DRAFT: needs legal review before launch. This is a placeholder written by the team to describe what the service actually stores. It is not legal advice and has not been reviewed by a lawyer. The operator’s name, address and jurisdiction must be filled in.

Privacy policy

Draft of 2026. Applies to https://cubecode.studio, the editor at https://app.cubecode.studio/ and our connection service at relay.cubecode.studio.

Who we are

Cube Code is run by [operator name and address, to be filled in]. Contact: [email protected].

What we store

• From Discord, when you sign in: your Discord user id, your username and your avatar. We ask Discord only for the identify permission. We do not get or store your email address, your servers (guilds), your friends or your messages.
• Your account: when it was made, when you last signed in, and your plan.
• Sign-in sessions: a session cookie in your browser and a keyed hash of it on our side, for up to 30 days per session.
• Your servers: for each Minecraft server you link, an id, its Minecraft and plugin versions, when it was linked and when it was last seen, and a hash of its link key (the secret your server keeps so it can reconnect). Link codes are stored as hashes for at most a day after they expire.
• Your scripts: scripts are stored on your Minecraft server, not by us. While you edit, they pass through our connection service to your server, which keeps the latest problem reports of a connected server in memory only.
• Logs: our server logs record connections, sign-ins and errors with internal account and server ids and IP addresses, for security and debugging. They never contain secrets (link keys, sign-in cookies), Discord names or script text. Logs are rotated and kept for a short time (about 50 MB, typically a few weeks).

What we do not do

• No advertising, no analytics, no trackers, no third-party scripts or fonts on this site or in the editor.
• We do not sell or share your data. Discord’s servers (for sign-in) and our hosting provider (which runs the machine) are the only other parties involved.

Cookies

The editor uses one strictly necessary cookie for your sign-in session (__Host-se_session, up to 30 days) and one for the few minutes a sign-in takes (__Host-se_signin). Both are HttpOnly and cannot be read by scripts. The website itself uses no cookies. The editor keeps your scripts, templates, board layout and preferences (for example the last script you opened) in your browser’s own storage (local storage and IndexedDB), which never leaves your computer unless you press Apply; nothing secret is kept there.

How long we keep it, and deleting it

Your data is kept while you have an account. You can delete your account and all its data at any time from your account page: this unlinks your servers at once and removes every record about you from our database. Daily backups of the database are kept for 14 days and then deleted, so a deleted account disappears from backups within 14 days.

Your rights

Depending on where you live (for example under the GDPR in the EU and UK) you can ask for a copy of your data, its correction or deletion, and object to its use, by writing to [email protected]. You can also complain to your data protection authority. [Legal basis, data processor list and authority to be confirmed in review.]

Changes

We will post changes here and announce important ones in our Discord.