Privacy Policy
Last updated: 7 September 2026
This page says what Grynora stores, why, and what you can do about it. It describes what the service actually does — nothing here is boilerplate.
1. Who is responsible
Grynora is run privately, not as a company. For anything about your data, write to support@grynora.com.
2. What we store
- Your account — the username you choose, your password as a salted hash (never the password itself), the date you signed up, and a random token that keeps you signed in.
- Your server settings — the address name you pick, the server name shown in the Minecraft server list, game settings, and any Minecraft names you put on your whitelist or operator list.
- Your worlds — world files you upload, and the worlds your server creates.
- What the Minecraft server itself keeps about players who join. This part is
Minecraft's own doing, not ours, but it happens on our machine so we name it plainly:
- its log records each player's Minecraft name and IP address when they connect;
- a player cache holds the Minecraft name and account ID of everyone who joined, for about a month after their last visit;
- if the owner bans someone, that person's Minecraft name or IP is written to a ban list.
- Web server logs — the usual line per request: IP address, time, the page asked for, the answer given, the page you came from and your browser. They keep the service running and help spot abuse.
- Service log — the site writes technical entries (which page was called, and errors) to the system journal. It does not contain visitor IP addresses.
- Safety copies — before the account file is written, the previous version is kept alongside it, so a mistake cannot wipe every account at once. Before a bigger change to the service we sometimes copy the settings folder as well, and remove that copy once the change has proven itself.
If you run a server, other people's data lands here too — the Minecraft names and IP addresses of the friends you invite. This policy covers them as well. Please tell the people you play with that a server keeps a log, the same way every Minecraft server does.
3. Why, and on what basis
- To give you an account and run your server — Art. 6(1)(b) GDPR, the agreement between us.
- To keep the service safe and working, and to stop abuse — Art. 6(1)(f) GDPR, our legitimate interest.
There is no advertising, no tracking and no profiling, and nothing here is decided automatically about you (Art. 22 GDPR).
What you have to give us: a username and a password. Without them an account cannot exist, and without an account there is no server. Everything else — the address name, the server name, whitelist entries, worlds — is yours to fill in or leave empty.
4. Cookies
One cookie, and only after you sign in: it holds a random token so the site knows it is still you. It is not used for anything else, and signing out removes it. Nothing else is stored in your browser — no local storage, no analytics, no embedded content from other sites. Because that one cookie is strictly necessary for a service you asked for, no consent banner is required (§ 25(2) TDDDG).
5. Where it is hosted
On a rented server from netcup GmbH (Germany), physically located in Vienna, Austria, inside the EU. There is a data processing agreement in place (Art. 28 GDPR).
6. Who else sees anything
- Mojang Studios / Microsoft — when someone joins, your server asks Mojang's session service to confirm that the player really owns the account they are using. That check is part of Minecraft itself, it happens on every Minecraft server, and it cannot be switched off without letting anyone play under any name. What exactly is exchanged is set by Mojang, not by us — their privacy notice covers it.
- PaperMC and Adoptium — the server software and Java are downloaded from them. No data about you is sent.
Nothing is sold, and nothing is passed on for advertising.
7. How long we keep it
- Your account, settings and worlds stay until you delete them or ask us to. The safety copy of the account file is overwritten each time and goes with the account.
- Everything the Minecraft server keeps — its logs, the player cache, ban lists — lives in your server's folder and is removed when the server or your account is removed. The player cache drops an entry roughly a month after that player last joined.
- Web server logs are rotated daily and deleted automatically after 14 days.
- The service log is kept by the operating system and rotates away as it fills up. It holds no visitor IP addresses.
8. How it is protected
The website runs over an encrypted connection, and the part of the service that holds your account is not reachable from the internet at all — only through the website. Your Minecraft server does listen on a public port, because that is how your friends connect to it. Passwords are stored only as a salted hash, and the machine itself is reached by key rather than by password.
This is a small private project, not a company with a security team. Please keep that in mind and do not store anything sensitive here.
9. Your rights
You can ask for a copy of your data, have it corrected or deleted, have its use restricted, receive it in a portable form, and object to processing based on legitimate interest (Art. 15–21 GDPR). Write to the address above. You can also complain to a data protection authority (Art. 77 GDPR).
10. Deleting your account
Write to support@grynora.com from any address and say which account it is. Your account, settings and worlds are removed.
11. Young players
Minecraft is played by a lot of young people, so Grynora is built to ask for as little as possible: a username and a password, nothing else. No real name, no address, no date of birth.
If you are under 16, please ask a parent before you sign up. If you are a parent and want your child's account and worlds removed, write to the address above and it will be done — no questions, no proof needed.
12. Changes
If this changes, the date at the top changes with it.