Summary: Cubicase works without an account, has no ads and uses no behavioral analytics. Your server and worlds stay on your computer. Below is everything that goes through our infrastructure, and why.
1. Who is responsible
Cubicase is an independent project, developed and operated in Brazil (“we”). We are the controller of the data described here under the Brazilian General Data Protection Law (LGPD, Law 13,709/2018) and, where applicable, comparable laws.
Privacy contact and exercise of rights: through the in-app Help Center (Help → Send message) or by e-mail at felipe@cubicase.net.
2. What stays on your computer
Servers, worlds, backups, mods, app settings, the app's technical log (cubeforge_debug.log) and the owner secret of your servers stay in folders on your computer (Documents/CubicaseServers, Documents/CubicaseBackups and the app data folder). We do not upload these files. The technical log only leaves your computer if you copy and send it with a help request.
3. Data we handle and why
| Situation | Data | Purpose |
|---|---|---|
| Using the app (no account) | A random installation identifier (not your name or e-mail); app version; the IP address of your connection (seen by the infrastructure and used for up to ~1 minute to limit abuse). | Make the service work and protect it from abuse. |
| Registering a server to invite friends | Invite code, server name, Minecraft version, type/loader, description, state (online/offline), number of online players and whether the host is connected. The owner secret is stored only as a hash. | Let your friends find and join the server. |
| Joining as a guest | The code you type; installation identifier; temporary connection credentials (valid for up to 24 hours). | Connect you to the host's server. |
| Connection between host and guests | To link the computers, the app exchanges network addresses (each side's public IP address and local addresses) through a temporary signaling room on our server. With the direct connection, host and guests get to see each other's IP address, which is inherent to this kind of connection; private mode (Cubicase Plus) hides the host's IP. When a direct connection is not possible, traffic goes through a backup server that relays already-encrypted data and records the volume relayed per server. | Connect host and guests and measure the backup server's monthly allowance. |
| Account (optional) | E-mail and, if you sign in with Google or Discord, the profile name and picture they provide. | Authenticate you and enable account features. |
| Cubicase Plus | Stripe customer and subscription identifiers, plan, status and renewal date. We do not receive or store card data; payment happens on Stripe's page. | Bill you and enable paid features. |
| Remote web panel (Plus) | Computer name, device token, last seen, invited accounts and permissions. While the app is connected: server state, server list, online players, computer usage metrics and the last ~200 console lines, plus commands sent from the panel. This temporary content is deleted when the app disconnects. | Control the server from a browser. |
| Custom link and address (Plus) | The chosen name, linked to your server and your account. | Show the link/address you configured. |
| Help Center | The e-mail, subject and message you write, plus the app version and operating system. | Answer your request. |
| Donations | Amount and currency confirmed by Stripe. We do not store your payment details. | Record the support received. |
4. Who we share it with (processors and third parties)
We do not sell data and we show no advertising. We use these providers to deliver the service; each handles data under its own policy:
- Cloudflare — Cubicase API, storage of server records and the remote panel.
- Supabase — accounts, subscriptions and remote panel data.
- Stripe — payments (subscriptions and donations).
- Resend — delivery of Help Center e-mails to us.
- Oracle Cloud — backup (relay) server in São Paulo, used only when a direct connection is not possible; it sees the IP addresses of whoever uses it and the volume relayed, but not the content (the connection is encrypted).
- Google (STUN servers) — used to discover the public IP address needed for the direct connection; Google sees the IP of whoever queries.
- GitHub — hosting of the website and of the app installers/updates (the app checks published versions).
- Mojang/Microsoft, Adoptium, PaperMC, Forge/NeoForge, Fabric — where the app downloads the server, Java and installers; they see the IP of whoever downloads.
- Modrinth and CurseForge — mod search and download; they receive the search terms and, to identify mods, file hash codes (never the files).
- Google Fonts — fonts for the website pages (Google sees the IP of whoever opens the pages).
We may also disclose data when legally required or ordered by a competent authority.
5. Legal bases (LGPD, art. 7)
Performance of a contract (providing the app and the features you asked for, including the subscription), legitimate interest (security, abuse and fraud prevention, and basic network operation) and compliance with a legal obligation (for example, tax records of the subscription). Where required we ask for your consent, which you can withdraw at any time.
6. How long we keep it
- Connection credentials and sessions: expire within 24 hours.
- Monthly backup-server usage (bytes relayed per server): up to 40 days.
- Per-IP anti-abuse counters: about 1 minute.
- Server record: until you delete the server in the app or ask for removal.
- Account: as long as it exists; you may ask for deletion.
- Subscription data: while the subscription exists and for the period required by law for tax records.
- Remote panel: temporary console content disappears when the app disconnects; the device registration stays until you remove it.
- Help Center messages: as long as needed to handle and document the request.
7. International transfers
The providers above operate servers outside Brazil. By using the service your data may be processed in other countries, under the providers' own contractual safeguards and in line with the LGPD (art. 33).
8. Security
We use encrypted connections (HTTPS and network encryption), store each server's owner secret only as a hash, restrict access to credentials and apply usage limits against abuse. No system is fully secure; if an incident may affect you, we will notify you as the law requires.
9. Your rights
You may ask for: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data or data processed unlawfully; portability; information about who we share data with; deletion of data processed on the basis of consent; and withdrawal of consent. You may also complain to Brazil's data protection authority (ANPD). Use the contacts in section 1; we may ask you to confirm your identity.
10. Children and teenagers
Basic use of the app requires no personal data. Accounts, subscriptions and the remote panel are intended for people aged 18 or over; minors must use them with the participation and authorization of a legal guardian. We do not knowingly collect personal data from children beyond what is needed to operate; if you are responsible for a child and believe they sent us data, contact us so we can remove it.
11. Changes to this policy
We may update this policy. The update date is at the top; relevant changes will be highlighted in the app or on the website.