Privacy Policy

1. Who we are

ReplayCore is a product of ForgeVector Software Limited, a company registered in England and Wales (company number 17271764), registered office 66 Paul Street, London, EC2A 4NA, United Kingdom. We are registered with the UK Information Commissioner's Office (ICO) under reference ZC171163.

This policy explains what personal data we collect when you visit replaycore.com, create an account, connect a Minecraft server or watch a replay. It covers why we use the data, who receives it, how long we keep it and the rights you have.

We have not appointed a Data Protection Officer, because the law does not require one for our processing. For any data protection matter, contact support@replaycore.com.

2. Our two roles

Controller. We are the controller for data about our own customers and website visitors. This covers accounts, billing, support, security, website analytics and the technical data a connected server sends us so the Service works.

Processor. When a customer records gameplay on their Minecraft server, we process the replay data about their players on that customer's instructions. The customer is the controller of that data. It is responsible for telling its players about the recording and for having a lawful basis for it. Our Data Processing Agreement (replaycore.com/en/legal/dpa) sets out the terms.

If you are a player and want to exercise your rights over a recording, contact the server that recorded you. If you contact us instead, we will pass your request to that server.

3. Data we collect

Account data: your name, email address, a securely hashed password (we never store the password itself), your sign-in settings, your workspace and team role, and your email preferences. If you link a Discord account, we also store your Discord user ID.

Security data: sign-in records with IP address, browser type, approximate location and times, and a record of security-relevant account actions such as password changes and deletion requests.

Billing data: your plan, and payment records such as the transaction reference, product, amount, tax, currency, country and status. Tebex takes the payment (see section 6). We never receive your card details.

Server and plugin data: technical information a connected server sends, such as its name, software versions, player count, recording status and the network address it connects from.

Replay recordings: player usernames and UUIDs; in-game activity such as positions, movement, actions, inventory, equipment and appearance; and, unless the server owner turns them off or redacts them, chat messages, commands and server messages. Known password commands are always filtered out, and player IP addresses are not recorded. Server owners control what is recorded.

Replay viewing: when a replay is watched in game, which player watched it and when. Share links, with who created them and when.

Support and contact: whatever you send us through the contact form, by email or on our community server, plus any details you add so we can help.

Website and dashboard usage: if you accept analytics cookies, Google Analytics records the pages you view, how you arrived, your device and browser type and your approximate location. It also records key actions such as signing up, starting a checkout, connecting a server, opening a first replay and downloading the plugin. We do not send Google your name, email address or account identifiers. See section 7.

Logs: technical logs that keep the Service running and secure. These can include IP addresses, requests and errors.

4. Why we use it and our lawful bases

Performance of a contract: to provide the Service you signed up for, including your account, recording, storage, playback, sharing and support.

Performance of a contract and legal obligation: to take payments and keep billing and tax records.

Legitimate interests: to keep the Service and accounts secure, to prevent fraud and abuse, to investigate problems and to improve our support.

Service emails (performance of a contract): verification, sign-in codes, security alerts and billing notices.

Product update emails (legitimate interests, and for customers the soft opt-in under PECR): you can turn these off at any time from the unsubscribe link or your account settings.

Account help emails (legitimate interests, and for customers the soft opt-in under PECR): a setup guide if you have not connected a server a day after signing up, one check-in a few days after your first replay asking how it is going and inviting a review, and a notice when your server needs an update to keep recording. Each is sent once, only to the account owner's verified email address. The unsubscribe link in them stops these emails without affecting service, billing or product update emails.

Consent: we use Google Analytics, and measure marketing and partner referrals, only if you agree. You can withdraw consent at any time from Cookie settings.

As a processor, we use replay data only to provide the Service to the customer who recorded it, on that customer's instructions.

5. Where your data is processed

We and our providers process data in the United Kingdom, the European Economic Area and the United States. Data that leaves the UK or the EEA is protected by the safeguards described in section 8.

6. Who we share data with

We do not sell personal data. We share it only with the recipients below, who act on our behalf under contract unless stated otherwise, and with authorities where the law requires it.

• Hosting and infrastructure providers, which run our servers, databases and storage.

• Content delivery and security providers, which serve the website and protect it against attacks and automated abuse.

• Payment processor: Tebex Limited is our authorised reseller and merchant of record. Tebex handles your payment, billing and tax details as an independent controller, under its own privacy policy, and tells us the purchase details we need to activate your plan.

• Analytics: Google Analytics (Google Ireland Limited and Google LLC), only if you accept analytics cookies.

• Advertising measurement: Reddit, Inc., only if you accept advertising cookies. The Reddit Pixel tells Reddit when a visitor from a Reddit ad views a page, signs up, adds a server or buys a plan, so we can measure our ads. If you had accepted advertising cookies when you created your account, our servers also tell Reddit about that sign-up and your plan purchases through Reddit's Conversions API. We send a one-way hash of your email address, your IP address and browser type, the Reddit click id if you came from a Reddit ad, and the value and currency of a purchase.

