Privacy Policy · Zelvaria

1. Who we are

Zelvaria is the personal information controller for the personal data described in this policy, within the meaning of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

Operator’s legal name and address: to be provided by the owner
Data Protection Officer: to be designated
Contact: Council Support

2. What this policy covers

This policy covers the Zelvaria website, the Zelvaria Minecraft server, and our support and community channels. Discord, Minecraft (Mojang and Microsoft) and payment providers have their own privacy policies for the data they handle themselves.

3. What we collect today

On the website

The website has optional accounts but no checkout of its own yet. We collect:

Account data, if you create an account: email address, your Minecraft name and edition (and, once you link in-game, your Minecraft UUID as the server reports it), a one-way hash of your password (never the password itself), whether your email is confirmed, the date you accepted the Terms and confirmed your age or guardian consent, and, if you turn it on, an encrypted two-factor key and hashed backup codes.
Security records for accounts: sign-in sessions and security events (such as sign-ins, failed attempts, password resets and two-factor changes) with a hashed form of your IP address and your browser’s user agent. We use these to keep accounts safe and investigate abuse.
Bot protection on sign-up, password reset and repeated failed sign-ins: Cloudflare Turnstile checks that the request comes from a person, and processes your IP address and browser signals to do so.
Hosting logs kept by our hosting provider: IP address, browser and device type, the pages requested, referring page and timestamps. These are used to deliver the site and to protect it against abuse.
Aggregate analytics, if enabled: page views and similar statistics. We don’t use advertising or cross-site tracking cookies. If we add an analytics provider, we will name it here.

On the Minecraft server

Like any Minecraft server, the server processes your in-game name, your Minecraft UUID (Java) or XUID (Bedrock), your IP address, chat messages, commands and gameplay actions. We use these to run the game, keep your progress, and enforce the rules.

When you contact us

If you contact Council Support or apply for a program, we receive the details you send (for example your in-game name, Discord username, channel links or payment receipts). Where an external form is used, the form provider also processes what you enter.

4. What we will collect when accounts launch

The referral program and online checkout are planned for later phases. When they launch, we expect to collect:

Discord data: Discord user ID and username, and whether you joined the Zelvaria Discord server (when you sign in with Discord)
Minecraft data: the playtime needed to check referral qualification
Referral events: the code used, sign-up, Discord join and account-link timestamps, qualification status and rewards issued
Order records: items bought, amounts, dates, payment reference and delivery status. Card and e-wallet details are handled by the payment provider, and we don’t store them.
Support tickets and applications: what you send us, and our replies

This policy will be updated, and its effective date changed, before any of this starts.

5. Why we use it

To run the website and the server and keep them secure (legitimate interests)
To provide accounts, linking, purchases and in-game delivery you ask for (contract)
To count referrals and Realmcaster invites fairly and prevent abuse (legitimate interests, and contract for program participants)
To answer support requests and review applications and appeals (legitimate interests)
To keep records that tax, accounting and other laws require (legal obligation)
For anything else, only with your consent, which you can withdraw at any time

We don’t sell personal data. We share it only with service providers who help us run Zelvaria, and only as far as needed:

our website hosting provider
Discord, for community and support channels
payment providers, when online checkout launches
for website accounts: our database provider (Neon), our rate-limiting provider (Upstash), our email provider (Resend) and Cloudflare (Turnstile bot protection) providers to be confirmed by the owner

We may also disclose data when the law requires it, or to protect players and the Service. Some providers may process data outside the Philippines. When they do, we will rely on appropriate safeguards.

7. How long we keep it

Hosting logs: a short period set by the hosting provider
Server and moderation logs: as long as needed to enforce the rules and handle appeals
Account, linking and referral data: while your account is active, then deleted or anonymised after a set period
Sign-in sessions: up to 30 days; security event records: period to be set by the owner
Order records: as long as tax and accounting laws require
Support tickets: as long as needed to resolve the matter and keep a reasonable history

Exact retention periods: to be set by the owner.

8. How we protect it

We use reasonable organisational, physical and technical measures to protect personal data, and we limit access to staff who need it. No system is perfectly secure. If a breach affects you, we will notify you and the authorities where the law requires.

9. Your rights

Under the Data Privacy Act you have the right to:

be informed about how your data is processed
access your personal data
object to processing, and withdraw consent
have inaccurate data corrected
have your data erased or blocked where the law allows
receive your data in a portable format where the law allows
claim damages for harm caused by unlawful processing
file a complaint with the National Privacy Commission

To use these rights, contact Council Support. We may need to confirm your identity first.

10. Children and teenagers

Many Minecraft players are under 18. We collect only what we need to run the game. Website accounts and purchases by anyone under 18 require the consent of a parent or guardian. A parent or guardian who believes their child has given us personal data can contact Council Support to review it or have it deleted.

11. Cookies and local storage

The website doesn’t use advertising or tracking cookies. It may store small preferences in your browser so the site works as expected. If you sign in, we set two essential cookies: one keeps you signed in, the other protects your forms against cross-site request forgery. Neither is used for tracking. Signing out removes the sign-in cookie.

12. Changes to this policy

We will post any update on this page with its effective date, and announce significant changes before they apply.

13. Contact

Privacy questions and requests: Contact Council Support.

See also: Terms of Service · Privacy Policy · Store Terms