Privacy Policy

Account info. Email, username, and a password — stored as a bcrypt hash, never in plain text, so we can't read it back even if we wanted to. Used to log you in and to reach you about your listings or bids.

Votes. When you vote for a server, we record the Minecraft username you voted with and a salted hash of your IP address — not the address itself. That hash exists purely to enforce the 24-hour cooldown and stop one person padding a server's numbers with alt accounts. It can't be reversed back into an actual IP address.

Uploaded banner images. This one is handled differently on purpose. Every image you upload as a listing banner is logged with your account, your real IP address (not hashed), your browser's user agent, and the time. We keep this because if an upload ever needs to be reported to the National Center for Missing & Exploited Children or to law enforcement — see our Terms of Service for what that covers — a hashed address is useless for that, and a real one is what actually gets used. This log is not anonymized, is kept indefinitely, and is not accessible through any part of the site — only site administrators can query it directly.

Payments. Card numbers never reach our servers — Stripe and PayPal handle that directly, and we only ever see a token referencing a saved payment method, not the number itself. We do keep a record of every balance change (deposits, charges, refunds) tied to your account, because that's the ledger a real-money auction system has to keep to be auditable.

Server pings. If you list a server, we periodically connect to its address to check whether it's online and how many players are on it. This is a connection to the server you listed, not to you.

A session cookie keeps you logged in. It's the only cookie this site sets directly, it's marked httpOnly (JavaScript on the page can't read it), and it expires or gets invalidated when you log out, reset your password, or an admin bumps your account's session version.

If Google AdSense is active on this site, Google and its advertising partners may set their own cookies to serve and measure ads, including based on your visits to this and other sites. We don't control what those cookies store. You can see and adjust how Google personalizes ads at adssettings.google.com, and industry-wide ad opt-outs are available at aboutads.info. Google's own policy on this is at policies.google.com/technologies/partner-sites.

Nobody, by default, except where a payment or delivery requires it:

• Stripe, PayPal, and Coinbase Commerce — for the payment method or charge you initiate. They're independent data controllers for that transaction; their own privacy policies apply to it.
• Our email provider — to actually deliver account, listing, and auction emails to your inbox. It sees the email address and message content, not your password or payment details.
• Google AdSense — if active, per the cookies section above.
• Law enforcement — when legally required, or in the specific, serious case described in the uploaded-images section above and in our Terms of Service.

We don't sell your data. There's no advertiser relationship here beyond AdSense serving its own ads.

Account and listing data stays until you delete the listing or close the account. Financial ledger entries are kept indefinitely — that's a normal requirement for anything handling real payments, not a ServerShulker-specific choice. The upload log described above is also kept indefinitely, for the reason given there.

You can update your account details from your dashboard at any time. To close your account or request deletion of data we don't need to keep for legal or financial record-keeping reasons, email us at the address below — there isn't a self-service delete button yet.

You need to be at least 13 to create an account here. Voting doesn't require an account or collect anything beyond a Minecraft username and a hashed IP, but the site as a whole isn't directed at young children, and account holders placing real bids need to meet the age requirement in our Terms of Service.

If this policy changes in a way that matters, we'll update the date at the top of this page.

Privacy questions, data requests, or anything else covered here: [email protected] (update this address before launch).