Privacy notice

The data controller is Apeyron Srl, registered at Via Giovanni Quarena 11, 25018 Bedizzole (BS), Italia, VAT no. IT04674920980. For anything concerning personal data, write to apeyronsrl@gmail.com.

This notice covers the Theatron website and web application and the Theatron desktop app. It does not cover our users' Minecraft servers, which stay under their control.

We collect only what the service needs to work. Concretely:

When you connect a server, Theatron temporarily processes the presence of players who are online — their in-game name, UUID when available, and live state needed for monitoring. We do not create player history or record first or last access.

For that data you are the controller: you decide why it is processed and for how long. We act as your processor, handling it only to provide the service and only on your instructions. If one of your players contacts us directly, we point them to you.

If your server is open to minors, this is the part of the notice that concerns you most: the obligations towards them are yours.

The Theatron desktop app for Windows and macOS, distributed on the Microsoft Store as "Theatron Server Launcher" (its window may be titled "Theatron Launcher"), is used to create and manage Minecraft servers (Paper) on your own PC and to see the servers in your Theatron workspace. It does not include, download or start the Minecraft game: it is not a game launcher.

The app contains no analytics, telemetry, advertising identifiers, cookies or crash reporting. There is no Google Analytics, Meta Pixel or reCAPTCHA inside it.

To sign in, the app opens the Theatron website in your system browser, where the reCAPTCHA and cookie rules described in this notice apply; signing in with Google, Discord or Microsoft also goes through the browser. Once you are signed in, the browser hands a one-time code back to the app over a local address on the same PC (127.0.0.1).

In detail:

We process account and session data to deliver the service you asked for: the legal basis is performance of the contract (GDPR Art. 6(1)(b)).

We process security data (failed sign-in attempts, temporary locks, session IP and user agent) to protect accounts, on the basis of our legitimate interest in keeping the service secure (Art. 6(1)(f)).

We use Google reCAPTCHA v3 on the sign-in, registration, password-reset and verification-email forms to protect accounts from automated abuse such as credential stuffing and mass registrations: the legal basis is our legitimate interest in keeping the service secure (Art. 6(1)(f)).

We keep the consent ledger so we can demonstrate compliance: the legal basis is our legal obligation (Art. 6(1)(c)).

We process billing data to meet accounting and tax obligations (Art. 6(1)(c)).

We use Google Analytics 4 to understand, in aggregate, how the public site is used, and Meta Pixel to measure campaign effectiveness and publish ads based on site activity. For these cookies and tools the legal basis is your consent (GDPR Art. 6(1)(a) and Art. 122 of the Italian privacy code), which we collect through the banner on first visit before activating any measurement or marketing.

We process waiting list data to record your interest, keep you posted on the service opening, and send you the sign-up confirmation email: the legal basis is your consent (GDPR Art. 6(1)(a)), which you give by ticking the dedicated box in the form and can withdraw at any time by writing to apeyronsrl@gmail.com.

We process interest-form data to understand your project, respond to the request, and suggest the most relevant Theatron path: the legal basis is consent (GDPR Art. 6(1)(a)). Promotional updates require a second, optional and separate choice.

We process creator application data to assess your request, contact you about it, and send you the application confirmation email: the legal basis is your consent (GDPR Art. 6(1)(a)), which you give by ticking the dedicated box in the form and can withdraw at any time by writing to apeyronsrl@gmail.com.

We make no automated decisions about you, we sell data to nobody, and we do not link data collected by Google Analytics or Meta Pixel to your Theatron account.

Account data lives as long as the account does. If you close it we delete or anonymise the data, with two exceptions the law requires us to keep: tax records, for the period Italian law prescribes, and the consent ledger, which by design cannot be altered or erased.

Session tokens expire on their own and are invalidated on sign-out or password change. Live player presence is volatile: it disappears when the connection ends or the service restarts and is not retained as history.

Measurement data stays in the Google Analytics property and Meta tools for the retention periods set in those services; the cookies that produce it last at most two years and may refresh on each visit, so they expire sooner if you do not come back.

Waiting list data is kept for at most 12 months from your request, after which we delete or anonymise it. You can ask us to remove you from the list at any time by writing to apeyronsrl@gmail.com.

Interest-form data is kept for at most 12 months from the latest activity, after which we delete or anonymise it unless you begin an active relationship with us. You can ask us to remove it at any time by writing to apeyronsrl@gmail.com.

Creator application data is kept for at most 12 months from the application, after which we delete or anonymise it, unless in the meantime you begin an active creator relationship with us.

We do not sell or trade personal data. We share it only with the providers the service needs or that measure marketing, each according to its privacy role: Infomaniak (Switzerland) for transactional email, OVH (France) for infrastructure and file storage, Google Ireland Limited for site measurement via Google Analytics 4, Meta Platforms Ireland Limited for Meta Pixel, mc-heads.net for rendering Minecraft player icons, and, if you take a paid plan, Stripe for payment processing. If you sign in through Google, Discord or Microsoft, the data described in section 2 passes through the chosen provider.

Google Ireland Limited provides reCAPTCHA v3 on those four forms and processes the data it collects under its own privacy policy and terms of service.

If you use the desktop app, Eclipse Adoptium (Eclipse Foundation) and PaperMC receive your IP address when the app downloads the Java runtime and the Paper server software from them respectively: they are not our processors but independent third parties that handle that data under their own privacy policies, and we send them no account data.

We may also disclose data to authorities where we are legally required to.

Most of our providers process data within the European Economic Area: OVH is based in France; Infomaniak is based in Switzerland, which benefits from a European Commission adequacy decision. For providers based in the United States, transfers rest on the EU-U.S. Data Privacy Framework (DPF) or on standard contractual clauses (SCCs). Write to apeyronsrl@gmail.com for a copy of the safeguards in place.

Specifically, transfers to the United States concern: Google LLC (site measurement and, if you choose to sign in with Google, authentication), Meta Platforms Inc. (campaign measurement and advertising audiences), Stripe Inc. (payments), and Microsoft Corporation (if you choose to sign in with Microsoft), all certified under the DPF; Discord Inc. (if you choose to sign in with Discord), on the basis of standard contractual clauses. mc-heads.net, used for player icons, may process data outside the EEA under its own terms.

Google reCAPTCHA may also transfer the data it collects to Google LLC in the United States, under the same safeguards.

Eclipse Adoptium and PaperMC, from which the desktop app downloads the Java runtime and Paper, handle your IP address under their own terms, including any processing outside the EEA.

You can ask us at any time to access your data, correct it, erase it, restrict its processing, receive it in a machine-readable format, or object to processing based on our legitimate interest. You can exercise these rights directly from your account settings or by writing to apeyronsrl@gmail.com: we answer within one month.

In particular, you can request an export of your personal data in a machine-readable format and the deletion of your account: in that case we anonymise your profile data, keeping only what the law requires us to retain (tax records and the consent ledger).

If you believe the processing breaks the rules, you can complain to the Italian data protection authority (www.garanteprivacy.it) or to the authority where you live.

We use strictly necessary cookies and, with your consent, measurement and marketing cookies. The full detail — which cookies, what they do and how long they last — is in our Cookie Policy, reachable from the site footer.

In short: on first visit a banner asks whether you accept Google Analytics and Meta Pixel. If you decline or close the banner without accepting, those tools do not activate and no non-necessary cookies are set. You can change your choice at any time from the "Cookie settings" link in the site footer.

If we change something substantive we bump the document version and tell you before the change takes effect. The current version and the date of the last update are at the foot of this page.