Privacy policy

Rodrigo José Branco Batista (tax number 255179383) is the controller of the personal data described here. For anything in this document, write to support@hotbar.gg.

Your account. An email address, a username, and optionally a display name, an avatar and a short bio. The email exists so you can sign in and so we can reach you about your account; it is never shown to other people.

Your Minecraft identity. If you link a Minecraft account, we store its UUID, its current name and the address of its skin. Linking works by having you join a small server we run: Mojang confirms who you are, and we never see or ask for your Minecraft password. For Bedrock, we store the Xbox identifier and gamertag instead, obtained through Microsoft sign-in. This is required before you can publish or take part socially, so that a person who is removed cannot simply return under a new email.

What you publish. Your builds, maps, skins, banners and palettes — their files, images, names, descriptions and tags — along with comments, collections, likes, saves and who you follow.

How pages are used. We count one view per person per day and one download per person, so that creators see honest numbers. If you are signed in, that record is tied to your account. If you are not, it is tied to a salted hash of your IP address — the address itself is never written down, and the hashes for views and downloads use different salts so the two cannot be matched against each other.

Recommendations. Those same views, downloads, likes, saves and collections are also counted to work out which publications go together, which is what fills the “others like this” row. The result describes pairs of publications, not you — see section 9.

Payments. If you subscribe, we store the identifiers Stripe gives us for your customer and subscription, which plan you are on, and the total you have paid. No card number, expiry date or security code ever reaches this site — payment happens on Stripe’s own checkout.

Moderation. Reports you file or receive, warnings, restrictions, appeals, and a log of the actions moderators take. Edits to published content keep a copy of the previous value so a change can be reviewed.

Contact. Support conversations and illegal-content notices, including the name and email you give there, and a salted hash of the IP the message came from.

• To provide what you asked for — your account, your publications, your subscription. Without this data there is no service to give you.
• Because we have to — moderation records, notices and appeals exist because the Digital Services Act requires them, and payment records because tax law does.
• Because it is reasonable — view and download counts, the recommendations built from them, anonymous visit statistics, and the abuse limits that keep the site usable. These are kept in the least identifying form that still works, which is why anonymous visitors are a hash and not an address.

We do not sell your data and we do not share it for advertising. It is handled by the services that make the site run:

• Supabase — the database, file storage and sign-in.
• Vercel — hosting, and the visit statistics: which pages are visited, and from which country, browser and kind of device. They are counted without cookies and without storing your IP address or who you are.
• Stripe — payments. They are the controller of your card details, not us.
• Mojang and Microsoft — only to confirm that a Minecraft account is yours.
• Modrinth and YouTube — when a page shows content hosted there, your browser contacts them directly, and their own terms apply to that request.

Supabase, Vercel and Stripe run infrastructure in several parts of the world, and some of what they do for us happens outside the European Economic Area. The law allows that in two ways and these transfers rest on them: a European Commission decision that the destination country protects data adequately, or the Commission’s standard contractual clauses, which each of those companies has agreed as part of its data processing terms.

Write to support@hotbar.gg if you want to know which of the two covers a particular provider, and we will point you at the document.

Your account and your publications stay until you delete them. Deleting your account starts a 30-day grace period — enough time to change your mind — after which we either erase everything or, if you chose to, detach your publications so they survive without your name attached. The account itself is erased either way.

Edit history and read notifications are removed after a year. View and download records are kept as counts. Moderation and payment records are kept as long as the law requires us to be able to account for them.

We use cookies to keep you signed in. There are no advertising or tracking cookies on this site, and the visit statistics use no cookies at all. Your browser also keeps some things locally so the tools work — your saved designs, your language, your layout preferences — and those never leave your device unless you choose to sync them to your account.

You can ask us for a copy of your data, to correct it, to delete it, to hand it over in a portable form, or to stop using it for a particular purpose. Most of it you can do yourself from your account page. For the rest, write to support@hotbar.gg and we will answer within a month.

Some of it you cannot decline and still have the thing it is for. An email address is how you sign in; a linked Minecraft account is how you publish. Refusing those does not close the site to you — it leaves you reading it rather than posting to it.

If you think we have handled your data badly, you can complain to the Portuguese data protection authority (CNPD) or to the authority where you live.

Nothing that happens to your account is decided automatically. Removals, warnings, restrictions and account closures are each taken by a person who looked at the case, and each one says so in writing when it reaches you. There is no filter making those calls and no automatic step from one to the next, so there is no automated decision here of the kind Article 22 of the GDPR is about.

What is automatic is arithmetic: the storage counter, the limits that stop the same action being repeated hundreds of times a minute, and the recommendations.

The recommendations are computed between publications, not about people. What is stored is that two publications tend to interest the same people, together with how alike their names, tags and categories are — never a profile of you, a list of your interests, or anything read back out at your account. Your part in it is one anonymous count inside a number shared with everyone else who opened the same page. Nothing is ordered for you personally, and no advertising is built on any of it. The parameters are described in section 8 of the terms of use.

This site is not intended for children under 13, and where local law sets a higher age for consent to online services, that age applies instead. We do not knowingly keep accounts for children below those ages; if you believe one exists, tell us and we will remove it.

If this policy changes in a way that matters, the date at the top changes with it, and we will say so on the site rather than quietly swapping the text.