Last updated: 15 October 2026
Madsi is an independent server management platform that connects Discord and Minecraft. This policy explains what data we collect, why, and how we handle it. When we say "Madsi," "we," or "us," we mean the operator of the Madsi service.
The data controller for that data is [TRADER: legal name, to be completed before launch], trading as Madsi, at [TRADER: geographic postal address, to be completed before launch]. Contact us at [email protected] for anything in this policy, including the rights in section 8.
One exception: for data about the players on a connected Minecraft server, the server's operator is the controller and we act as their processor. Those terms are in section 9 of the Terms of Service, and an operator who wants their players' data corrected or deleted should ask us there.
When you sign in, we request the identify, guilds and email scopes from Discord. This gives us your Discord user ID, username, display name, and avatar, as well as a list of servers you can manage. We store your Discord user ID in our database to associate your configuration and linked accounts.
If your Discord account has a verified email address, we store it for three purposes only: delivering the feedback-board notifications described in section 2H (replies to your posts, status changes, @mentions); if you subscribe on the changelog, telling you when a new changelog edition ships; and telling you about a Madsi plan you pay for or manage billing on (a failed payment, a renewal your bank must confirm, a lapsed plan, or a change to who pays). Billing notices go by Discord DM instead when no email is on file or the email can't be sent. You can switch each feedback notification type, changelog updates included, to Discord DM or off entirely on your feedback profile, and every notification email contains an unsubscribe link. We never use it for marketing and never share it.
To keep you signed in without asking you to re-authorise constantly, we store the access and refresh tokens Discord issues for your session. These are encrypted at rest (AES-256-GCM) and are only ever used to read the same identify/guilds information above on your behalf. They never give us access to your messages or your password. You can revoke them any time from your Discord authorised apps settings.
If a server grants you dashboard access through a Discord role, we also store the list of role IDs you hold in that server against your session, so every page load does not have to ask Discord again. It holds role IDs only (no names, no other members) and it is deleted with the session when you sign out or it expires.
When you link your Minecraft account, you sign in through Microsoft. We use your Microsoft token only to verify your identity and retrieve your Minecraft UUID and username. We do not store your Microsoft credentials or tokens. They are used once during the linking flow and discarded. We store your Minecraft UUID and username. If you turn whispers off in game with /madsi whispers off without a linked account, or on a server that does not check Minecraft accounts, we keep your Minecraft UUID, with the Discord server it applies to, on a list of players who don't take whispers until you turn them back on (in game, or on your Preferences page once you link).
The Madsi Minecraft mod sends periodic data from your server, including: player count, max players, TPS, memory usage, uptime, world size, server icon, and player join/leave events (player UUID and username). From those sessions we also derive and store per-player activity statistics, playtime, session counts, last-seen time, deaths, and advancement progress. This data powers the dashboard, whitelist, live stats, and stat-based in-game role features. When a vanish plugin or mod hides a player, we also note whether they were vanished the last time the server reported them, so the server's vanish settings can keep them out of stat roles and leaderboards; the note is deleted with the server.
Because Minecraft restarts a world's statistics from zero, these per-player statistics are kept per world. When a server operator starts a new world, the totals collected up to that point are archived and retained alongside the new world's, so activity history survives a world reset. An operator can delete an archived world, or delete a server's collected statistics outright, from the dashboard at any time; removing the server or the Madsi bot deletes them too.
We store your server settings, whitelist rules, nickname format preferences, onboarding templates, setup progress, dashboard widget layouts, custom command and message templates, command preferences, application forms, scheduled commands, stat-based role tiers, and custom branding (the bot's name, uploaded avatar and banner images, and bio). If you import existing links from another tool such as DiscordSRV, the imported Discord-to-Minecraft account mappings are stored the same way as natively-linked accounts.
If a server's owner allows config editing, the contents of that server's mod and plugin config files pass through Madsi when someone with the right permission opens or saves one. Values that look like passwords, tokens or keys are removed on the server before a file is sent, and a file that contained them cannot be saved from the dashboard. File contents are not stored: they travel from the server to the viewer's browser and back. A backup of each file's previous version is kept on the Minecraft server itself, not by Madsi, and every save is recorded in the activity log with who made it, which file, and a fingerprint of its contents before and after. Madsi also shows each installed mod's own icon, read from its file on the server.
