Privacy Policy

1. Who we are and what this policy covers

Exylia Stats (the "Service") is the telemetry service at stats.exylia.net. It receives the reports that ExyliaLib, the shared library of the Exylia Minecraft plugins, sends from the servers where release builds of those plugins run, and it offers a private dashboard where only Exylia reads them. It is operated by Cristobal Aranda, a natural person domiciled in Chile ("we", "us"). Contact: [email protected].

We collect these reports for our own purpose, to support and fix the Exylia plugins, so we are the controller of any personal data they contain. We do not process data on behalf of server owners and do not offer them analytics, which is why there is no data processing agreement for this Service.

This policy concerns:

• The owners and administrators of the Minecraft servers that send reports ("Server Operators").
• Visitors of stats.exylia.net, where only the sign-in page and these legal pages are public.
• The people Exylia authorises to sign in to the dashboard.

2. What a server report contains

Reports are designed to describe a server and the behaviour of our plugins on it, not people. ExyliaLib sends one between one and five minutes after the server starts and then about every 30 minutes, plus a report within a minute when an Exylia plugin throws an error. A report can contain:

• Server identifier: a random ID that ExyliaLib generates once and keeps in plugins/ExyliaLib/metrics-id.txt. It is not derived from the server's address, name or licence.
• Environment: server software and its version, Minecraft version, Java version, operating system, architecture, CPU cores, maximum and used memory, machine memory and live threads.
• Players: only the number of players online and the player limit, plus whether the server runs in online mode and behind which kind of proxy (Velocity, BungeeCord or none). Never who the players are.
• Plugins: the name and version of ExyliaLib and of each Exylia plugin and, when the list changes, the name, version and enabled state of every plugin installed on the server.
• Setup: what each Exylia plugin chooses to describe about its own configuration, such as how many arenas or events it has or how large its regions are. Plugins are built never to describe players here.
• Errors: for exceptions thrown by Exylia plugins, the exception type, its message, the stack trace, when it happened (enable, disable or runtime) and how many times.
• Country: a two-letter country code that our network provider, Cloudflare, derives from the IP address of the connection.

Reports never contain player names, player UUIDs, chat, commands, configuration files or licence keys. We do not link reports to licences, purchases or customer accounts.

Error messages and stack traces are written by the software, not by people. They are not meant to contain personal data, but an exception message can occasionally include something the server was handling at that moment, such as a player name or a file path containing a user name. We use them only to fix the error, and we delete them on request (section 9).

The IP address of the server that sends a report is used, in memory, to limit how many reports one address can send per minute, and passes through Cloudflare. It is never written to our database.

For most servers this information does not identify anyone. Where a server can be linked to a natural person (for example a small server run by one person), we treat its reports as personal data and apply this policy to them.

3. Visitors and dashboard users

• Visitors: when you open a page on stats.exylia.net, Cloudflare and our servers process your IP address, browser user agent and the requested URL to deliver the page and protect the Service against abuse. We run no advertising on it.
• Usage analytics, only if you accept them in the cookie banner: Google Analytics and Microsoft Clarity receive the pages you visit (URL path and title), the referring page, your device, browser and operating system, your screen size, an approximate location they derive from your IP address, and your clicks and scrolling. Clarity also makes session recordings and heatmaps of how pages are used, with all text inside the dashboard masked, so report data is not captured.
• Dashboard: access is limited to Exylia. There is no public registration; one dashboard account is configured on our servers. Signing in only sets the session cookie described in section 6; we do not keep a record of who signed in or from where.
• Communications: the messages you send us by email and our replies.

4. Why we use the data and on what legal basis

• To support and improve the Exylia plugins: deciding which Minecraft versions, server software and Java versions to support, finding errors, prioritising fixes and checking that a fix worked. Basis: our legitimate interest in maintaining software that runs on many servers (GDPR art. 6.1.f), and in Chile, the support of the plugins the Server Operator obtained (Law 19.628) and, once Law 21.719 applies, our legitimate interest as that law recognises it. We weighed it against the interests of Server Operators: the data are technical and minimal, servers are identified only by a random ID, no player is identified, and reporting can be turned off at any time (section 5).
• To keep the Service secure and working: rate limiting, abuse prevention and error diagnosis. Basis: our legitimate interest in running a secure service (GDPR art. 6.1.f).
• To answer your requests. Basis: legitimate interest and, where you ask us to act on your rights, our legal obligation.
• To comply with legal obligations and respond to lawful requests from authorities. Basis: legal obligation (GDPR art. 6.1.c).
• To understand how stats.exylia.net is used and improve it, through usage analytics and session recordings, only if you accept them. Basis: your consent (GDPR art. 6.1.a; in Chile, your consent under Law 19.628 and Law 21.719), which you can withdraw at any time with the "Cookies" link in the footer.

We do not profile anyone, make automated decisions about people, sell or rent data, or use it for advertising.

5. How to turn reporting off

Reporting is on by default and the Server Operator can turn it off at any time: set metrics.enabled to false in plugins/ExyliaLib/config.yml and restart the server. From then on ExyliaLib sends nothing, and the plugins keep working normally. The setting is documented at https://docs.exylia.net/docs/exylialib/library-config.

A server that runs no release build of an Exylia plugin sends nothing at all. Deleting metrics-id.txt makes the server report under a new ID; the data under the old ID stay until they are deleted (section 8).

