message, request type and submission information. Follow-up correspondence and evidence you choose to provide may also form part of the case.

When you use network features, we process the preferences, social interactions, messages, reports and user-generated content needed for those features. This can include friends, parties, guild information and privacy settings where the network provides them.

Do not include sensitive personal information about yourself or others unless it is genuinely necessary to explain a safety issue or exercise a right. We do not need your Microsoft password, full payment-card details or login verification codes.

Minecraft account identifiers and usernames are used to recognise players. Network records may include join and session information, the server or game used, gameplay results, progression, ranks, entitlements and reward transactions.

For FFA rankings, we process lifetime Kills, Deaths and best Kill Streak. The public website feed contains the Minecraft UUID, current recorded username and those three counters for eligible public human profiles. It excludes profiles marked private in the relevant network setting and registered training bots.

Connections to the website and Minecraft services expose technical information such as IP address, request or connection time, requested resource, browser or client details and error information to the systems receiving the connection. Security, moderation and diagnostic records may associate relevant events with an account or connection.

Moderation records can include reports, relevant chat or gameplay evidence, restriction reasons, dates, staff actions and appeal history. We do not need to collect unrelated information about your activity outside CoastMC to operate the service.

We receive information directly from you, automatically through your use of the website and Minecraft network, and from account-identity and payment or entitlement systems when needed for a feature.

Other players or staff may provide a report, screenshot, recording or witness account involving your username. We assess relevant context rather than treating a third-party allegation as proven merely because it was submitted.

If you make a purchase, the seller or payment provider may supply the account identifier, order reference, purchased entitlement and payment status needed to deliver or investigate the order. Do not assume CoastMC receives or stores every detail entered into an external checkout.

Providing the service: we process account identity, sessions, game state, progression, chosen features and support information where necessary to perform the service agreement or take steps you request before entering it. Providing required information is necessary for the affected feature; for example, we need a reply address to answer an email support request.

Safety and legitimate interests: we process proportionate connection, diagnostic, moderation and anti-abuse information to protect players, investigate incidents, prevent fraud and cheating, maintain reliable systems and handle complaints. We consider the impact on users and limit processing to what is reasonably needed.

Public community features: displaying eligible public profiles, rankings and player appearance supports the legitimate interest in an understandable competitive network. Your network profile-visibility choice affects inclusion in the website statistics feed. You can also object to this processing by contacting us.

Legal obligations: where applicable, we retain or disclose information required for tax, accounting, lawful authority requests or other legal duties. Where processing genuinely depends on consent, it must be obtained separately and can be withdrawn without affecting processing already lawfully carried out. Accepting the terms is not blanket consent to every use of personal data.

Public leaderboards and player pages can be viewed without signing in. A username, UUID and public gameplay statistics can be read, copied or linked by other visitors. The public FFA JSON feed is also accessible outside the website. Minecraft UUIDs can remain associated with the same account after a username change.

The server export refreshes approximately once a minute, and the website caches it briefly. A visibility change is therefore not always instantaneous. The website rejects statistics that are more than five minutes old instead of presenting them as current.

Use the network profile-publicity setting to exclude your profile from this feed, or contact support if you cannot find the setting or your data remains visible. A privacy change does not erase necessary internal gameplay or security records. We cannot control independent copies already made by other people, but will consider requests within our responsibilities.

The website stores selected language under “coastmc.language” and selected country/currency under “coastmc.region” in your browser’s local storage. These are preferences you choose; the country selector is not a statement that we have determined your physical location. The values remain until replaced or cleared in your browser.

Supabase authentication can store session information in the browser when an authorised staff member signs in to administration. General visitors do not need a website account to read public pages or view the leaderboards.

The current website code does not integrate advertising trackers or a third-party audience-analytics script. This does not mean that no technical connection data is processed by hosting or external resources. If optional tracking is introduced, we will update this notice and obtain any consent required before activating it.

You can remove local preferences and session data using your browser’s site-data controls. This may reset your chosen language or region and sign you out. Essential session or security processing is distinct from optional advertising or analytics.

VPS hosting and infrastructure process website and Minecraft traffic and stored network information. Authorised staff access information relevant to support, moderation, security or operations, according to their responsibilities.

Supabase supplies the website’s support-request database and staff authentication. When you submit a support form or use staff sign-in, your browser connects to Supabase; the provider receives the submitted information and technical details of that connection.

Player head images on leaderboard and profile pages load from mc-heads.net. Your browser sends the image provider your IP address and ordinary request metadata, together with the requested player UUID in the image URL. Other generated CoastMC artwork and website fonts are served with the website rather than requiring a Google Fonts request from your browser.

Discord, the external store, identity providers and payment providers receive information when you use their services under their respective notices. Following a link is different from sending a CoastMC support request. We do not sell personal information; disclosures described here are for operating the service, responding to requests, safety or legal requirements.