World backups are made and kept on the Minecraft server's own disk, not by Madsi, and so are a server's other worlds with their mods and configs. When someone with the Backups permission downloads a backup, only its world passes through Madsi on its way from the server to their browser, and it is not stored; a world zip they upload passes through the same way to the server, and is not stored either. A modpack picked from Modrinth is fetched by Madsi and handed to the server, and deleted within three hours. A world holds what the game saves about its players, such as their positions, inventories and statistics. Madsi keeps each world's name, loader and Minecraft version, to list them and count them against the plan. Every backup, download, new world, switch and restore is recorded in the activity log with who asked for it.
A modpack file uploaded to be installed on a server is held by Madsi for up to 30 minutes, long enough for the server to fetch it, and then deleted. Madsi keeps the pack's name, version and what was installed in the activity log.
If you add other people to your server's dashboard team, we store their Discord user ID, username, and avatar alongside the role you give them. We also keep an activity log of management actions taken in the dashboard (who changed what and when (for example, adding a team member or editing a whitelist rule)) so server owners have an audit trail. This log records the acting user's ID and a snapshot of their name at the time, not message content.
When a server's staff ban a Minecraft player through Madsi, we keep a record of that ban for each of its Minecraft servers: the player's UUID and name, the reason, and where the ban came from. It lets Madsi lift only the bans it placed, and reach a server that was offline at the time. The record is deleted once the ban is lifted, or with the server. Madsi also keeps one record of each player's ban for the whole Discord server, so a Minecraft server added later, even after the others are removed, is given the ban too; it is deleted once the ban is lifted, or when the Discord server's data leaves Madsi.
If you use the built-in support chat (Nuri), your questions and its answers are stored with your Discord user ID, so we can review how well it answers; if you rate an answer, the rating and any reason you give are stored too. Both are deleted after 90 days. To answer, your question and up to the last six turns of the conversation (your earlier questions and Nuri's replies) are sent to Google's Gemini AI. Your Discord ID is not sent to Google. Each use of Nuri or the Bridge pattern assistant also records your Discord user ID, which assistant and when (not what you asked), to hold the daily AI limits; that record is deleted after two days.
Payments are taken by Stripe, whose affiliate trades as Onelink and is the merchant of record for the sale. Your card number, bank details and billing address go to Stripe, not to us: we never see or store them, and Stripe holds them as merchant of record rather than purely as our processor. Stripe may create a Onelink account for you, under the email address you paid with, so you can see your orders, receipts and invoices. We store only the Stripe customer and subscription IDs linked to your Discord server, and, for the person paying, their Discord ID and the Discord display name they had at checkout, which the server's team sees on the Billing page as "Paid by". Each person who pays for a server gets their own Stripe customer, so nobody sees another payer's card or invoices. If you ask to take over paying for a server's plan, we keep the request (who asked, who answered and when) and email the server owner and the current payer about it, using the verified email on their Discord account. Deleting your account removes your ID and name from servers you used to pay for. Section 5 of the Terms of Service sets out what that means for your purchase.
Posts, comments and stars on the public feedback board are public, shown under the display name you choose (your Discord name, a custom name, or "Anonymous"). Staff can always see the Discord account behind a post. That's what makes anonymous posting moderable. A comment containing a link or a Discord invite is seen only by you and staff until staff approve it, and staff can hide any comment. Avatars on the board are loaded through Madsi, so the page never carries your Discord user ID.
When you submit feedback, we automatically attach a small technical snapshot so you don't have to describe your setup by hand and so we can actually reproduce what you report: your browser and version, operating system, screen size, light or dark mode and reduced-motion setting, language and timezone, the page address you were on, the app version, the last few errors and failed requests that page hit (error message and code location, or request address and status, never anything you typed), and, if you own a Discord server on Madsi, your highest plan, how many servers you own and how many of your Minecraft servers are online or offline. This snapshot exists solely to diagnose and fix the problem you're reporting. It is visible only to staff, never shown publicly, and is deleted with the post. It does not include your IP address.
