Privacy Policy

1. Who This Covers

This policy applies to visitors, account holders, Minecraft players, Discord server managers using Legend, social users, job or staff applicants, support contacts, and people who buy or receive digital benefits.

Contact us using the details at the bottom of this page if you have privacy questions or want to exercise a data protection right.

2. Information We Collect

We collect information you give us, information created by your use of the service, and technical data.

• Account data: user ID, email address, username, display name, avatar, Minecraft username, profile details, linked provider details, and admin or entitlement status.
• Authentication data: Firebase session data, OAuth provider identifiers, provider profile details, login state, password reset events, and security metadata.
• Community data: posts, comments, profiles, direct messages, friend requests, notifications, call metadata, moderation records, support reports, and related timestamps.
• Minecraft data: server access requests, linked Minecraft username, ranks, whitelist/code activity, support issues, purchase delivery, and moderation records.
• Purchase data: Tebex checkout identifiers, transaction IDs, product names, ranks or app plans, amount, currency, payment status, buyer email, subscription references, refunds, disputes, and entitlement records.
• Legend data: Discord user ID and username, Discord OAuth grants, manageable guild IDs, server names, icons, role IDs, channel IDs, emoji data, bot configuration, embeds, published messages, buttons, reactions, reaction roles, commands, automations, tickets, audit logs, sync jobs, uploaded Discord bot assets, and custom bot application details.
• Hiring and support data: names, Discord username, Minecraft username, age range, timezone, availability, role preferences, answers, evidence links, uploaded files, messages, and contact details you submit.
• Technical data: IP-derived request information, browser and device information, logs, security events, cookie choices, local storage preferences, app session checks, and error diagnostics.

3. Why We Use Information

We use information for the following purposes:

• To create accounts, authenticate users, link providers, maintain sessions, and secure access.
• To provide Minecraft server features, ranks, support, moderation, whitelist access, voting, and wiki/support information.
• To run social features, profiles, conversations, calls, notifications, forums, friend requests, and moderation tools.
• To operate apps, check premium entitlements, and pass limited session status to embedded tools.
• To provide Legend server discovery, bot setup, dashboard access, commands, messages, automations, tickets, sync jobs, and audit logs.
• To process payments, deliver digital benefits, manage subscriptions, prevent fraud, handle disputes, and provide billing history.
• To process hiring applications, support requests, bug reports, business inquiries, and evidence files.
• To protect users, detect abuse, enforce rules, investigate incidents, improve the service, and meet legal obligations.
• To show advertising only on approved content pages and manage advertising privacy choices.

4. Legal Bases

Depending on the context, we rely on different legal bases under UK data protection law. These may include:

• Contract: to provide accounts, apps, purchases, subscriptions, Minecraft benefits, and requested services.
• Legitimate interests: to secure the service, prevent abuse, moderate communities, improve features, and answer support requests.
• Consent: for optional cookies or storage, certain OAuth connections, and any processing where we ask for consent.
• Legal obligation: to keep records needed for tax, accounting, consumer, fraud, safety, or legal compliance.

5. Sharing Information

We do not sell personal information. We share information where needed to run Enderfall, including with:

• Firebase and hosting/storage providers for authentication, databases, file storage, and infrastructure.
• Tebex and payment providers for checkout, payment history, recurring payments, refunds, disputes, and fraud checks.
• Discord for OAuth, server discovery, command permissions, bot operation, message publishing, roles, tickets, and automations.
• Google AdSense and advertising partners when ads are eligible and lawful privacy signals are available.
• Email, support, admin, security, and analytics/service providers used to operate the site.
• Law enforcement, regulators, platform providers, or affected parties when required by law or needed to protect rights and safety.

6. Cookies, Storage, and Advertising

We use essential cookies and browser storage for login, security, checkout, privacy choices, app sessions, preferences, and requested settings. Advertising privacy choices are handled through Google's consent management tools where Google AdSense is available.

Advertising technology is restricted to approved content pages. We do not intentionally request ads on legal, login, profile, checkout, admin, messaging, social utility, or other low-content screens. Your Google consent choices may affect whether Google serves personalised ads, non-personalised ads, limited ads, or no ads. More detail is in the Cookie Policy.

7. Legend and Discord Data

Legend uses Discord data so authorized users can select servers, configure the bot, publish messages, manage commands, run automations, set up reaction roles, configure tickets, and audit changes.

Discord OAuth access is used for server discovery and, where authorized, command permission management. Custom bot tokens are only accepted for premium personalizer features and are encrypted before storage, but you should still treat them as sensitive credentials and rotate them if you suspect exposure.

8. Retention

We keep information for as long as needed for the purposes described above. Retention periods vary by data type: account and profile data usually stays while your account is active; payment and accounting records may need to be kept longer; support, moderation, audit, bot, and security records are kept as needed to resolve issues, prevent abuse, and protect the service.

If you ask us to delete data, we will delete or anonymise what we reasonably can, unless we need to keep it for legal, security, fraud prevention, payment, dispute, or moderation reasons.

9. Your Rights

Depending on your location and the legal basis involved, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal information. You may also withdraw consent where we rely on consent.

You can manage privacy choices from Privacy Settings, unlink providers or update profile details where the site provides controls, and contact support for account deletion or privacy requests.

10. Security

We use technical and organisational measures to protect information, including authentication controls, access checks, scoped Discord server permissions, file-size and path checks, and encrypted storage for custom Legend bot tokens. No online service can be guaranteed completely secure.

11. Children and Young Users

Enderfall is not intended for children below the minimum age required by applicable law or platform rules. Young users should use the service with parent or guardian involvement where required.

12. Changes to This Policy

We may update this policy as Enderfall, Legend, apps, payment flows, advertising requirements, or legal requirements change. The updated date at the top shows when this version was published.

13. Contact

Questions or privacy requests can be sent to Enderfall support.