Privacy policy
Last updated:
Data collection summary
| Data | Source and purpose | Proposed legal basis | Retention |
|---|---|---|---|
| Connection details, IP address, request and device metadata | Vercel website delivery; self-hosted CookieAPI on a Prepaid-Host server; security and diagnostics | Art. 6(1)(f) GDPR: reliable, secure operation | Retention period not yet established |
| Discord ID, profile name, avatar and email | Discord sign-in and website account management | Art. 6(1)(b) GDPR: requested account service | Retention period not yet established |
| Minecraft UUIDs, names, verified links and linking attempts | MC-ID (mc-id.com); identity verification and cape ownership | Art. 6(1)(b) GDPR | Link attempts expire after 10 minutes; persistent links: retention period not yet established |
| Session token hashes and authentication cookies | Auth.js and CookieAPI; secure sign-in | Art. 6(1)(b)/(f) GDPR; necessary session storage | Website sessions expire per their stored expiry; expired records are cleaned up. Cookie lifetime follows Auth.js session expiry. |
| Cape images, names, assignments and verification status | Uploads, public cape/player galleries and mod functionality | Art. 6(1)(b) GDPR | Certain legacy capes hidden after account review: eligible for deletion after 30 days; other uploads: retention period not yet established |
| Security/audit records, usage counts and API performance statistics | CookieAPI moderation, upload limits, service monitoring | Art. 6(1)(f) GDPR | Retention period not yet established; expired upload reservations and short-lived records have scheduled cleanup |
| Player names, skin/name history, country and social profile entries | Public profile display; names.amplitudes.me, Minotar and Crafthead | Art. 6(1)(f) GDPR: requested community profile display | Retention period not yet established |
| Page views, referrers, device/usage statistics, outbound domains and web vitals | Hosted Betterlytics analytics | Legal basis not yet determined | Retention period not yet established |
| Browser language and English/German preference | Accept-Language selects the initial CookieCapes language; cookiecapes.locale remembers an explicit choice | Requested preference storage; Art. 6(1)(f) GDPR where applicable | Language header used per request; preference cookie lasts one year and is scoped to /cookiecapes |
| Minecraft UUID, Discord ID and account name | CookieAttack server registration and account lookup through playerdb.co | Legal basis not yet determined | Retention period not yet established |
| Minecraft player names, UUIDs, gameplay statistics and achievements | CookieAttack statistics backend and public leaderboards | Legal basis not yet determined | Retention period not yet established |
| Connection information | Homepage server status request to api.mcstatus.io | Legal basis not yet determined | Retention period not yet established |
1. Introduction
Leon Meyer operates CookieAttack and CookieCapes as a noncommercial community project. Contact: leon@cookieattack.de. This notice covers the whole cookieattack.de website, including the homepage, registration, CookieCapes, and their connected backend services.
Plain English: browsing, signing in and uploading a cape involve different data flows. This notice explains the flows found in the code; it does not assume that a free service processes no personal data.
2. Information we collect
We process the data listed in the summary when you browse, sign in through Discord, link Minecraft accounts through MC-ID, upload a cape or use account management. Discord sign-in can provide your email as well as your provider identity and avatar. We store provider account identifiers but intentionally do not persist Discord OAuth access or refresh tokens.
Cape images, cape names, Minecraft names/UUIDs, assignments and verification badges are publicly displayed where the service makes them available. Player pages can display public name/skin history, social entries and country returned by names.amplitudes.me. Image requests to external services can disclose connection details to those services. Do not upload personal information in a cape design.
3. How we use information
We use account and upload data to deliver the features you request (Art. 6(1)(b) GDPR). Reliable delivery, security, moderation, abuse prevention and technical diagnostics are proposed legitimate interests under Art. 6(1)(f) GDPR. Any processing required by a specific law would rely on Art. 6(1)(c) GDPR only where that obligation actually applies.