• Email delivery providers, which send our service, account help and product update emails.

• AI service providers, for example Anthropic and OpenAI. These may process limited data to help draft support replies, to run automated security scanning, and to provide code completion assistance to our developers. Model training on our data is switched off with these providers.

• Platforms you use to reach us. If you contact us on our Discord community server, Discord handles your messages under its own terms. If you download the plugin from Modrinth or BuiltByBit, that marketplace handles your data under its own policy, and we do not receive customer data from it.

• Professional advisers, and any buyer of our business if it is sold, under confidentiality.

7. Cookies and Google Analytics

We use necessary cookies to sign you in and keep the Service secure. With your consent, we also use Google Analytics cookies to understand how the site is used, and a marketing cookie to credit partners who refer you. You choose in the cookie banner. You can change your choice at any time from Cookie settings in the site footer or the dashboard menu. Our Cookie Policy lists each kind of cookie.

We use Google Consent Mode. Google Analytics sets no cookies until you accept. Until then it receives only basic signals without cookies, such as the page, the time and your browser type, which Google uses to estimate total visitor numbers.

If your browser sends a Global Privacy Control signal, we treat it as a refusal of advertising cookies everywhere. In the UK, the EEA and Switzerland, we treat it as a refusal of all optional cookies.

Google Analytics does not run on our admin pages, in replay players embedded on other websites, or on customers' own portal domains.

With your consent to advertising cookies, we also use the Reddit Pixel (Reddit, Inc.) to measure our ads on Reddit. It never loads before you accept, and never on admin pages, embedded players or customer portals.

We record which link or campaign brought you to our site when you sign up, to measure our marketing. This doesn't use cookies.

We also count visits that arrive from a campaign link. For each one we keep only the page, the campaign details, the domain of the site that linked to us, your country and whether you used a phone or a computer. We do not keep your IP address, your browser details or any identifier for you, and this doesn't use cookies.

8. International transfers

Some of our providers are in the United States or other countries outside the UK and the EEA. When we transfer personal data to them, we use one of these safeguards:

• for transfers from the UK, the International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement;

• for transfers from the EEA, the EU Standard Contractual Clauses;

• where the recipient is certified, the EU-US Data Privacy Framework and its UK Extension.

You can ask us for a copy of the relevant safeguards at support@replaycore.com.

9. Data Retention

We keep personal data only for as long as we need it:

• Replay recordings: for the retention period of the customer's plan (Free 14 days, Starter 30 days, Pro 60 days, custom plans as agreed), or for a shorter period the customer sets. They are then deleted automatically, and customers can delete them sooner at any time. If a paid plan ends, no replay is deleted early for the next 14 days.

• Accounts: when you delete your account, it is permanently removed after 30 days, so an accidental deletion can be cancelled. When our services to a customer end, we delete the customer's account and replay data 30 days after termination.

• Payment and invoice records, including payment notifications from Tebex: 6 years, as HMRC requires.

• Sign-in sessions and IP addresses: 90 days.

• Security audit logs: 1 year.

• Server logs: 30 days.

• Support tickets: 2 years after they are closed.

• One-time codes: deleted once used or expired, within hours at most.

• Google Analytics: event-level data for 2 months. User-level data is kept for 14 months after your last visit; each new visit restarts that period.

Billing records are kept for longer than the account itself where tax law requires it.

10. Your rights

Under UK and EU data protection law you have the right to:

• access your personal data;

• correct it;

• have it deleted;

• restrict or object to how we use it;

• receive a copy in a portable format;

• withdraw consent at any time, where we rely on consent.

You can also object to direct marketing at any time.

From your account settings you can download your account data and request account deletion. You can change cookie choices from Cookie settings, and unsubscribe from product update or account help emails using the link in any of those emails. For anything else, email support@replaycore.com. We will reply within one month.

You can complain to the UK Information Commissioner's Office (ico.org.uk) or, in the EEA, to your local data protection authority. We would appreciate the chance to resolve your concern first.

11. Security

We protect personal data with encryption in transit, secure password hashing, separation of each customer's data, limited and logged staff access, and regular security testing.

12. Children

You must be at least 16 to create a ReplayCore account.

Players recorded on customers' servers may include children. The customer, as controller, is responsible for giving its players appropriate notice. We provide chat redaction, retention and deletion tools to help.

13. Changes to this policy

We update this policy when our services change, and the date at the top shows the latest version. If a change materially affects how we use your data, we will tell you by email or in the dashboard before it takes effect.

14. Contact

For privacy questions or requests, email support@replaycore.com or write to ForgeVector Software Limited, 66 Paul Street, London, EC2A 4NA, United Kingdom.