Privacy Policy

The controller within the meaning of the GDPR is Nyvoro UG (haftungsbeschränkt), Johann-Georg-Fischer-Straße 18, 73079 Süßen, Germany, represented by Managing Director Robin Thonhofer, email info@voxel-mind.com. For all data protection questions, including requests to access or delete data, write to info@voxel-mind.com.

• This website: static pages, no accounts, no cookies. Until 8 November 2026 the other pages on voxel-mind.com still belong to the hosted VoxelMind service, which has its own privacy policy at voxel-mind.com/privacy.
• The free mod: runs on your PC or server and stores its data locally; it only sends an anonymous daily count of which kind of AI service it uses (section 4).
• VoxelMind Sparks: our optional prepaid AI service (api.voxel-mind.com). Only this service stores personal data on our side.

The website is hosted by Cloudflare (see section 9). When you open a page, Cloudflare processes technical connection data such as your IP address, the time and URL of the request and your browser type in order to deliver the page and to protect it against attacks. The legal basis is Art. 6(1)(f) GDPR (our interest in a secure and stable website).

We do not use cookies, analytics, advertising or tracking tools, and we do not load fonts or scripts from third parties. The Sparks pages (/sparks, /sparks/thanks, /sparks/redeem, /sparks/account) and the withdrawal page (/withdraw) contact our API at api.voxel-mind.com from your browser to load current packs, to check the status of a payment, to redeem a code, to show your account or to submit a withdrawal. This transmits your IP address to our API, which also runs on Cloudflare.

Links to external sites (for example CurseForge, Discord, YouTube) lead to services with their own privacy policies.

The mod stores its data locally: settings (including any API key you enter), the characters, memories and event timelines of your companions, and decision logs. They live in your game folder and in your world folders (voxelmind-local). We do not receive this data. You can delete it at any time by deleting those folders or by deleting a companion in the menu. Full prompts are only written to the log if you switch that option on yourself.

The mod only contacts the services you choose (see sections 5 and 6); Mojang's services, if you give a companion the skin of a Minecraft account; MineSkin (mineskin.org), if you give a companion your own skin image (see below); our API for the anonymous usage count (see below); and the Minecraft Wiki (minecraft.wiki), with the search term only, when a Builder looks something up there.

Your own skins: Minecraft only shows skins that Mojang has signed. If you give a companion your own PNG (a link or a file from the skins folder), the mod loads the image and uploads it to MineSkin, which signs it through one of its Minecraft accounts and returns the signed texture. Only the image is sent, with no name or account. It is uploaded as "unlisted", so it does not appear in MineSkin's public gallery; like every Minecraft skin, it is then stored on Mojang's texture server and visible to anyone who has its link. MineSkin processes the image under its own privacy policy.

Anonymous usage count: once a day, after the first answer from the AI service, the mod sends one count to api.voxel-mind.com with only the kind of AI service (VoxelMind Sparks, Player2, OpenRouter, a local model or another endpoint), the mod version and the Minecraft version. It contains no name, no identifier, no key and nothing from your chats. Our API adds it to a counter per day and kind and stores nothing else; your IP address is processed by Cloudflare only to deliver the request. Purpose: knowing which AI services players use, so we know which ones to keep supporting (Art. 6(1)(f) GDPR). The mod tells the host in the game before the first count is sent. It is turned off with /vml stats off or "usageStats": false in config/voxelmind-local.json; development runs never send it. The totals are public at api.voxel-mind.com/v1/stats.

Playing on a server: nearby chat messages of other players can be part of the prompts sent to the AI you connect. Server operators should inform their players about this.

If you connect Player2 or your own OpenRouter account, your game sends requests directly to that provider. This is a direct relationship between you and the provider; we are neither the controller nor the processor of that data. Please read their privacy policies. The requests contain what the AI needs to decide, such as game state, your chat messages and the companion's memory.

OpenRouter forwards requests to the model provider you selected. Your OpenRouter key is stored in your game folder and is only sent to OpenRouter.

A local model (Ollama, LM Studio or another server you run) receives the same content, but it stays on your computer or in your network.

Sparks are prepaid credits for our AI service. If you use them, we process the following data.

• Sign-in with your Minecraft account: the game asks our API for a one-time server ID and joins it at Mojang's session server, exactly as when joining a server. Our API then asks Mojang whether this join happened and receives your Minecraft UUID and current name. We never see your password, email address or Minecraft access token.
• Account data: Minecraft UUID, Minecraft name, a token that identifies your sign-in to the mod, your balance of paid and free Sparks and the grants you received (welcome and daily Sparks).
• Usage ledger: the time and the cost of each AI request. We do not store prompts, chat messages or answers.
• Purchases: the pack, the amount, the currency, the time and the payment reference from Stripe, together with the Minecraft account the Sparks were credited to. Gifts are credited to the name entered at purchase. For a gift purchase we look up the profile ID of the named Minecraft account at Mojang (see section 8).

