This policy explains what personal data Keystone collects, why, and what you can do about it. Keystone is mostly an app that runs on your own PC. Your servers, worlds, files, console output and backups stay on your PC or in storage you choose. We only see the small amount of data described below.
"Keystone", "we" and "us" means the team that runs keystone.the-best.uk and publishes the Keystone app. We are the controller of the personal data described here. Contact us at admin@the-best.uk or through the Keystone Discord server.
| Data | Why | Legal basis (UK GDPR) |
|---|---|---|
| Your Keystone account. When you sign in with Discord we receive your Discord user ID, username, display name and avatar. We store these, when the account was created and last used, your plan, and the Minecraft username your app reports, if you set one. | To give you an account, link it to your app, show who you are to people you share servers with, and apply your plan. | Contract |
Sign-in session. A random session cookie (__Host-ks_session), kept on our side only as a hash with the first 90 characters of your browser's user agent. It lasts up to 30 days. | To keep you signed in. This cookie is strictly necessary, so we don't ask for consent for it. | Contract |
| Linked apps and licences. An identifier for each Keystone installation linked to your account, and hashes of the tokens it uses. | To issue licences to your installations and let you unlink them. | Contract |
| Shared groups. Which hosts' servers you are a member of, and who added you. | So shared servers appear for the right people, and disappear when access is removed. | Contract |
| Security records. An audit log of administrator actions on accounts (for example a ban or plan change), and short-lived hashes of IP addresses used for rate limiting. | To protect accounts and the service from abuse. | Legitimate interests |
| Usage sharing (opt-in). Only if you press Share usage in the app: a one-way hash of your installation ID, app version, edition, operating system, server counts, server types, player counts, coarse activity counts and, only if you tick it, your Minecraft username. Never server names, addresses, file names, console text or world data. Settings has a See exactly what's sent button. | To show a live "people using Keystone" count and learn which parts of the app are used. | Consent. Turn it off any time in Keystone settings, which also deletes your record. |
| Purchase and use records (paid plans only). When you get a paid plan, and for as long as you hold it: how you got it (who granted it, or what you bought, the price, the payment reference, the terms version you accepted and your request for immediate access), sign-ins to the website, and when the Pro app on each of your installations first checked its licence, plus the days it was used. Each record includes the IP address, approximate country and browser or app details of the request. | To prove what was bought and that it was delivered and used if a payment is disputed, charged back or a refund is claimed, and to prevent payment fraud. | Legitimate interests (handling payment disputes, and establishing or defending legal claims) |
| Website analytics (only if you allow it). Vercel Web Analytics records page views without cookies. We remove query strings and fragments from addresses before anything is sent. | To understand which pages are useful. | Consent. It stays off until you press Allow analytics. Change your mind any time with Privacy choices at the bottom of each page. |
| Remote access traffic. If you use remote access through the website, requests between your browser and your PC pass through our relay. They are encrypted while queued and held only until they are delivered or expire. | To make remote access work when your PC can't be reached directly. | Contract |
| Messages you send us by email or Discord. | To reply and help you. | Legitimate interests |
We never ask for or store passwords, and we don't keep Discord access tokens. We don't sell personal data or use it for advertising, and we don't use advertising or tracking cookies.
We only use the cookies and browser storage the website needs to work, plus analytics if you allow it. Our cookie policy lists each one, what it does and how long it lasts.
Some features connect your app directly to another company. That data goes between your PC and that company, not through us, and their privacy policy applies:
drive.file) and to read your email address to show which account is connected. Our website never receives your Drive files or token. Keystone's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect in Keystone, or remove access at myaccount.google.com/permissions.Vercel hosts the website and runs the account service. Upstash provides the database the account service uses. Discord handles sign-in. Stripe handles subscription payments for Pro and Team. If you dispute a payment, we may give that provider and your card issuer the purchase and use records described above, but only what's needed to answer the dispute. These providers may process data in the United States. Where that happens we rely on recognised safeguards, such as the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework.
Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, ask for it in a portable format, and withdraw consent at any time. You can delete your account yourself from your account page on this website. For anything else, email admin@the-best.uk. We'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office.
Signing in needs a Discord account, so you must be at least 13, or the minimum age for Discord where you live. If you think a child under 13 has given us personal data, contact us and we'll delete it.
If we change this policy, we'll update the date at the top. Significant changes will also be announced in the app or on Discord.