Privacy
What mcindex.gg stores, why and for how long.
As of 4 October 2026
1The short version
- mcindex.gg shows no advertising. For simple visitor statistics we use Umami, run by ourselves, without cookies and without any third party (see “Visitor statistics”). Your browser loads fonts, scripts and images from mcindex.gg only, never from a third party.
- We set cookies only where they are technically necessary: for signing in, and for language, appearance and currency when you change them.
- Profiles show publicly available data of Minecraft accounts: name, UUID, skin, capes and earlier names. On top of that we rate how rare the account is.
- If you do not want your Minecraft profile to appear here, you can have it removed free of charge through the form “Hide a profile”; our team handles the request. As the linked owner you can also hide single capes, earlier names or the rarity yourself in the settings.
- An account with mcindex is optional. It does not need an e-mail address.
2Who is responsible
The controller within the meaning of the General Data Protection Regulation (GDPR) is the operator of mcindex.gg.
Privacy requests, in particular about a Minecraft profile, reach us through the form “Hide a profile”. As the linked owner of a profile you can hide single capes, earlier names or the rarity yourself in the settings.
3When you visit the website
When you open a page, your browser transmits technically necessary information: your IP address, the address requested, the time, the browser identifier and, where applicable, the page you came from.
- Protection and delivery: traffic runs through Cloudflare (protection against overload, delivery). Cloudflare processes your IP address on our behalf.
- Access log: the web server keeps a log of requests with IP address, time, address, status code and browser identifier. It serves troubleshooting and the defence against abuse and is deleted after 15 days at most.
- Request limits: so that single networks cannot overload the site, we count requests per network (IPv4 address or IPv6 prefix). No clear text is stored for that, only a check value formed with a secret key, and a counter; both expire after minutes to one day at most.
- A calculation in your browser: some forms (registration, “Hide a profile”) and the first load of a profile make your browser solve a short calculation. This replaces third-party puzzles; no data is sent to third parties in the process.
- Application log: the application itself logs no IP addresses, e-mail addresses, user names or browser identifiers.
- Security reports: if something on a page violates our security policy (CSP), your browser reports it to us. Of that we store only the page concerned, the rule violated and the origin of the blocked resource.
The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).
5Visitor statistics
To understand which pages are used and how visitors find us (for example through a post with a link such as mcindex.gg/?ref=x), we measure reach with Umami. Umami is open-source analytics software that we run ourselves on our server in Germany. Script and collection endpoint are on mcindex.gg; no data is passed to third parties or to the maker of Umami.
For each page view we record:
- the page opened, without search terms and without any other additions to the address; a player name in the address is replaced by a placeholder first (/player/Name becomes /player/[name]);
- campaign markers in the address (ref and utm_…), for example “ref=x”;
- the website you came from, only its address without a path (for example https://t.co/);
- browser, operating system, device type, screen size and browser language;
- the country, derived from the IP address;
- a few events without content: that a search was submitted (not what was searched for), that a profile was viewed (not which one), that a claim was started, clicks on Index+, on the invitation to our Discord and on links to X.
Your IP address is not stored. Our web server passes it on only shortened (IPv4 to /24, IPv6 to /48). From that, the browser identifier and a value that changes every day, Umami forms a random identifier that only groups the page views of one day. There is no recognition across days, no profile of you and no link to your account: user names, account ids and UUIDs are never sent.
The admin area, the settings, sign-in, registration, password recovery and the pages of e-mail links are not measured. If your browser sends “Do Not Track” or “Global Privacy Control”, the statistics script is not loaded at all.
The data is deleted automatically after 13 months. The legal basis is our legitimate interest in measuring the reach of the site and the success of posts that point to it (Art. 6(1)(f) GDPR). You can object at any time, most simply by switching on “Do Not Track” or “Global Privacy Control” in your browser.
6Minecraft profiles
When somebody searches for a player name or a UUID, our servers fetch the publicly available data for it and store it:
- from Mojang (the official interface): UUID, current name, skin and the cape being worn;
- from NameMC: earlier names with their dates, the list of capes known there and, when someone looks up a name, which accounts held that name before;
- from OptiFine (s.optifine.net): the picture of an OptiFine cape, requested with the player name. Your browser loads it from mcindex.gg only;
- calculated by us: rarity score (0 to 100) and tier with their reasons, and daily counters of how often a profile was viewed.
This data relates to a Minecraft account. We neither know nor store a legal name, an e-mail address or login details of the account. Because a player name can be linked to a person, we treat the data as personal data all the same.
The purpose is looking up accounts and a comprehensible rating of how rare they are. The legal basis is our legitimate interest, and that of our users, in this information (Art. 6(1)(f) GDPR). The data is publicly available from the sources named in any case.
