Privacy Policy

This policy applies to sten.wtf — the dashboard, the API, the Discord bots we host on your behalf, the mail service, and the marketplace. It describes how we handle information belonging to you, the account holder.

It does not describe how Microsoft, Mojang, Discord, or any blockchain network handle data. When you connect those services to ours, their own policies continue to apply to them.

If you use the platform on behalf of an organisation, "you" means both you and that organisation.

We collect only what the service needs to function. In practice that falls into six groups:

• Account and identity — your sten.wtf login, and, if you sign in with Discord, your Discord user ID, username and avatar.
• Minecraft account data — credentials, tokens, recovery codes and two-factor secrets for accounts you choose to secure, plus the profile and statistics we retrieve for them.
• Mail — messages delivered to inbox addresses you create on our domains, including their full content.
• Financial — crypto wallet addresses, deposits, withdrawals, invoices, subscription status and AI balance ledgers.
• Platform activity — bots you create and their configuration, marketplace listings and trades, and support conversations.
• Technical — IP addresses, timestamps, request logs and error diagnostics generated as you use the service.

We do not buy personal data about you from third parties, and we do not run advertising or tracking networks on our pages.

This is the most sensitive information we hold, so it is worth stating separately and plainly.

When you secure a Minecraft account, we store the credentials required to keep that account usable by you: the email address and password, the two-factor secret, the Microsoft recovery code, and any tokens obtained during the flow. Secrets are encrypted at rest.

Access: These records are scoped to your account. Other customers cannot read them. Our own staff do not access them as a matter of routine — access happens only where it is necessary to investigate a fault you have reported, to respond to a credible abuse report, or where the law requires it.

We do not use secured account credentials for any purpose other than operating the service for you. We do not sell them, and we do not use them to play on, trade, or otherwise make use of your accounts.

We operate our own inbound mail service. Addresses you create on our domains receive real email, and we store those messages so you can read them in the dashboard.

That means we hold message content — subjects, bodies, senders and verification codes — for the addresses you create. We process them only to display them to you and to support features such as surfacing a verification code at the top of a message.

We do not read your inbox for any other purpose, and we do not scan message content for advertising or profiling.

Email you send us directly — support requests, abuse reports — is retained as part of the conversation record.

Payments are made in cryptocurrency. We store the addresses involved, transaction identifiers, amounts, invoice records and the resulting balance or subscription state.

Card details: We never see or store them. There is no card processing on this platform.

Blockchain transactions are public and permanent by design. Anything recorded on a public ledger is outside our control and cannot be deleted by us or by you — that is a property of the network, not a choice we made.

Where a third-party payment processor is involved in generating an invoice, the data required to create and settle that invoice is shared with them for that purpose alone.

The platform includes AI chat and AI-assisted module building. When you use these, the messages you send — and the context the assistant needs, such as the dashboard page you are on — are transmitted to the AI provider that serves the model you selected.

We keep a record of usage for metering and billing: which model ran, token counts, and the resulting charge against your free credits or AI balance. We keep conversation content only as needed to provide the feature and to investigate faults.

Do not paste secrets into an AI chat that the assistant does not need. The model provider processes what you send under their own terms.

AI features are optional. Not using them means none of this data is created.

We use what we collect to:

• Operate the service — secure accounts, run your bots, deliver mail, process payments and settle balances.
• Keep the platform working — diagnose faults, monitor availability, and investigate errors you or our systems report.
• Protect the platform and its users — detect abuse, fraud, phishing and unauthorised access.
• Communicate with you about your account, billing, security matters, and material changes to the service.
• Comply with legal obligations.

We do not sell your personal information. We do not share it with third parties for their own marketing, and we do not build advertising profiles.

We share information only in these situations:

• Service providers who make the platform run — hosting and infrastructure, our encrypted off-site backup provider, AI model providers for the features you invoke, and payment infrastructure. Each receives only what their function requires.
• Other users, where you direct it — publishing a shared account page, listing on the marketplace, or completing a trade discloses what that action necessarily discloses.
• Legal requests, where we are compelled by valid legal process, and where we believe disclosure is necessary to prevent serious harm.
• A successor, if the service is transferred to another operator — in which case this policy travels with the data or you are told before anything changes.

That is the complete list. There is no category of sharing we have left out of it.

Credentials and secrets are encrypted at rest. Traffic to the platform is encrypted in transit. Access to production data is limited to the operators who need it to run the service.

Backups are encrypted and stored off-site with a provider-side encryption key, using access credentials scoped to that backup store alone.

You can add two-factor authentication to your own sten.wtf account, and we strongly recommend it. Privacy settings in the dashboard let you mask sensitive values on screen — useful when streaming or sharing a display.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your data, we will tell you what happened, what was involved, and what to do about it.

We keep information for as long as your account is active, and then only as long as we have a reason to.

• Deleted accounts go to a recycle bin and are recoverable for seven days, after which they are permanently purged automatically.
• Mail is retained while the receiving address exists. Removing the address ends retention for it.
• Transaction and invoice records are kept longer, as financial records generally must be.
• Diagnostic logs are retained on a rolling basis for troubleshooting and abuse investigation.
• Encrypted backups roll over on their own schedule, so recently deleted data may persist in a backup for a short period after deletion.

Closing your account removes your data on the timelines above, except where we are required to keep a record for legal or financial reasons.

You can, at any time:

• Access and update your information from the dashboard.
• Export your account data.
• Delete individual secured accounts — recoverable for seven days — or request deletion of your entire account and its data.
• Control what is shown publicly: leaderboard participation, shared page branding, and on-screen masking of sensitive values.
• Withdraw from optional features such as AI chat simply by not using them.

Depending on where you live, you may also have statutory rights to a copy of your data, to correction, to erasure, to restrict or object to processing, and to complain to a data protection authority. We honour these requests regardless of where you are — we do not think geography should decide whether you can get your data back.

To make a request, contact us through the channels in the final section. We may need to verify that the request comes from you before we act on it.

The service is not directed at children and is not intended for anyone under 13, or under the minimum age of digital consent where they live if that age is higher.

We do not knowingly collect information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

The service is operated from, and data is processed and stored on, infrastructure that may be located in a different country to your own. Using the platform involves your information being transferred to and processed in those locations.

We apply the same protections described in this policy wherever data is held.

We may update this policy as the service changes. The date at the top of this page always reflects the current version, and we will give notice of material changes through the platform rather than changing it quietly.

For privacy questions, data requests, or account deletion, reach us through our support channels or the Discord server linked in the footer.

Abuse reports: abuse@kidnap.life — see the Abuse Reporting section of our Terms of Service.