Privacy Policy

Minebit (“Minebit”, “we”, “us”) runs this site and is the controller of your personal data under the GDPR: it decides why and how the data is used. Contact us about your data at support@minebit.dev. This policy goes with our Terms of Service.

• Account. When you sign in with Discord we receive your Discord user ID, username and display name, and your email address if Discord has verified it. We do not keep your Discord avatar. If you sign in by email we receive your email address and the name you type. We store these. Sign-in links are stored only as a one-way hash and expire after 15 minutes. While a link is valid we also keep the IP address that asked for it, to limit abuse, and remove it with the link within a day.
• Talent profile. Your headline, bio, skills, platforms, rate, availability, time zone, years of experience, links, projects, server history, pictures, and your vetting application and the reviewer's notes.
• Network and company. Company name, website, description, tagline, server address, Discord invite, pictures, team listings, jobs and bounties you post, applicants, quote requests you send, and verification evidence you submit (server address, links, statement).
• Listings and posts. Services you list, screenshots on your projects, quotes you send in reply to a request, and portfolio feedback requests and replies you write.
• Server status. If a network adds a server address, our server contacts that address, like a player's game does (Java first, then Bedrock), to read the public server-list information (icon, message of the day, player count, version). We keep the result in memory for about a minute and do not store it.
• Imports. If you import projects from GitHub or Modrinth we send the username you type to that site's public API and read the public bio and public project list, once, to check the code and build the list. We keep the projects you choose to import and the source name. We do not keep anything else from those sites and do not post to them.
• Online status. While you are signed in with the site open, we record the time we last heard from your browser, and show it as a green dot or “last seen” next to your name. You can turn this off on your Account page, and then we stop recording it and delete the last time we stored.
• Activity. Applications and their status, invites, messages and whether and when the other person opened them, notifications and your notification settings, who you follow and who follows you, reports and replies, promotions, bids, and what you purchased.
• Optional profile details. Languages you speak and your time zone, if you add them.
• Payments. Stripe handles payment details. We receive confirmation, amounts and a reference. We do not receive or store your full card number.
• Technical. Server logs with your IP address, browser type and the pages requested, kept for a limited time for security and debugging. Our application also uses your IP address briefly to rate-limit sign-in and abuse, and does not store it except as described under Account. Cookies and similar storage are described below.

Under the GDPR we need a legal basis for each use. Ours are:

• To provide the Service you asked for (Art. 6(1)(b), performance of the contract): sign you in, show your profile, jobs and listings, match talent to jobs, deliver messages, notifications and the emails you have chosen, take and confirm payments.
• Our legitimate interests (Art. 6(1)(f)): keeping the Service secure and preventing fraud and abuse, reviewing vetting, verification, promotions and reports, enforcing our Terms including banning accounts, and keeping server logs. You can object to this, see below.
• Legal obligations (Art. 6(1)(c)): keeping financial records and responding to lawful requests.
• Your consent (Art. 6(1)(a)), where we ask for it, for example if you choose to receive an optional email. You can withdraw it at any time, which does not affect what was done before.

In more detail, we use data:

• to run the Service: sign you in, show profiles and jobs, match talent to jobs, deliver messages and notifications;
• to review vetting, verification, promotions and reports, and to enforce our Terms, including banning accounts;
• to take and confirm payments;
• to email you what you have chosen to receive. Each kind of notification can be switched off on the site and by email under notification settings. Emails about your account, such as sign-in links and decisions on your reports, are part of running your account;
• to keep the Service secure and prevent fraud and abuse; and
• to meet legal obligations and respond to lawful requests.

Matching uses the skills, platforms, rate and availability you put on your profile, and the details of a job. It is automatic but only ranks and filters what you already provided. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Vetting, verification, bans and report decisions are made by people.