6. Cookies and local storage

stats.exylia.net sets, without asking, only cookies that are strictly necessary or that remember a choice you made; visitors who do not sign in receive none of the first two. Analytics cookies are set only if you accept them in the cookie banner: until you choose, none is set and no analytics script is loaded. There are no advertising cookies.

• exs_session: keeps the dashboard account signed in. 30 days. Strictly necessary.
• exs_rail: remembers whether the dashboard sidebar is collapsed. 1 year. Preference.
• NEXT_LOCALE: the language you chose. 1 year. Preference.
• exylia_consent: remembers whether you accepted or rejected analytics, for every Exylia site (*.exylia.net). 180 days. Strictly necessary.
• Only with your consent, Google Analytics: _ga and _ga_<id>, which tell visits from the same browser apart. 2 years.
• Only with your consent, Microsoft Clarity: _clck (1 year) and _clsk (1 day), which tie the pages of a visit together, and CLID and MUID (1 year), which Microsoft uses to recognise the browser.
• The theme (light or dark) is kept in your browser's local storage and never leaves your device.

You can change your choice at any time with the "Cookies" link in the footer. If you withdraw your consent, the analytics cookies are deleted and the page reloads without the analytics scripts. The choice applies to every Exylia site and is asked again after 180 days.

7. Who receives the data

We run the Service on servers we administer. We share data only with the providers needed to run it, each bound by its own data protection terms:

• Cloudflare, Inc. (United States; global network): DNS, TLS and network protection. All traffic to stats.exylia.net, including every report, passes through Cloudflare, which also derives the country code.
• Discord Inc. (United States): when an error appears for the first time or comes back after being fixed, an alert is posted to a private channel of Exylia's Discord server. It contains the plugin, its version, the error type, the first part of the error message and a link to the dashboard; never the server identifier or the stack trace.
• Google LLC (United States): Google Analytics, only if a visitor accepts analytics. Advertising features and Google Signals are off, and the data is not used for ads.
• Microsoft Corporation (United States): Microsoft Clarity, only if a visitor accepts analytics, with the dashboard content masked.

We may disclose data when required by law or by a court or competent authority, and to defend our legal rights. We do not publish reports or share them with other Server Operators.

8. How long we keep data

• Server record (latest environment, country, installed plugins and setup description) and daily summaries (one row per server and day with software, versions, plugins, peak players, peak threads and error count): there is no automatic expiry today. They are kept while they are useful for supporting the plugins, and deleted on request (section 9).
• Hourly summaries: 8 days.
• Report identifiers used to avoid counting a retried report twice: 2 days.
• Errors: the 50 most recent occurrences of each distinct error, including message and stack trace; older ones are deleted as new ones arrive. The summary of each distinct error (type, message, top stack frame, counts, dates, versions and which servers hit it) has no automatic expiry.
• Discord alerts: deleted from our database 7 days after delivery; an alert that could not be delivered stays until we remove it. Messages already posted remain in the Discord channel until we delete them.
• IP addresses used for rate limiting: held in memory for about one minute, never stored.
• Usage analytics: Google Analytics keeps it for 14 months and Clarity keeps session recordings for 30 days, after which those providers delete it. Withdrawing consent stops any further collection.
• Emails with us: as long as needed to handle the matter and for up to 2 years afterwards, unless the law requires longer.

9. Your rights

Depending on where you live, you have the right to access your data, rectify it, erase it, restrict or object to its processing, receive it in a portable format and withdraw any consent you gave (for analytics, with the "Cookies" link in the footer), without affecting earlier processing. In Chile, Law 19.628 grants the rights of access, rectification, cancellation and blocking, and from Law 21.719 taking effect also objection, portability and the right not to be subject to automated decisions. Where we rely on legitimate interest, you can object at any time; the simplest way is to turn reporting off (section 5).

To have the data of a server deleted, send us its server ID (the content of plugins/ExyliaLib/metrics-id.txt) at [email protected]. Holding that file is how we confirm the server is yours. We delete the server record, its daily and hourly summaries, its error occurrences and its link to each error within 30 days. Error summaries that other servers also hit stay, without any link to your server.

We will answer without undue delay and within the time the applicable law allows (under the GDPR, one month, extendable where necessary).

You can complain to a data protection authority: in the European Union, the authority of your country of residence or work; in Chile, the Personal Data Protection Agency created by Law 21.719 once it is operating, or the courts under Law 19.628. We would appreciate the chance to resolve your concern first.

10. International transfers

Our servers are in Chile, and the providers in section 7 are in the United States. When data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on our providers' own safeguards, such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. Google LLC and Microsoft Corporation, which receive analytics data only if you accept it, are certified under the EU-U.S. Data Privacy Framework.

11. Security

We protect data with measures appropriate to the risk, including encryption in transit (HTTPS/TLS), a database not exposed to the internet, a dashboard that requires signing in for every page and endpoint except report intake, signed session cookies, size limits and validation on every report, and rate limiting.

No system is completely secure. If a personal data breach occurs, we will notify the competent authority and the affected people where the law requires it.

12. Minors

The dashboard is used only by Exylia staff. Reports contain no data about players, whatever their age, beyond how many are online.

13. Changes and contact

We will update this policy when the Service, what ExyliaLib reports or the law changes, and show the date of the latest version at the top. Changes to what is reported are also reflected in the ExyliaLib documentation.

Questions or requests: [email protected].