Privacy Policy

Last updated: June 7, 2026

This Privacy Policy explains how the Leaf Host team ("we", "us", "our") collects, uses, and protects your information when you use the Leaf Host website and Minecraft server (the "Service"). We aim to collect only what we need to run the Service.

1. Information We Collect

Account information: your Minecraft username, a securely hashed password (we never store your password in plain text), and an optional email address you choose to provide.
Purchase and balance information: your credit balance, purchase history, the items you redeem, and delivery targets.
Payment information: processed by Stripe. We receive a transaction/session identifier and confirmation of payment — we never receive or store your full card number, CVC, or bank details.
Server & technical data: in-game activity needed to deliver items, and standard server logs (such as IP address, timestamps, and browser/user-agent) generated automatically and used for security, abuse prevention, and diagnostics. Our infrastructure provider Cloudflare may also process connection metadata.
Two-factor authentication data: if you enable 2FA, we store a TOTP secret or a WebAuthn public-key credential (never a private key).

2. How We Use Your Information

To create and operate your account and deliver purchased Virtual Goods;
To process payments and prevent fraud and abuse;
To secure the Service, enforce our Terms, and comply with legal obligations;
To respond to support requests and communicate important account or service notices.

We do not sell your personal information, and we do not use it for third-party advertising.

3. Cookies

We use a single strictly necessary session cookie (PHPSESSID) to keep you logged in. It is set with HttpOnly and SameSite=Lax protections. We do not use advertising or third-party tracking cookies. Disabling cookies will prevent you from logging in.

We share information only with service providers that help us run the Service, and only as needed:

Stripe — payment processing (Stripe Privacy Policy);
Cloudflare — network delivery, DDoS protection, and tunneling;
mc-heads.net — to render your Minecraft avatar from your public username.

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, and security of our users and the Service.

5. Data Retention

We keep account and purchase records for as long as your account is active and as needed to comply with legal, tax, accounting, and fraud-prevention obligations. You may request deletion of your account (see below); some records may be retained where required by law.

6. Security

We protect your information with measures including password hashing (bcrypt), optional two-factor authentication, encrypted connections (HTTPS), hardened session cookies, and restricted server access. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

7. Your Rights

Depending on where you live (for example under the EU/UK GDPR or the California CCPA/CPRA), you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. We do not sell or "share" personal information as those terms are defined under California law. To exercise any right, contact us using the details below; we will respond within the timeframe required by applicable law.

8. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us information, please contact us and we will delete it.

9. International Users

The Service is operated from the United States. By using it, you understand your information may be processed in the United States and other countries that may have different data-protection laws than your own.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

11. Contact

For privacy questions or to exercise your rights, contact us at [email protected] or via our Discord.