When you use Sparks as your AI, the mod sends each request to api.voxel-mind.com. Our service forwards it to OpenRouter, Inc. (USA), which is our processor (Auftragsverarbeiter) for the Sparks API. OpenRouter passes the request to a model provider and returns the answer along the same path. The model providers are currently Relace (USA), Sail Research (USA) and Together AI (USA); they neither store the content nor train on it (zero data retention). The legal basis for the transfer to the USA is the Standard Contractual Clauses (Art. 46(2)(c) GDPR). Prompts can contain chat lines of other players on the same world. We process them only to answer the request and do not store them.

Purposes and legal bases: providing Sparks and the AI service (Art. 6(1)(b) GDPR), keeping accounting records required by commercial and tax law (Art. 6(1)(c) GDPR) and preventing abuse, for example limiting free Sparks to one welcome grant per Minecraft account and a capped daily pool (Art. 6(1)(f) GDPR).

Retention: individual usage entries are aggregated into daily totals after 90 days. Accounts with no Sparks left and no purchases are deleted 24 months after their last use (sign-in, AI request or code). Otherwise account data is kept as long as the account holds Sparks or the data is needed to resolve a refund or dispute, and it is deleted on request unless we have to keep it. Purchase records are kept as required by tax and commercial law (§§ 147 AO, 257 HGB, up to ten years).

Access and self-service: the private account page (/sparks/account, opened from the game with /vml sparks) shows your balance, usage and credits. If you send us a request by email, we check that the account is yours: open your private account page from the game (/vml sparks → [Account]) and tell us the balance and the date of the last credit shown there; only the signed-in player can see them.

Sparks are paid for through Stripe Checkout. You enter your payment details directly with Stripe Payments Europe, Ltd. (Ireland) and its parent Stripe, Inc. (USA); we do not receive card or bank details. From Stripe we receive your name, email address, country/address and the payment details needed for the payment and for our tax records, as well as whether the payment succeeded and the amount. Stripe processes payment data under its own privacy policy. The request to start the service before the withdrawal period ends, which you confirm in the checkout, is stored together with the payment. Legal bases: Art. 6(1)(b) and (c) GDPR; we keep the records as required by §§ 147 AO and 257 HGB.

At sign-in and when loading skins, Mojang AB / Microsoft process requests under their own privacy policies. We only use the answer, namely UUID and name of your Minecraft account. For a gift purchase we look up the profile ID (UUID) of the Minecraft account named at purchase at Mojang so that the Sparks reach the right account (legitimate interest, Art. 6(1)(f) GDPR).

We host this website and the Sparks API on Cloudflare (Cloudflare, Inc., USA, and its affiliates). Cloudflare processes connection data and the data stored for the Sparks service on our behalf. Transfers to the USA are based on the EU-US Data Privacy Framework and, where needed, on the EU Standard Contractual Clauses.

Recipients of data are Cloudflare (hosting), Stripe (payments), Resend (confirmation emails, USA), OpenRouter, Inc. as our processor and the model providers behind it (Relace, Sail Research, Together AI; only when you use Sparks), Mojang (sign-in and gift lookup) and, only if you give a companion your own skin image, MineSkin (signing the skin). Some of them are located in or process data in the USA. We safeguard such transfers as described in section 9, with Standard Contractual Clauses (Art. 46(2)(c) GDPR) or rely on the safeguards of the respective provider.

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. To exercise your rights, write to info@voxel-mind.com. We may need to verify that you control the Minecraft account concerned.

You also have the right to lodge a complaint with a supervisory authority, for example the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

You are not obliged to provide personal data, but without it we cannot provide Sparks. There is no automated decision-making within the meaning of Art. 22 GDPR.

The earlier hosted VoxelMind service (subscriptions, accounts, hosted worlds) ends on 8 November 2026. Data of that service is deleted after it ends; accounting records and invoices are kept for the statutory retention periods. Write to info@voxel-mind.com if you want your data deleted earlier.

If you withdraw from a contract on the page /withdraw (or by email), we store your name, email address, order reference and message to process the withdrawal and as proof (Art. 6(1)(c) GDPR). We send you a confirmation email via our email provider Resend (Resend, Inc., USA; transfer based on Standard Contractual Clauses).

We update this policy when the service changes. The date at the top shows the current version.