Skip to content
CubeVote

Privacy

This English translation is provided for convenience. Only the French version is legally binding.

Data controller

The data described here is processed by Lorgnet Axel, 14 rue marcel triboulet. Contact: contact@cubevote.net. It is hosted by OVH SAS (2 rue Kellermann, 59100 Roubaix, France).

What we collect

When you vote

A vote records a fingerprint of your IP address, the username you enter (required: one vote per username per cooldown) and the date. The IP address is never stored in clear: only a salted SHA-256 fingerprint is kept, to check that you don't vote more than once every 3 hours for the same server. This fingerprint can't be used to recover your address. When you vote, the address is also compared, on our servers, with public lists of VPN and Tor exit addresses that the site downloads every day: it isn't sent to anyone for this.

The username you enter is passed on to the owner of the server you vote for, so they can give you an in-game reward.

The username and date of your votes are also public: the server's top voters, the voters ranking, the Hall of Fame, the voter profile (/en/player/…, which search engines don't index) and, if the server installs it on its website, its “Top voters” widget. Pick a username you're happy to see shown; you can object to this display by writing to us.

If you vote while logged in, the vote is also linked to your account: that's what lets us give you, and nobody else, the free week of CubeVote+ offered to top voters and, if you publish a review of that server, to show the “Voter” label on it. This link is erased if you delete your account; the vote itself still counts for the server.

An application to a recruitment listing (username, message, availability, optional Discord username) is passed on to the team of the server concerned, and to them alone. You can withdraw it at any time from “My applications”; it is erased with your account.

“Remind me”, after a vote, records your browser's notification address and the reminder time, deleted as soon as it is sent.

When you create an account

We keep your username, your email address and a fingerprint of your password (bcrypt). The password itself is never stored.

If you arrive through a referral link, its code is stored with your account, never in a cookie: it lets us credit the member who invited you once your listing has proved its server's ownership.

Reviews and reports

A review is published with your account's username, its rating and its text, until you delete it (or your account). A report is only read by moderators; the salted fingerprint of your IP address, kept against abuse, is erased 90 days after it is handled.

If the account signing a review has voted for that server while logged in, the review publicly shows the “Voter” label with a rough number of those votes (1, 10, 50 or 100 and more), never their exact count or dates. The label is worked out when the page is shown: nothing more is stored. It disappears with the review or the account; you can also object to it by writing to us.

Audience measurement

To know which pages are read and where visitors come from, each page view is counted without cookies and without keeping your IP address. A visitor is recognised for one day by a fingerprint of their address and browser, computed with a key that changes every day: it's impossible to follow them from one day to the next, or to recover their address. These fingerprints are erased the next day; only totals remain (page views, visitors per day, landing pages, referring site, device type, number of pages opened from the home page by kind of page). Nothing is shared with a third party.

This measurement, limited to anonymous statistics, is exempt from consent (CNIL, deliberation no. 2020-091). You can still object to it:

CubeVote+: if you subscribe, we keep the status of your subscription (trial, active, cancelled) and its end date. The CubeVote+ badge is shown publicly next to your Minecraft username, in reviews, top voters and the Hall of Fame, while the subscription runs. If you activate CubeVote+ with a code (given by a partner server), we keep the code, its length and the date, linked to your account for 13 months (or until you delete your account, if sooner). If you arrive through a code's link, we keep that code on your account until you activate it (30 days at most): nothing is stored in your browser. We also remember the end date of a free period already announced after a vote, so that it is only announced once.

Inviting Minecraft servers

To make CubeVote known, we write to Minecraft server teams at the contact address they publish themselves (on their website or in a server directory). We keep the server's name, that address, the page where it is published, its website and game address, and the date of our messages. Basis: our legitimate interest in presenting a free service related to their activity (business-to-business prospecting). One message at most, and one follow-up at most; each says where the address comes from and how not to be contacted again: reply “stop”, or a link applied at once. An address that objects is kept on an opt-out list, so that it is never contacted again. The link in the message pre-fills the server's listing; if an account and then a listing are created, we note which ones, and when, to know how many teams these messages bring. Nothing measures whether a message is opened. This data is neither sold nor shared.