4. Cookies and analytics
Auth.js uses a website session cookie (__Secure-cookiecapes.session-token in production, cookiecapes.session-token in development) and may use temporary OAuth security cookies. The session cookie is HttpOnly, SameSite=Lax and Secure in production. The language switch sets cookiecapes.locale only after an explicit choice: one-year lifetime, /cookiecapes path, SameSite=Lax, Secure in production. You can remove cookies in your browser; removing the session cookie signs you out and removing the language cookie restores automatic browser-language detection.
Betterlytics is initialized globally using its hosted script and event endpoint. Web vitals and outbound-domain tracking are enabled; session replay and error tracking are not enabled in the inspected configuration. Betterlytics describes its standard analytics as cookieless and says it does not store visitor IP addresses. Those are provider statements, not an independent audit. Disabling cookies alone does not disable cookieless analytics.
5. Information sharing
The website is hosted on Vercel. CookieAPI is hosted on a server from Prepaid-Host (prepaid-host.com). Discord handles website authentication, and MC-ID (mc-id.com) verifies Minecraft identities when linking is enabled. Minotar (minotar.net), Crafthead (crafthead.net) and names.amplitudes.me provide skin/avatar or profile-history features; depending on the request, access is direct from the browser or through our server/image proxy. Betterlytics receives analytics events. The homepage requests Minecraft server status directly from api.mcstatus.io, exposing visitor connection information to that service. When checking a Minecraft name for server registration, our server requests playerdb.co; the server registration backend receives the Discord ID and Minecraft UUID. The statistics service supplies publicly displayed gameplay statistics, achievements and player identifiers.
6. Data retention
The API expires Minecraft link attempts after 10 minutes and schedules cleanup of expired attempts and website sessions. Legacy capes hidden after account review are scheduled for deletion after 30 days and can be restored before that deadline. Cape-review records are cleaned up 30 days after expiry; upload reservation records older than two UTC date boundaries are eligible for cleanup. Cleanup runs periodically, so eligibility is not a guarantee of immediate deletion.
These rules do not establish a general 30-day account or upload deletion policy. Contact leon@cookieattack.de to request erasure; applicable legal obligations and the rights of others may limit erasure.
7. Your GDPR rights
Where the GDPR applies, you may request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), and portability where its conditions apply (Art. 20). You may object to processing based on legitimate interests (Art. 21). Art. 22 protects against qualifying solely automated decisions with legal or similarly significant effects.
Email leon@cookieattack.de to exercise a right. We may request proportionate information to establish identity. You may withdraw any consent at any time without affecting prior lawful processing and complain to a competent supervisory authority (Art. 77). Requests are normally answered within one month, subject to the GDPR's permitted extensions and exceptions.
8. California privacy rights
If applicable, California residents may request to know/access, delete, or correct personal information; opt out of sale or sharing for cross-context behavioural advertising; limit qualifying use/disclosure of sensitive personal information; and exercise rights without unlawful discrimination.
Send requests to leon@cookieattack.de. Identity verification and statutory exceptions may apply. No advertising-sale integration was detected; this observation is not a verified statement about every provider's practices. These conditional explanations do not assert that CookieCapes meets CCPA business thresholds.
9. Security
The inspected code uses server-only service credentials, session token hashes in the API database, protected website session cookies, ownership checks and validation at account/upload boundaries.
10. International transfers
External hosting, authentication, analytics and image/history providers may process requests outside Germany or the EEA. Prepaid-Host advertises German data centres and Betterlytics states that its hosted analytics processing is in the EU.
11. Children's privacy
Minecraft is used by children as well as adults. This website does not establish a verified minimum age or a parental-consent workflow. No age or consent mechanism is claimed by this notice.
If a child has supplied personal information in circumstances requiring parental authorization, a parent or guardian can contact leon@cookieattack.de to request review or erasure. Do not submit unnecessary information about the child.
12. Contact and updates
Controller: Leon Meyer, Germany. Email: leon@cookieattack.de.
Last updated: 28 October 2026.