Legal
What Nebula Games stores about you, why we store it, how long we keep it, and how to get a copy of it or get it deleted. Written to be read, not to be skipped.
Last updated August 9, 2026
We store your Minecraft username and your Mojang UUID, so we know which account to deliver a purchase to. If you run /link in game, we also store your Discord ID, so the site knows you are you. We keep a record of what you bought. Staff keep records of punishments. That is close to everything.
We never ask you for an email address, a phone number or your real name, and this site runs no analytics, no advertising pixels and no tracking cookies. When you pay, the payment itself is handled by PayNow.gg — your card details never reach our servers.
Nebula Games runs this store and the Minecraft servers behind it, at play.nebulagames.cc. Under EU and UK data protection law we are the controller of the data described here, which means we are the ones who decide what is collected and why, and we are the ones you can hold to it.
[OWNER TO COMPLETE: the legal identity of the operator — the trading or registered company name, a company registration number if one exists, and the country you operate from. GDPR Article 13(1)(a) requires the controller's identity and contact details to appear here, and this policy is not complete without them.]
[OWNER TO COMPLETE: a contact route for privacy requests that does not require a Discord account, normally an email address. A ticket panel is a fine front door, but a person should not have to create a third-party account to exercise a legal right.]
This is the whole list of what the store and the game servers keep about you.
| What | Why we have it | How long we keep it |
|---|---|---|
| Minecraft username | To show you the right account at checkout, and to label your order. | For as long as your order history is kept. |
| Mojang UUID | The permanent ID for your Minecraft account. Everything you own is attached to this rather than to your name, so changing your name never loses your purchases. | For as long as you have a rank, a coin balance or an order on record. |
| Discord ID and display name | Only after you run /link in game. It signs you in to the community pages and keeps voting to one vote per person. | Until you unlink. See the section below. |
| Order history | Order ID, what you bought, which server it was for, the amount and currency, and whether it was paid and delivered. Needed to deliver it, and to sort out a problem or a refund later. | [OWNER TO COMPLETE: the statutory record-keeping period for sales records — this depends on the country you operate from and is typically several years.] |
| Nebula Coins balance and entitlements | Your coin balance, and the rows recording which ranks and crates you own. This is the thing you actually bought. | As long as you have an account on the network. |
| Punishment records | Bans, mutes, kicks and warnings, with the reason, the staff member who issued it and the dates. Needed to enforce the rules consistently and to handle appeals. | [OWNER TO COMPLETE: how long lifted or expired punishments stay on record. Keeping them forever is hard to justify and should be a defined period.] |
| Sign-in session | One random token in a cookie, plus whichever of your Discord ID and Minecraft account it belongs to. It is what keeps you signed in. | Deleted 7 days after you sign in, or straight away when you sign out. |
| Your IP address | Passed to PayNow when you start a checkout, because they require it for fraud and tax handling. The store does not save it to its own database. | Held by PayNow under their policy. [OWNER TO COMPLETE: web server and CDN access logs also record IP addresses — state the retention period those are actually configured with.] |
We do not store your email address, your postal address, your phone number, your real name, your date of birth or your payment card details. The store never asks for them and has nowhere to put them.
This is the part worth understanding properly, because it is the one place where two separate identities of yours get tied together.
Every Minecraft account has a UUID: a permanent ID issued by Mojang that looks like f81d4fae-7dec-11d0-a765-00a0c91e6bf6. It never changes, even when you change your username. Our servers run in online mode, so the UUID we hold is your real Mojang one.
We use it because usernames move between people. If we keyed your rank to the name you typed, someone else could take that name later and inherit what you paid for. When you enter your username at checkout we ask Mojang's public API to turn it into a UUID, and we store the UUID.
Your Discord ID is the permanent number behind your Discord account. We only get it if you choose to sign in with Discord, and we only store a connection between it and your Minecraft account after you run /link in game. Signing in asks Discord for the identify scope only: your ID and display name. We cannot read your messages, your email address, or the list of servers you are in.
Once linked, a row in our database says that this Discord account is this Minecraft account. The practical consequences, stated plainly:
Linking is optional. You can buy things without it. It is required only for the community pages, because those need to know that one person is one person.
[OWNER TO COMPLETE: confirm the in-game command that unlinks an account, and confirm that unlinking deletes the link row rather than just marking it inactive. This policy tells people they can withdraw that connection, so it has to actually be true.]
This section matters if you are in the EU or the UK, where we have to name a specific legal reason for holding each piece of data.
We do not sell your data, we do not rent it, and we do not hand it to advertisers. These are the only outside companies involved, and each gets only what it needs.
PayNow processes payments for this store. When you start a checkout we send them your Minecraft UUID, your username and your IP address, and they collect whatever the payment itself needs, normally a billing email address and your payment details. That information lives with them, not with us. We never see your full card number.
PayNow is not in live mode yet for this store. No real payment has ever been taken through it, and no buyer billing data exists yet.
[OWNER TO COMPLETE: link PayNow's own privacy policy here, and confirm a data processing agreement is in place with them before live mode is switched on.]
