Last updated October 17, 2026
1. Who is responsible
Octocarbon runs octocarbon.com and app.octocarbon.com and decides what is collected and why. Write to support@octocarbon.com about anything on this page.
2. What we collect
Your account
- The name you give us, your email address, and a hash of your password (never the password itself). Whether your email is verified, and when you signed up and last signed in.
- Session records so you stay signed in, with the browser and network address they were created from.
Your servers
- Each server's name, kind, state, settings document (homes, teleport requests, sleep and death rules, the allowlist and operator usernames you enter, milestone rosters) and its history of state changes.
- What the server's plugin reports: how many players are online, the Minecraft usernames of players joining and leaving, the running challenge's objectives, time and outcome, how the server is keeping up, and the adventure in progress.
- The world itself and the server's files, on the game machine that runs it.
Your challenges
- The drafts you build and the versions you publish, with your account name shown as the creator on published ones, and the number of servers that have played each version.
Billing
- Your Stripe customer id, your subscription's plan, status and period, and the credit ledger. Card details go to Stripe directly and never reach us.
Livestreams
- If you connect a Twitch channel: the channel's id and display name, its access tokens (stored sealed), your rules and limits, and for each event that reached your rules the viewer's display name, what they did and what happened.
Email and errors
- The emails we send you (verification, password reset) go through Mailgun, which keeps its own log of them.
- Error reports from the site and the dashboard, which can include the address of the page and your browser.
What we don't collect
No advertising trackers, no analytics cookies, no selling of data. The only cookie is the one that keeps you signed in.
3. Why, and on what basis
- To provide the service you asked for: accounts, servers, the editor, the library, billing. (Performing our contract with you.)
- To keep the service safe and working: sessions, rate limits, error reports, the automatic stop of idle servers. (Our legitimate interest in running a secure service.)
- To meet legal duties, mainly invoicing and tax records.
- To email you about your account and servers. We don't send marketing email.
4. Who else handles it
We use a few providers, each for one job, under their own terms:
- Stripe for payments: your email, name, card details (entered on Stripe's pages) and subscription.
- Mailgun to deliver our emails to you.
- Sentry for error reports from the site and the dashboard.
- OVHcloud, where our application and game machines run (United States).
- Backblaze for backups of server files.
- Twitch, if you connect a channel: we receive the events your rules use from Twitch.
Minecraft itself is Mojang's; players on your server also deal with Mojang under Mojang's own privacy policy.
5. Players on your server
If you host a server, the usernames of the people who join it, and what they do in a challenge, are reported to us as described above so that the dashboard can show them to you. Those players are your guests: tell them the server is hosted with us, and don't add personal information about them to settings or challenge text.
6. How long we keep it
- Account data: while the account exists, then deleted within 30 days of closure.
- Servers and worlds: until you delete them, or 30 days or more after a plan ends and the server is suspended, as the terms describe.
- Server activity and challenge playtests: while the server or the challenge exists.
- Published challenge versions: for as long as a server may still be playing them, with the creator's name shown only while the version is in the library.
- Invoices and billing events: as long as tax law requires, usually seven years.
- Twitch tokens: until you disconnect the channel; event records: with the server.
- Error reports: 90 days.
7. Your rights
You can see most of your data in the dashboard. For a copy of everything, a correction, deletion of your account, or an objection to how we use something, write to support@octocarbon.com from the account's address. We answer within 30 days. If you live somewhere with a data protection authority, you may also complain to it.
8. Security
Everything travels over HTTPS, passwords are hashed, server tokens and channel tokens are stored as hashes or sealed, and the machines are kept patched and behind firewalls. No system is perfect; if we learn of a breach that affects you, we tell you.
9. Changes
We update this page when what we collect changes, with a new date at the top, and email you if the change matters. The terms of service describe the rest of our relationship.