You can object to this processing at any time. In practice that means: we hide the profile. The whole profile is removed through the form “Hide a profile”, with or without an account; our team handles the request. As the linked owner you can also hide single capes, earlier names or the rarity yourself in the settings. Hidden profiles appear neither as a page nor in suggestions, cape lists or preview images.
To keep a hidden profile hidden, we maintain a block list with the UUID and the reason for the block. It is kept permanently, also across data restores.
7An account with mcindex
For an account we store:
- your user name (it is not shown publicly anywhere);
- your password as a hash only (Argon2id), never in clear text;
- an e-mail address only if you choose to give one. We use it only for confirmation links, password resets, security notices about your account and Index+ notices – never for advertising, without tracking pixels and without link tracking. You can switch off the notices about new sign-ins and Index+ in the settings;
- language, appearance and currency, and the time at which you accepted the terms of use;
- your sessions: a hash of the session key, a coarse device label (for example “Firefox, Windows”), a country code and the times of sign-in and last use. We do not store an IP address with them;
- recovery codes as hashes only;
- notices to you inside the site and a log of security-relevant events (for example “password changed”), without IP address and without browser identifier.
The legal basis is the contract of use (Art. 6(1)(b) GDPR). You can export your data in the settings and delete the account there at any time.
8Linking a Minecraft account
If you want to prove that you control a Minecraft account, you join our Minecraft server and enter a code there. For that the server sends us the UUID and name of the account, the code and the IP address of the connection. The IP address only serves to limit failed attempts and is not stored in clear text. We never learn the login details of your Minecraft or Microsoft account.
We store the link between your mcindex account and the UUID together with the time of the proof. What is publicly visible is at most that and when control was proven, never your mcindex account.
The connection to the Minecraft server runs through a protection service (TCPShield), which processes your IP address in doing so. The legal basis is the contract of use (Art. 6(1)(b) GDPR).
9Index+ and payment
The seller and contracting party for Index+ is Tebex Limited (see the imprint). The purchase is completed on Tebex’s pages; Tebex processes your payment and billing data as a controller in its own right.
We receive notifications from Tebex about the state of a subscription and store which account it belongs to, its status and when it ends. We do not store names, addresses, payment data or IP addresses from the purchase.
10The form “Hide a profile”
Through the form we store the player name or UUID given, your message and, if you give one, a way to contact you. We use this only to handle the request. We delete contact details and message 90 days after the request has been dealt with.
The legal basis is compliance with your rights as a data subject (Art. 6(1)(c) GDPR) and our legitimate interest in handling the request (point (f)).
11Earlier feedback on ratings
Until October 2026 a profile let you say with one click whether an assessment fitted. That vote no longer exists. Votes already cast are stored with a check value of your network or, if you were signed in, of your account; the check value is a hash formed with a secret key, and we do not store an IP address with it. Your votes are deleted together with your account.
12Recipients and service providers
- Cloudflare: delivery and protection of the website (processing on our behalf). Data may be transferred to countries outside the EU in the process.
- TCPShield: protection of the Minecraft server used for the proof of control.
- Hosting: the servers are located in a data centre of Hetzner Online GmbH in Germany.
- Visitor statistics: Umami runs on our own server; no data goes to third parties in the process.
- E-mail delivery: we send our e-mails through mailbox.org (Heinlein Hosting GmbH, Berlin) on our behalf (data processing agreement). Your e-mail address and the content of the message are transmitted for this. After sending, our database keeps only a digest of the address; outbox entries are deleted after 90 days.
- Tebex Limited: seller of Index+, a controller in its own right.
- Mojang and NameMC: our servers request data about Minecraft accounts there. These services learn nothing about you as a visitor in the process; your browser does not contact them.
We do not sell data and do not pass it on for advertising purposes.
13How long we store data
- Sessions: without “Stay signed in” up to 12 hours after the last use, 7 days at most; otherwise up to 30 days after the last use, 90 days at most.
- Counters for request limits: minutes to one day at most.
- Access log of the web server: 15 days at most.
- Visitor statistics: 13 months.
- Log of security-relevant events: 400 days.
- Requests through the form “Hide a profile”: 90 days after they were dealt with.
- Account data: until you delete the account.
- Profile data of Minecraft accounts: as long as the profile is kept; after an objection only the entry in the block list remains.
- Backups: 35 days at most.
14Your rights
Under the GDPR you have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing that is based on a legitimate interest (Art. 21).
Much of this you can do yourself: export your data and delete the account in the settings, hide single capes, earlier names or the rarity in the settings, and have a whole profile removed through the form.
You can also lodge a complaint with a data protection supervisory authority if you believe that we do not process your data lawfully.
15Changes to this text
If the site or the legal situation changes, we adapt this text. The version published here applies.