Privacy at PandaEye

PandaEye is an anticheat service for Minecraft servers. This page summarises how player and staff data is handled; the full policy is in the project's PRIVACY document.

Roles

• For gameplay data of a network's players, PandaEye acts as a processor on behalf of the server operator (the controller). Operators receive a template notice to inform their players.
• For the opt-in reputation network and any cross-network model training, PandaEye is a controller, based on a documented legitimate-interest assessment.

What is collected

• Player UUID and name, client version and client brand.
• Gameplay telemetry needed for detection: movement, rotations, combat, block and inventory interactions, latency.
• No IP addresses of players are collected or stored.
• For appeals: the message and an optional contact handle provided by the player.
• For dashboard staff accounts: username, a salted and peppered password hash, session records and short-lived rate-limit counters keyed by a pseudonymous hash of the network address (deleted after a day).

Purposes

Detecting cheating, producing evidence (checks, confidence and short replay clips) for each action, handling appeals, and, only for networks that opt in, sharing confirmed cheat verdicts with other trusted networks.

Retention

• Raw event stream: 24 hours. Detection signals: 7 days. Verdict delivery records: 30 days.
• Replay clips: 90 days, unless referenced by an active ban, an open appeal or a label.
• Verdicts and evidence: 180 days (kept while a ban is active).
• Appeals: 1 year; the contact handle is deleted 30 days after the decision.
• Labels: 2 years. Usage statistics: 2 years. Latency statistics: 30 days. Audit logs: 1 year.

Automated decisions and your rights

• Every kick and ban carries evidence. Ban messages include an appeal code and a link to the appeal form.
• Appeals are reviewed by people. An accepted appeal overturns the verdict and lifts the ban automatically.
• Players can ask the server operator to erase their data; operators can erase a player from the dashboard.
• After an erasure, an active ban keeps only a minimal record (verdict id, UUID, check ids, score, time) under the legitimate-interest exception until it is lifted. Residual data in the event stream expires within the retention times above.

Minors

Many players are minors. PandaEye collects no contact data during play and no IP addresses; appeal contact fields are optional and short-lived.

Regions and sub-processors

The dashboard runs on Cloudflare Workers and D1. The cloud service runs in the region shown on the status page. The full list of sub-processors is in the PRIVACY document.