If a server you interact with uses the applications feature, we store the answers you submit to its application form together with the Discord account you submit them from (and your linked Minecraft account, once linked). Submissions are visible to that server's staff for review. Each form's staff choose how long the answers of an accepted or a denied submission are kept (30 days, 90 days, 1 year, or for as long as the form exists), and a submission withdrawn because you left the server follows the denied period; after that the answers are deleted (for a denied or withdrawn submission, the Minecraft name and the staff's note too), while the record of who applied, the outcome and when it was decided stays. Everything is deleted with the form, or with the server's data when it leaves Madsi. When the answers are deleted, Madsi also edits the review post it made in the server's Discord channel to remove them, and when a submission is deleted with its form or with your Madsi account, Madsi deletes that post, and the staff discussion thread it started off it where the server lets Madsi manage threads; beyond that, the post is a Discord message under that server's control, not ours. The same goes for any post in the server's Applications log channel, which Madsi does not edit. When an accepted application whitelists a Minecraft account, the whitelist entry records the Discord account that applied, so a ban in that Discord server can take the access back; it stays with the entry, after the submission, the form or your Madsi account is deleted, until the entry is removed or the server leaves Madsi. For a form with a time limit, we record when you pressed Start, until you submit or the form's wait after a window runs out has passed. A public web application link only accepts people who are members of the Discord server, so to check that, Madsi asks Discord whether you are a member (or banned) when you open the form signed in.
When a page or request fails, Madsi records the error automatically so we can fix it: the error message and code location, the page address (which can include your server's IDs), your Discord user ID if you are signed in, your browser's user agent, the app version, and a list of the pages you visited, requests that failed and errors logged just before it (page types and addresses only, never what you typed). It is visible only to staff, does not include your IP address, and is deleted after 30 days.
If a server you play on turns on stat alerts, Madsi compares the statistics your Minecraft server reports about you (blocks mined, playtime, advancements and similar) with limits that server's staff set, to flag play that looks like cheating, such as X-ray mining. If the server runs the Grim or Vulcan anticheat, Madsi also passes on what it reports about you: the check that flagged you, its violation level, and any kick or ban it issued. To do this we keep your recent readings for 2 hours, a running score per rule, and, when a limit is crossed or the anticheat reports you, an alert: your Minecraft name and UUID, what was measured or reported, when, and what staff did about it (dismissed, kicked or banned, and who did it). An alert is a suspicion for that server's staff to check, not a finding that you cheated. Alerts are visible only to that Discord server's owner and the team members they allow, on the dashboard and in the Discord channel they choose, and are kept for the period the server's staff set, at most 30 days on the Free plan, 90 on Basic and one year on Pro, then deleted. Staff can set a rule to kick or ban a player automatically, without a person checking first; that choice is theirs. A server can exempt you from its alerts; that is stored as your UUID in its settings. Posts in the server's Discord channel are kept by Discord under that server's control, not by us.
About IP addresses. We never store one. Your address is processed transiently, in memory, for three things: a per-address request counter that enforces rate limits and is discarded within an hour; a keyed, one-way fingerprint of the address and the file name when you download the Mod from our site, kept for six hours so a repeat download of the same file counts once; and a check of the approximate country your hosting provider reports in a request header, which picks the currency prices are shown in. None of these is written to the database or kept in our logs, and none tells us where you are more precisely than a country.
The same holds for the players on a connected Minecraft server. Their addresses appear in ordinary Minecraft log lines, so the Mod strips IP addresses and Madsi tokens out of every console line before it leaves the server. Console output is then relayed live to that server's dashboard, and to a Discord channel if its operator turns that on; we do not store it.
