MINAX PRIVACY POLICY
Version of 19 October 2026.
Contents
In short
We use your data to run Minax, not to sell it. Under 15, audience measurement needs a parent's agreement. Ads only load with the "Ads (18 and over)" choice, or with the agreement already given by an account that declared being 18 or over. A new plugin that works may be published in Discover without you asking; it then never shows your username, unless you choose to show it. You can export or delete everything from Settings.
1. Controller
Thomas Bidault, sole proprietor (EI), trading as Minax, 26 rue des Ponts, 44470 Thouaré-sur-Loire, France; dev@minax.fun. No data protection officer has been appointed, as the law does not require one.
2. What we process
| Why | Data | Legal basis | Retention |
|---|---|---|---|
| Your account and sign-in | email, hashed password, username, language, sign-up country (read to check that sign-up is allowed, never kept); name and profile picture if you sign in with GitHub or Discord | contract | while the account exists; the email of a deleted account is kept to prevent re-registration within 3 days, and is not yet deleted automatically afterwards |
| Creating your plugins | your messages, dictated voice (converted to text), attached images, code, .jar files, textures | contract | while the account or project exists |
| Test server | players' Minecraft usernames and identifiers (their Minecraft account identifier when the server checks accounts), IP addresses, game chat (server logs) | contract; for friends you invite, our legitimate interest (running the server and following Minecraft's rules) | server logs: deleted within 10 minutes after the session ends; usernames of players who joined: kept in the session history, not yet deleted automatically |
| Payment and invoices | name, billing address, country (of the address and of the card's issuer, which Stripe sends us), VAT number, payment currency, purchase history; the country of your connection when you buy, read to check that Minax is sold in your country and, outside the European Union, so that Stripe's payment page can offer to let you pay in your own currency; your card's brand, last 4 digits and expiry date are read from Stripe to show them to you in Settings, without being kept; the full card number and security code stay with Stripe | contract and legal obligation | invoices: 10 years (accounting records); purchase history: while the account exists |
| Proof of your consents (purchase, cookies, emails) | date, time, version and hash of the accepted text, language, IP address, browser; for a purchase paid on Stripe's page, also Stripe's confirmation and, depending on the purchase page, the country you state, the country of the connection, of the billing address and of the card's issuer (sent by Stripe) | legal obligation (to be able to prove) | purchases: 5 years after the end of the last contract; cookies and emails: while the account exists |
| Online withdrawals and cancellations | name, email addresses given, purchase or subscription concerned, reason if any; hashes of the IP address and email (against abuse) | legal obligation (to be able to prove) | 6 years; hashes deleted after 7 days |
| Link sent to a parent | parent's email | legitimate interest (letting a parent pay) | 30 days after sending, or 10 years as an accounting record if the parent pays |
| Service emails | contract | while the account exists | |
| Tips and offers emails | email, sending history | your consent (switch in your settings; under 15: with a parent's agreement); for customers who have already paid, our legitimate interest, with opt-out at any time | until you unsubscribe; sending history: while the account exists |
| Audience measurement (Google Analytics, Microsoft Clarity) | cookie identifiers, pages viewed, clicks, device, country | your consent (under 15: with a parent's agreement) | cookies 13 months at most, data 25 months at most; your choice kept 6 months |
| Advertising (Google Ads, Reddit) | cookie identifiers, events (sign-up, purchase), hashed email sent by our server to Reddit | your consent, given for people aged 18 and over | cookies 13 months at most |
| Knowing where sign-ups come from | once, when the account is created: the campaign parameters of the landing address (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the landing page without its parameters, and the name of the site you came from (for example google.com). Never an ad click identifier (such as gclid or fbclid); nothing is written to your device for this, and nothing is passed to a third party | legitimate interest (measuring which channels bring sign-ups and buyers) | while the account exists |
| Technical errors (Sentry) and product log | errors, in-app actions linked to a pseudonymous identifier, including the steps of a purchase (country you connect from, billing country, payment currency) | legitimate interest (running and securing the service) | 90 days at most (Sentry), 90 days (log) |
| Refining your request before payment | the text of your plugin request and your answers to the questions, sent to Anthropic to be refined before any payment (not your age, email or username); to limit abuse, a hash of your IP address computed with a key that changes every day, never the address itself | contract (steps taken at your request before purchase); for the hash, our legitimate interest (preventing abuse) | the request: as long as the project exists; the hash: deleted after 48 hours |
| Anti-fraud (referrals, payments) | IP address, browser, fraud signals | legitimate interest | no automatic deletion yet |
| Publishing projects and profiles | project name and description (for a plugin published by default, the description is written by the AI from its code and the request, never the message word for word), images, source files, .jar file; your username only if you show it or publish yourself | contract: at your request; a new plugin that works may also be published by default, without your username (your username only by your choice) | until you unpublish |
| Reports and moderation | reported content, author, reporter's email | legal obligation (Regulation (EU) 2022/2065) | 12 months after the decision |
3. Who receives your data
We do not sell your data. Our providers only use it to serve us:
- Anthropic Ireland, Limited, with Anthropic PBC (USA): AI that writes the code, and refines your request before payment.
