Privacy notice · Theatron

1. Who processes your data

The data controller is Apeyron Srl, registered at Via Giovanni Quarena 11, 25018 Bedizzole (BS), Italia, VAT no. IT04674920980. For anything concerning personal data, write to apeyronsrl@gmail.com.

This notice covers the Theatron website and web application. It does not cover our users' Minecraft servers, which stay under their control.

2. What we collect

We collect only what the service needs to work. Concretely:

Account data: email address, name, password stored as a hash (we never store a password in clear text), whether the address has been verified, when the password last changed, the count of failed sign-in attempts and the temporary lock that follows from it.
Session data: for each active session we keep a hashed refresh token, its expiry, and the IP address and user agent it started from. This keeps you signed in and lets us notice if a session is replayed by someone else.
Consent ledger: when you accept this notice or give a consent, we record what you accepted, which version of the document, when, from which IP and with which browser. The ledger is append-only: a withdrawal is a new row, never the deletion of the old one.
Billing data: if you take a paid plan, we keep the subscription state and our payment provider's identifiers. Card details never pass through our systems and we never see them.
Content you create: characters, dialogue, quests, items, settings, and files you upload. This is your content rather than your personal data, but we list it here because it lives on our systems.
Site measurement data: when you visit the public site, Google Analytics 4 records — pseudonymously — the pages you open, how you got here, your browser and device type, your language and an approximate location derived from your IP address, which Google does not store. We do not link any of it to your account.

3. Your server's players

This deserves its own section, because it is the least obvious part. When you connect a server, Theatron records the players who join it: the Minecraft UUID, the in-game name, and when they were last seen. Nothing else.

For that data you are the controller: you decide why it is processed and for how long. We act as your processor, handling it only to provide the service and only on your instructions. If one of your players contacts us directly, we point them to you.

If your server is open to minors, this is the part of the notice that concerns you most: the obligations towards them are yours.

4. Why we process it, and on what legal basis

We process account and session data to deliver the service you asked for: the legal basis is performance of the contract (GDPR Art. 6(1)(b)).

We process security data (failed sign-in attempts, temporary locks, session IP and user agent) to protect accounts, on the basis of our legitimate interest in keeping the service secure (Art. 6(1)(f)).

We keep the consent ledger so we can demonstrate compliance: the legal basis is our legal obligation (Art. 6(1)(c)).

We process billing data to meet accounting and tax obligations (Art. 6(1)(c)).

We use Google Analytics 4 to understand, in aggregate, how the public site is used. For measurement cookies the legal basis is your consent (GDPR Art. 6(1)(a) and Art. 122 of the Italian privacy code): the banner that collects it is being introduced, and until it is live you can switch measurement off as described in section 9.

We do not profile you, we make no automated decisions about you, we do not use measurement data for advertising, and we sell data to nobody.

5. How long we keep it

Account data lives as long as the account does. If you close it we delete or anonymise the data, with two exceptions the law requires us to keep: tax records, for the period Italian law prescribes, and the consent ledger, which by design cannot be altered or erased.

Session tokens expire on their own and are invalidated on sign-out or password change. Your server's player data stays while that server is connected, or until you ask us to remove it.

Measurement data stays in the Google Analytics property for the retention period set on that property; the cookies that produce it last at most two years and refresh on each visit, so they expire sooner if you do not come back.

6. Who we share it with

We do not sell or trade personal data. We share it only with the providers the service needs, each appointed as a processor and bound to handle it only on our behalf: the infrastructure Theatron runs on, the service that sends transactional email (address verification, password reset), the storage service for files you upload, the site measurement provider (Google Ireland Limited, for Google Analytics) and, if you take a paid plan, the payment provider.

We may also disclose data to authorities where we are legally required to.

7. Transfers outside the European Union

Some of the providers above may process data outside the European Economic Area. Where that happens, the transfer rests on a European Commission adequacy decision or on standard contractual clauses. Write to apeyronsrl@gmail.com for a copy of the safeguards in place.

In practice this concerns site measurement: data collected by Google Analytics may be processed in the United States by Google LLC, which is certified under the EU-U.S. Data Privacy Framework — the adequacy decision the transfer rests on.

8. Your rights

You can ask us at any time to access your data, correct it, erase it, restrict its processing, receive it in a machine-readable format, or object to processing based on our legitimate interest. Write to apeyronsrl@gmail.com and we answer within one month.

If you believe the processing breaks the rules, you can complain to the Italian data protection authority (garanteprivacy.it) or to the authority where you live.

9. Cookies

Strictly necessary cookies: the ones that hold your session open after sign-in (access_token and refresh_token) and the one that remembers the language you picked (NEXT_LOCALE). The site does not work without them, and by law they need no consent.

Measurement cookies: on the public site Google Analytics 4 sets _ga and _ga_<ID>, which give your browser a pseudonymous identifier so we can count visits and see which pages actually earn their place. The script is served from googletagmanager.com, the domain Google distributes its tag from. We use no advertising, profiling or social network cookies.

You can refuse measurement by installing Google's Analytics opt-out add-on, or by blocking or clearing this site's cookies in your browser settings: the site behaves exactly the same either way. The banner that will collect consent before measurement runs is in progress; this section will say so once it is live.

10. Changes to this notice

If we change something substantive we bump the document version and tell you before the change takes effect. The current version and the date of the last update are at the foot of this page.