If you sign in with Discord, Discord tells us your ID and display name, and Discord separately knows that you authorized this store. We never post anything to Discord as you.
To turn a username into a UUID we ask Mojang's public API, which means Mojang sees the username being looked up. This is the same API every Minecraft server and store uses.
Two things on this page load from other companies' servers, which means those companies can see your IP address and which page you are on:
[OWNER TO COMPLETE: EU regulators have ruled against loading Google Fonts from Google's servers without consent. Self-hosting the font files and the avatar images removes this disclosure entirely and is the recommended fix.]
The website, the game servers and the database run on infrastructure Nebula Games controls. Network staff can access it as part of running the network.
[OWNER TO COMPLETE: name the hosting provider and the country the servers are physically in. If they sit outside the EU and UK, this policy must also name the transfer safeguard relied on, such as Standard Contractual Clauses.]
Some of what we hold is deliberately public. Read this before you assume something is private.
This site sets exactly one cookie, called nb_store. It holds a random token and nothing else — no personal data is kept inside it. It is what keeps you signed in, it is marked HttpOnly and SameSite=Lax so other sites and page scripts cannot read it, and it expires after 7 days or when you sign out.
There are no analytics cookies, no advertising cookies and no third-party trackers, which is why this site has no cookie banner.
The network runs an automatic chat filter that can delete a message, warn you or mute you without a human looking first. Nothing automated decides whether you get what you bought, and we do not profile you. If an automatic action was wrong, open a ticket and a staff member will review it.
Specific, and with nothing claimed that is not true.
We hold no security certification and we are not going to pretend otherwise, and no online service can promise it will never be breached. If a breach happens that puts you at risk, we will tell the players affected and, where the law requires it, the relevant regulator.
GDPR and UK GDPR give you these rights if you are in the EU or the UK. The CCPA gives Californian buyers a similar set — see below. We use the same process for everyone who asks, wherever you live, because running two standards is more work than running one.
Open a ticket at bot.nebulagames.cc and say which of the rights above you want to use. Include your Minecraft username so we can find your records.
We will ask you to prove the account is yours before we hand anything over or delete it, normally by having you run a command in game from that account. This protects you: without it, anyone who knew your username could request your data or wipe your purchases.
Deleting your data deletes what you paid for. Your ranks, your coin balance and your crates are all stored against your UUID. Remove that and they are gone, and we cannot restore them or refund them. We may also have to keep your order records to satisfy tax law, and we keep a minimal record of a ban so that a banned player cannot clear it by asking for deletion.
We have one month to answer under GDPR and UK GDPR, and 45 days under the CCPA. There is no charge.
[OWNER TO COMPLETE: add the non-Discord contact route here once it exists, and put a real process behind these deadlines — a promise nobody is watching is worse than no promise.]
The CCPA, as amended by the CPRA, applies to you. In its terms, the categories of personal information we collect are identifiers — Minecraft username, Mojang UUID, Discord ID and IP address — and commercial information, meaning what you bought. We do not collect sensitive personal information, biometric data, geolocation beyond a country code used for tax, or anything about your education or employment.
We collect it for the reasons given above, from you directly and from Mojang's public API. We have never sold or shared personal information in the CCPA's sense of those words, and we do not use it for cross-context behavioral advertising. Because there is no sale, there is nothing to opt out of, including the extra opt-in the CCPA requires for people under 16.
You have the right to know what we collect, to have it deleted, to have it corrected, and not to be treated worse for asking. We will not degrade your account, remove your rank or change your prices because you used a right. Use the same ticket route above. An authorized agent may make a request for you, and we will still verify the account.
[OWNER TO COMPLETE: confirm whether the store meets the CCPA's applicability thresholds. Honoring these rights voluntarily is the safe position either way, which is what this policy commits to, but a lawyer should confirm whether the statutory notice requirements are actually triggered.]
Plenty of our players are teenagers, so this part is written for you and for whoever pays for things in your house.
Ask a parent or guardian before you buy anything. It is their money, and depending on where you live their permission is what makes it lawful for us to hold your data at all.
Parents and guardians: you can ask us for a copy of everything we hold about your child, ask us to delete it, or ask us to reverse a purchase they made without your say-so. Open a ticket at bot.nebulagames.cc. We would much rather sort it out with you than have it come back as a chargeback.
We do not knowingly collect data from children below the age at which they can agree to it themselves. If we find out that we have, we delete it.
[OWNER TO COMPLETE: set the minimum age to use the store and state it here and in the Terms. Under GDPR Article 8 the digital consent age is 16 unless the member state lowered it, and some went to 13; the UK's is 13, and the US COPPA line is 13. You need one clear number, and the Terms and this policy have to agree on it.]
If we change something that actually affects you, we will post it on the updates page and change the date at the top of this one. Carrying on using the store after that means the new version applies.
This page is a plain-language description of how the store handles data. It is not legal advice and it has not been reviewed by a lawyer. Every bracketed note above marks something that depends on a real-world fact about the business, and must be filled in before this is relied on.