- OpenAI Ireland Ltd, with OpenAI (USA): documentation search, voice dictation.
- Retro Diffusion (USA): textures; it only receives the texture description.
- Google Ireland Ltd and Google LLC: Google Analytics, Google Ads, image generation.
- Google (Gemini), directly or through Lovable's AI gateway: backup AI.
- Microsoft (Clarity); GitHub and Discord, if you link them.
- Reddit, Inc.: ad measurement.
- Stripe Payments Europe Ltd (Ireland): payments; Stripe is also controller of its own anti-fraud processing and, if you use Link, of your Link account.
- Supabase Inc. (USA): database and accounts, data stored in Paris.
- Lovable (Sweden): website hosting.
- Cloudflare, Inc. (USA): network and security.
- Resend, Inc. (USA): sending emails.
- Functional Software, Inc. (Sentry), with data in Germany: errors.
- Trigger.dev: background tasks.
- OVHcloud (France): compile and test servers.
- Microsoft (Mojang), which runs Minecraft accounts: when the test server checks accounts, Microsoft receives, for each player who joins, the authentication data of their Minecraft account (their username and account identifier) and confirms to the server that this account owns the game; it also receives the username of a friend or admin you add, to find their account. Minax never receives the password, which stays with Microsoft. Legal basis: the contract and, for friends you invite, our legitimate interest in following Minecraft's rules, which keep servers for accounts that own the game. Microsoft is the controller of its own processing: Microsoft Ireland Operations Limited (Ireland) for players in the European Economic Area, the United Kingdom and Switzerland, Microsoft Corporation (United States) for everyone else. For Microsoft Corporation, the transfer relies on the EU-US adequacy decision of 10 July 2023 (Data Privacy Framework), which Microsoft has joined.
- GitHub, Inc. (USA): compiling your plugin's code into a .jar file (GitHub Actions).
- Hangar (PaperMC): only if you choose to publish your plugin there with your own key; it receives the .jar file and its version note.
- Firecrawl (USA) and Jina AI (Germany): reading public documentation; they receive no account data.
- Authorities, only on a legal request.
4. Transfers outside the EU
For providers in the United States, transfers rely on the EU-US adequacy decision of 10 July 2023 (Data Privacy Framework) where the provider has joined it, and on European Commission standard contractual clauses in each contract. For Switzerland: the Swiss-U.S. Data Privacy Framework or standard contractual clauses. You can ask us for a copy of these safeguards.
5. Minors
Minax is open from age 13. We don't ask for age. If you are under 18, a parent must agree before a purchase; under 15, also before accepting audience measurement, offer emails or showing your username. Ads only load with the "Ads (18 and over)" choice, or with the agreement already given by an account that declared being 18 or over. For an account that declared its age before this version, we keep its age group (13 to 15, 16 and 17, 18 and over) and, under 18, the date on which it will change, rounded to the start of the following quarter; while it says under 18, that account receives no ads and no offer emails. A plugin published without the person asking never shows their username. A parent can exercise their child's rights by writing to us; we check the relationship proportionately. If we learn that an account belongs to a child under 13, we delete it.
6. AI
Your messages, images and project files are sent to AI providers only to produce your answer. Under their terms, these providers do not use them to train their models; they may keep them briefly for security, for the period set in those terms. Don't type personal information in your requests.
7. Emails
Service emails (confirmation, security, invoices) are necessary. Tips and offers emails are only sent with your consent, or if you have already paid for an offer; you can stop them with the link at the bottom of each email or in your settings. We track neither opens nor clicks.
8. Automated decisions
No decision with legal effects on you is made by a machine alone. You can challenge an automatic filter's refusal with a human.
9. Security
Data is encrypted in transit, access is restricted and passwords are hashed. In case of a data breach, we notify the French authority (CNIL) within 72 hours and, if the risk is high, the people affected.
10. Your rights
You can access, correct and delete your data, restrict its use, object to processing based on our legitimate interest, receive it (portability), withdraw consent at any time, and give instructions about your data after your death. Use Settings (export, deletion) or dev@minax.fun. We reply within one month. You can complain to the CNIL (cnil.fr) or your local authority; in Switzerland, the FDPIC (edoeb.admin.ch). If you live outside the EU, you also keep the rights given by your country's law (for example in Japan, Brazil or California).
11. What is required
Your email is needed to create an account; without it, no account. Everything else is optional.
12. Advertising pixels
For data collected by the Google and Reddit pixels, Minax and these companies are joint controllers; each then applies its own policy.
13. Browser signals
Minax does not track visitors across other websites. The Global Privacy Control signal counts as a refusal of analytics and advertising cookies. "Do Not Track" signals are not read.
14. Changes
We tell you about any significant change by email or by a message in your Minax account, no later than the day it is published.