We use nine cookies. None of them track you, and none are shared with anyone.
| Cookie | Purpose | Duration | Readable by page scripts |
|---|---|---|---|
session | Authentication (opaque server-side token) | 7 or 30 days | No |
oauth_state_* | Discord sign-in security (CSRF protection during login only) | 10 minutes | No |
return_to | The page you opened while signed out (a dashboard page, or an application form's Minecraft check), so sign-in takes you back to it | 10 minutes | No |
pkce_verifier | Microsoft OAuth security (PKCE flow, when you link your Minecraft account or verify it on an application form) | 10 minutes | No |
link_query | Your Discord ID and the one-time code from your /link card, kept while you sign in with Discord (account linking only) | 10 minutes | No |
mc_link_intent | A signed note of which Discord account and server you are linking, carried through the Microsoft sign-in (account linking only) | 10 minutes | No |
srv_<guildId> | Which of a Discord server's Minecraft servers the dashboard was last showing | 1 year | Yes |
madsi_ccy | The display currency you picked on the pricing page | 1 year | Yes |
The seven marked "No" are httpOnly and Secure: they are sent over HTTPS only and a script on the page cannot read them, which is what keeps your session out of reach of injected code. The two marked "Yes" are ordinary readable cookies, because the page itself writes or reads them. Neither holds anything secret: one is a server id that is already visible in the dashboard URL, the other a three-letter currency code.
We do not use advertising, analytics, or third-party cookies. No cookie banner is required: the first seven are strictly necessary, and the last two only remember a choice you made yourself.
We share data with third parties only as necessary to operate the Service:
/profile, /stats, /mc-ban, adding a player to a whitelist or a rank by name, exempting a player from stat alerts by name, and a DiscordSRV import. Requests come from our server, and nothing about you is sent with them/profile card shows a full-body skin render requested by the player's UUID, so the request (made by Discord's image proxy) reveals that UUID to them. A server's staff can remove it by editing the template/server sends the server address you type to mcstatus.io to look up its status, and Discord's image proxy loads the server's icon from there. The dashboard home page shows a few public example servers whose status Madsi reads from mcsrvstat.us and whose icons your browser loads from it. Nothing about you or your players is sentWe do not sell your data to anyone.
Depending on your jurisdiction (including under GDPR and UK GDPR), you may have the right to:
Signed in, you can do the first and last of these yourself, right now: your account page (the account menu → Account and data) lists everything we hold about you, place by place, downloads it as a file, and deletes your account. Records kept under a Minecraft account rather than your Discord ID (whitelist entries, stats, playtime, stat and anticheat alerts, whispers sent from the game) are included only for a Minecraft account you proved is yours by signing in with Microsoft, and only while no other Discord account has proved it since; for one linked only in game, the link itself is included but those records are not, so contact us for them. Deleting removes the records that exist only to describe you, any feedback post off the board (held for review or dismissed) that nobody else voted on or commented on, and any comment that never went public. An edit to a post or comment still waiting for review is deleted, and the post or comment goes back to its last public version. Your other posts and comments, and activity log entries, stay with your name and ID replaced, because they belong to everyone who took part. A subscription you pay for must have ended first, and a Discord timeout mirrored to a Minecraft ban must have run out. For anything else, or if you would rather we did it, contact us via our Discord server or email [email protected]. We will respond within 30 days.
Madsi is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 is using the Service, please contact us and we will delete their data.
We use industry-standard measures to protect your data: encrypted connections (HTTPS/WSS), httpOnly secure cookies, opaque session tokens stored only as SHA-256 hashes (so a database leak can't be replayed as a login), and Minecraft server tokens stored only as SHA-256 hashes.
The personal data we consider most sensitive is encrypted at rest with AES-256-GCM, each category under its own separately derived key: your Discord OAuth tokens, your notification email address, the contents of private whispers, and the answers you give on application forms. The keys are held by the application and never stored in the database, so a stolen database, backup or disk does not reveal any of it.
We are deliberately clear about the limit of that protection: encryption defends your data against theft of our storage, not against us. Madsi's staff operate the service and hold the keys. What actually limits what anyone can see is how little we keep: our copy of a whisper is destroyed the moment it's read, unread ones are destroyed after 30 days, and support questions are deleted after 90 days.
No system is perfectly secure, but we take reasonable precautions to protect your information.
We may update this policy from time to time. If we make material changes, we will notify you through the dashboard or Discord. The "last updated" date at the top reflects the most recent revision.
Questions or concerns? Reach out via our Discord server or email [email protected].