• Everyone can see public talent profiles and network pages: names, pictures, headlines, bios, skills, work history and screenshots, services and prices, vetting or verified status, promoted taglines, open jobs and bounties, a network's team and the people it hired and reviewed, and the reviews, star ratings and completed jobs that other users left after working with them (with the name of the reviewer). Portfolio feedback requests and replies are public too. Who a person follows, and who follows them, is public on their profile, limited to people with public profiles.
• Quote requests are seen by the network that sent them and the people it asked. Each person's reply is seen by the network.
• Blacklists are public. When an account is blacklisted from applying or posting jobs, the reason given by staff is shown on its profile or network page.
• Signed-in networks with a company can see a talent user's Discord handle on their profile.
• The other person in a conversation sees your messages, and sees when they have been opened (“Seen”). Employers see a talent user's profile and message when they apply.
• People in a report see each other's names, the report, and the replies and decision.
• Moderators and admins can see account details and may read messages, applications and report material when reviewing a report, a vetting or verification request, or abuse.

Do not put anything in a public field or a message that you do not want that audience to see.

We do not sell personal data. We do not use analytics, advertising or tracking services, and the typeface and every other file the site needs are served from our own servers, so your browser contacts no third party when you read our pages. We share personal data only with:

• Discord, if you sign in with it. You are sent to Discord to sign in, under its own privacy policy, and we receive the details listed above;
• Stripe, which processes payments. When you pay you are sent to Stripe's checkout page, under its own privacy policy;
• Resend, our email delivery provider, which sends sign-in links, notifications and other emails to the address you gave us, on our behalf;
• our hosting and infrastructure provider, which stores and serves the Service for us on our behalf;
• authorities or other parties where the law requires or permits it, to protect rights and safety, or in a sale or reorganization of the business.

We only store things on your device that the Service needs to work or that you asked for, so under § 25 TDDDG and the ePrivacy rules no consent banner is needed. We use no analytics, advertising or cross-site tracking.

• next-auth.session-token (named __Secure-next-auth.session-token over HTTPS), a cookie that keeps you signed in. Required. Lasts up to 30 days or until you sign out;
• next-auth.csrf-token and next-auth.callback-url, cookies that protect the sign-in form and return you to the page you came from. Required. They last for the sign-in session;
• bw_mode, a cookie that remembers whether your dashboard is in talent or network mode. Set when you switch mode. Lasts one year;
• theme, an entry in your browser's local storage that remembers light or night mode. Set when you pick one. Stays until you clear it.

We keep your data while your account exists. When you delete your account, whether yourself from the Account page or by asking us, we remove your profile, work history, networks and jobs, applications, messages and conversations, reviews, promotions, notifications and uploaded pictures straight away. We keep only a record that a deletion happened, with a short one-way fingerprint of your email address and not the address. Copies in backups are overwritten within about two weeks.

Some things are kept after that where the law allows, to prevent abuse, to establish or defend legal claims, and to meet legal duties: the record that an account was banned, reports that are still being decided (so an account with an open report is deleted once the report is decided), and payment records, which are held by Stripe and by us as financial records require.

• You can edit or remove most profile content, pictures and projects yourself, hide your profile from the directory, and turn off notifications about matching jobs.
• Access and export: download a copy of your data from the Account page at any time, as a JSON file.
• Deletion: delete your account yourself from the Account page. It takes effect immediately.
• You can also ask us to access, correct, export or delete your data, to restrict its use, or to object to uses based on our legitimate interests, by emailing support@minebit.dev. We will respond within one month, or tell you why we need longer.
• Where we rely on your consent you can withdraw it at any time.
• You can complain to a data protection supervisory authority, for example in the EU country where you live or work or where you think your rights were breached.
• You are not required to give us your data, but without the account details above we cannot give you an account.
• Depending on where you live (for example the EU, UK or California) you may have additional rights. We do not sell or share personal data for cross-context advertising.

We use reasonable measures to protect your data, including access controls, encrypted connections and limits on what moderators can see. No system is perfectly secure, and we cannot guarantee that your data will never be accessed without permission.

Minebit is not for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, email us and we will remove it.

Some of our providers, including Discord, Stripe and Resend, are based in or process data in the United States or other countries outside the EU and EEA. Where that happens we rely on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework, for providers certified under it) or on the Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the safeguards we use.

We may update this policy. The date at the top shows the latest version, and we will give more notice of significant changes where the law requires it.