Internet services and the providers you use can process information in countries other than the Netherlands, including outside the European Economic Area. The location of a VPS does not by itself establish where every service provider processes data.

Where we make a transfer subject to GDPR transfer restrictions, a valid legal transfer mechanism is required, such as an applicable adequacy decision or appropriate contractual safeguards. You can contact us for information about the providers and safeguards relevant to your data. This notice is not a claim that every external website you choose to visit operates under the same arrangements.

We may disclose information when necessary to comply with a valid legal obligation, protect someone from serious harm, investigate abuse or establish, exercise or defend legal claims. Requests are assessed for their legal basis and scope; we do not grant unrestricted access merely because someone asks for data.

We keep personal information for the purpose for which it is needed, subject to legal requirements. A single retention period would not accurately describe all network, support, security and transaction records; the following criteria determine retention.

Account identity and legitimate gameplay progression are kept while needed to provide the persistent network profile and related features. Public rankings use the current exported snapshot; they are not a promise to keep a permanent public history. We assess account deletion and inactivity requests against remaining service, legal and safety needs.

Support and appeal information is kept while the case is handled and for a proportionate period needed for follow-up, repeated abuse, a related dispute or legal claims. Moderation evidence and restriction history may need to be retained while a restriction is active and where necessary to assess evasion, serious safety concerns or a challenge to the decision.

Diagnostic and security information is retained only as needed to maintain systems, investigate incidents and protect against abuse. Order or financial records are kept for any applicable statutory accounting period or unresolved dispute. Legal holds may require particular records to be preserved longer.

When information is no longer needed, it should be deleted or anonymised. Backup copies may remain until the relevant backup cycle expires; they should not be used as an ordinary active record. You can request information about the retention criteria and remaining need for records associated with your account.

We use access controls and operational precautions appropriate to the service. The website accesses the public leaderboard feed without exposing the Minecraft database credentials to visitors; support administration requires an authorised account. These measures reduce risk but cannot guarantee that an online service will never experience a security incident.

Use the HTTPS domain when sending information to CoastMC and check external destinations carefully. The raw VPS IP address may provide an HTTP preview; do not submit confidential information over an unencrypted connection.

Report a suspected security incident privately to support@pyroncompany.com. If an incident creates a notification duty under applicable law, we will assess and meet that duty. We will not ask you for your Microsoft password or authentication codes to investigate a report.

Where the GDPR or other applicable law grants them, you may request access to your personal data and a copy, correction of inaccurate information, erasure, restriction of processing and portability of qualifying data. You may object to processing based on legitimate interests, including public profile processing, on grounds relating to your situation.

Where processing relies on consent, you can withdraw it at any time. We do not use consent as a substitute for another legal basis merely because a user has agreed to the terms. Withdrawal does not affect the lawfulness of processing before withdrawal.

Rights are not absolute: for example, some information may be needed for a legal obligation, a necessary safety record or the defence of a claim. If a request cannot be fulfilled in full, we will explain the reason and available options, rather than simply treating every record as exempt.

Send a request to support@pyroncompany.com or use the contact form. We may ask for proportionate information to verify that the request concerns your account; we will not routinely require an identity-document copy. Requests are normally free. Where the GDPR applies, we respond without undue delay and ordinarily within one month; any lawful extension and its reason will be communicated as required.

Minecraft communities can include young people. We aim to limit collection to information needed for the service and do not ask general visitors for their date of birth or official identity documents as part of ordinary browsing.

A young person should involve a parent or guardian where permission is required by applicable law or a platform provider, particularly for purchases. If a feature relies on a child’s consent, the relevant local age and parental-authorisation rules must be satisfied; there is not one assumed worldwide age for every feature.

A parent or guardian concerned about a child’s data can contact us. We will assess the request, verify authority proportionately and take appropriate action under the applicable rules. Please do not publish a child’s private details in public chat or a public report.

Systems automatically calculate statistics, apply game mechanics and may detect suspicious activity or enforce technical protections. A score or automated signal is not a complete explanation of a player’s circumstances.

If you believe a restriction or automated result is wrong, use the appeals or contact process to ask for human review and explain relevant context. Where applicable law provides rights concerning solely automated decisions with legal or similarly significant effects, those rights remain available; these terms do not waive them.

You can raise a concern with support@pyroncompany.com. You also have the right to complain to a competent data-protection supervisory authority where the law provides it. In the Netherlands this is the Autoriteit Persoonsgegevens; within the EEA you may also contact the authority in your habitual residence, place of work or the place of an alleged infringement.

The effective and last-updated date appears on this page. We will update the notice if the service or our processing changes and provide an appropriate additional notice for significant changes where required. A privacy-policy update does not create consent to optional processing that legally requires a separate choice.