Menu

Legal

Privacy Policy

This policy describes data handled by the MCAddonsHub website, Android app, and community service.

Version: 2026-10-27Updated: Operator: MCAddonsHub Team

1. Contact and scope

MCAddonsHub Team (“we”, “us”) operates MCAddonsHub. For privacy questions or requests, email [email protected]. This policy covers the public website, Android app, and community API. The public website pages do not load third-party analytics or advertising scripts. The Android app uses the third-party services listed in section 4.

The community is intended for people aged 13 or older. If we learn that a younger child has submitted community data, a parent or guardian may contact us to request its removal.

2. Data we handle

  • Catalog and local data: the app requests catalog information and files from our server. Search history, downloaded files and download history, settings, and favorites may be kept on your device.
  • Anonymous community profile: a numeric user ID, nickname if chosen, a hash of the access token, accepted document versions, language, and acceptance time. The plain community token is returned to the app and is not stored in our community database. To create, bind, recover, or unlink a profile on the same Android device, the app sends its Android device ID to our API; the community database stores a keyed hash of that ID, not the raw value. The app may also keep the token in Google Play services' Block Store, with cloud backup only when end-to-end encryption is available.
  • Community activity: comment text and moderation status, reactions, blocked author IDs, reports (including a required explanation for “Other”), and private notices about decisions. Earlier reports may contain source links submitted under the previous form. Approved comments show the chosen nickname and numeric author ID publicly.
  • Push notifications: the app obtains a Firebase Cloud Messaging (FCM) token and sends it to our API with an app-generated installation ID, language, and time zone. It can also sync selected notification categories and up to 2,000 catalog IDs from favorites and completed downloads to follow updates. A community profile may be linked to the installation for private notices. Our server stores notification content, delivery information, and read/open state. The app registers for push on startup even if display permission has not been granted; the operating-system permission controls whether notifications are shown.
  • Analytics and diagnostics: Google Analytics for Firebase receives app usage events, such as opened catalog cards, favorites, downloads and failures, Minecraft handoff, review actions, and notification opens. These custom events may include a catalog item ID, failure reason, notification type, or detected installed Minecraft version. Firebase Crashlytics processes crash reports and diagnostic device/app information. These SDKs may also collect their own installation identifiers and automatic events. We do not intentionally send nicknames, comments, or community bearer tokens as custom analytics events.
  • Limited Android backup: Android Auto Backup or device transfer can include a small app snapshot with language, download and display settings, theme choice, and favorite catalog IDs. Search history, downloaded files, and the community token are not in that snapshot. Google Play services' Block Store can separately back up the community token as described above.
  • Moderation and support: administrators' actions are recorded with their account ID, action, target, and time. We also process information you include in support email. Do not email your bearer token.

The community API does not store raw IP addresses or raw request headers in its community tables. Web server, hosting, or CDN logs may still process connection information outside the application database; their exact retention settings have not been confirmed.

3. Why we use it and who can see it

We use this data to deliver catalog content, remember community choices, restore and protect profiles, show approved comments and reaction counts, process reports, moderate abuse, deliver requested and selected notifications, improve the app, investigate crashes, and answer support requests. Approved comments and their author IDs are public. Reports, pending comments, and private community notices are available only to the relevant user and authorized moderators or administrators as needed. Notification data and linked interests are used to select and deliver updates and digests.

We do not sell community profile data. The third-party providers in section 4 process information to provide their services; their own policies explain their practices. Files and links from third-party creators may lead to other services with separate policies.

4. Third-party services

These services are used by the Android app, not loaded as SDKs by the public website pages:

These links describe the providers' practices; this policy describes what MCAddonsHub itself sends to and stores for those services.

5. Retention

Data Current retention
Community access-token hash Its expiry is extended when the token is used; expired tokens are removed by the scheduled cleanup task after 365 days without use.
Request replay keys and feed snapshots Keys expire after 7 days; feed snapshots after 24 hours.
Rejected or removed comments Deleted 90 days after the moderation decision.
Approved comments Kept until removed or until a valid deletion request is handled; then the 90-day removal period applies.
Closed reports and private community notices Reports: one year after the decision. Community notices: one year after creation.
Push inbox, delivery records, campaigns, and digest runs Push inbox: one year; delivery records and campaigns: three years; digest runs: two years. Processed file-update events are removed after 30 days.
Moderator audit records Deleted after three years.
Profiles, acceptance, reactions, blocks, device-binding hashes, push registrations, selected categories and watched catalog IDs, open reports No automatic deletion date is currently configured. Revoking a push installation disables it and clears its access key and profile link, but does not by itself erase its record. Contact us with a deletion request.
Google/Firebase data and Android/Block Store backups Provider policies and service configuration govern Google/Firebase retention; backup retention also depends on account or device settings. See section 4.
External web, hosting, CDN, and support-email records Their actual retention periods have not been verified.

Automated deletion depends on the server's scheduled cleanup task running. We may retain information longer when required by law or needed to resolve an active dispute.

6. Your choices and requests

You can choose a nickname, block authors, mark private notices as read, and change digest categories or turn off the weekly digest in the app. Device settings can prevent notifications from being displayed; this does not itself revoke the registered FCM token or disable analytics. You can unlink a community profile from a device in the app, and you can ask us to revoke a push installation. Unlinking does not delete the profile or its content from our server.

To ask about access, correction, or deletion of community or notification data, email [email protected] and include your numeric user ID if you have it. We may need to verify that you control the anonymous profile before acting on private data. Do not email the bearer token. A profile may be recoverable through a verified local or backed-up token or the same device binding, but recovery is not guaranteed. If those methods are unavailable, identifying an anonymous profile may not be possible.

Deleting the app does not automatically erase server records or data already processed by third-party services. Requests about a catalog item or intellectual property can use the same contact address.

7. Security and updates

The community token is stored on our server as a hash; device bindings use a keyed hash. The published document URLs use HTTPS. No method of transmission or storage is perfectly secure. We may update this policy when the service or its data practices change; the current date will appear at the top of this page. The related Terms of Use and Community Rules explain participation and moderation.

Privacy contact: [email protected].