Why: legal bases

  • Performance of the contract (art. 6.1.b GDPR): your account, your listings, your orders, your applications and the emails that go with them (address confirmation, forgotten password, outage alerts, receipts).
  • Legal obligation (art. 6.1.c): invoices, credit notes and the sales ledger.
  • Legitimate interest (art. 6.1.f): a reliable ranking (votes, cooldowns, fighting fraud and bots), the site's security (rate limits, technical log), reviews (including the “Voter” label) and moderation, anonymous audience measurement and inviting Minecraft servers. You can object on grounds relating to your situation (see “Your rights”).
  • Consent (art. 6.1.a): browser notifications, email reports (off by default). It can be withdrawn as easily as it is given.

Retention periods

  • Votes: kept for the ranking history; their fingerprints (IP address, subnet, device) are erased after 90 days.
  • Login sessions: thirty days.
  • Account: until its holder deletes it.
  • Invoices and credit notes (name, address, email shown on them, amounts): ten years, even after the account is deleted, as the French Commercial Code (art. L123-22) requires for accounting records.
  • Server attendance readings: thirty days.
  • Password reset links: valid for one hour, erased once used or expired.
  • “Remind me”: erased as soon as the reminder is sent.
  • Applications: until withdrawn, or the account is deleted.
  • Audience measurement: fingerprints erased the next day, totals twenty-five months.
  • Server invitations: three years after our last unanswered message; the opt-out list, as long as the objection lasts.
  • Web server technical log (IP address, requested page, browser, date): seven days, to spot and block bots probing for security holes.

Cookies and local storage

The site sets one cookie, cubevote_session, strictly necessary to keep you logged in, and, for five minutes between the password and the code, cubevote_2fa if you have turned on two-factor authentication. If you pick a language with the FR / EN button, the langue cookie remembers it for a year; without it, the site follows your browser's language. No referral cookie: a referral link's code travels in the page address, then in the sign-up form. No advertising cookies, no audience-measurement cookies.

Your browser also keeps, locally and without anything being sent to us: the theme you chose (light or dark), an identifier drawn at random on your first vote, which groups your votes from this machine against fraud, the last username you voted with (so you don't retype it), the list of servers you follow and, if you asked for it, your refusal of audience measurement. Clearing the site's data deletes them.

The code you copy to vote is produced by us: no cookie, no third-party service. The site shows no advertising.

Third-party services and recipients

Minecraft heads (Minotar), trailer thumbnails (YouTube) and listing images hosted elsewhere (Imgur, ImgBB…) are fetched by our servers, then served from CubeVote: these services never see your IP address, only ours. Your browser only contacts a third-party service in the following cases, and that service then sees your IP address:

  • Cloudflare Turnstile, anti-bot check on the sign-up, vote, review and report forms, when it is turned on.
  • YouTube (Google Ireland Ltd): the player, loaded from youtube-nocookie.com only if you start a trailer.
  • Your browser's notification service (Google, Mozilla or Apple as the case may be), only if you turn on notifications.
  • Stripe, payment for promotions and the CubeVote+ subscription, only when paying or managing your subscription. No card number goes through our servers; we only keep the customer identifier and the subscription status.
  • PayPal, only if you choose to pay with PayPal on Stripe's payment page: PayPal then processes that payment under its own privacy policy.

Recipients: the site's administrators; our service providers, each for its own task (the host, OVH SAS, the email delivery service, Stripe and, depending on the settings, Cloudflare, Google and Discord for the bot of a server that linked it); the owner of the server you vote for (username and date, for the reward); the public, for what the site shows (usernames on votes and reviews). No data is sold.

Outside the European Union: Stripe, Cloudflare, Google and Discord may process data in the United States. These transfers are covered by the Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and, failing that, by standard contractual clauses.

Minors

Many players are minors. Voting needs no account and only collects the username you choose; under fifteen, creating an account requires a parent's consent (art. 45 of the French Data Protection Act, see the terms of use). Ads are never personalised, and no data is used to build a profile.

Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, the right to withdraw a consent at any time, and the right to set instructions for what happens to it after your death (art. 85 of the French Data Protection Act). Several can be exercised directly, without writing to us or waiting:

  • Access and portability: download your data in JSON format from your account.
  • Erasure: delete your account from the My account page. Deletion is immediate and permanent; only invoices remain, for ten years, as the law requires.
  • Rectification: change your information from your account, or write to us for what can't be changed there.
  • Objection and withdrawal of consent: audience measurement (above), email reports (My account), notifications (browser settings), server invitations (the link in each message, or a “stop” reply).

For anything else (removing your username from public pages, for instance), write to contact@cubevote.net: we answer within a month. If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr/plaintes).