1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

A data protection officer has not been appointed as the corresponding requirements of the GDPR are not met.

2. Overview of Processing

We process data for the following purposes:

• Transmission of requested page content
• Security and stability of operations
• Display of market data
• Login and account functions
• Optional Discord linking (login and notifications)

Legal bases are contract fulfillment (Art. 6 para. 1 lit. b GDPR), legitimate interest (Art. 6para. 1 lit. f GDPR), and consent (Art. 6 para. 1 lit. a GDPR).

3. Transmission of Content

What?

For the purpose of transmitting the webpage you requested, typically the following information is sent by your browser:

• IP address: Asequence of digits that identifies your current computer connection on the internet.
• URL: The webpage you requested and possibly additional parameters.
• Browser and system information: Name and version of your browser and operating system.
• Referrer: Potentially the page from which you came to us.

Why?

To transmit the requested content to your browser.

Legal Basis?

Legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. We pursue the legitimate interest of making the content of this website available to you. Without processing this data, transmission would not be possible.

How Long?

The data is processed only temporarily for transmission and not stored permanently (see Section 4 for security logging).

4. Logging for Security Purposes

What?

The information mentioned in Section 3 is stored in log files.

Why?

To analyze possible disruptions, for security and stability of operations, and to defend against attacks.

Legal Basis?

Legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in the security and stability of our web presence.

How Long?

The data is stored for 7 days. In case of disturbances, storage may continue longer in individual cases. They will be deleted at the latest when they can no longer contribute to determining the causes.

5. Market Data

This website displays market data (prices, auctions, orders) from the HugoSMP Minecraft server.

What?

Market data with player names (who traded which items). This data is publicly visible in the Minecraft server and displayed by us.

Why?

To display price trends, market trends, and trading activity.

Legal Basis?

Legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. The data is publicly accessible in the server. Our interest is to present this data in an organized way and make it historically available.

How Long?

The data is stored for historical purposes.

6. Login and Account

What?

When logging in, the following data is processed:

• Minecraft username: For unique identification and display in the application

Why?

To verify your account and provide personalized functions (e.g. price alerts).

Legal Basis?

Contract fulfillment pursuant to Art. 6 para. 1 lit. b GDPR. Data processing is necessary to provide account functions.

How Long?

Data is stored until your account is deleted. After logout, all personal data is deleted immediately.

7. Discord Linking (Optional)

You can voluntarily link your Discord account to your Minecraft account. Linking is not required to use this website.

What?

When you link your accounts, we process the following data:

• Discord user ID: To uniquely identify your Discord account
• Discord username: To display in your profile settings
• Association: The link between your Minecraft and Discord accounts

Why?

We use the link exclusively for the following purposes:

• Login: You can sign in via Discord as an alternative
• Notifications: You can receive notifications via Discord direct messages (e.g. price alerts or marketplace notifications) if you enable them

Discord login uses the OAuth service provided by Discord, Inc. You will be redirected to Discord's website. What data Discord processes is governed by Discord's privacy policy.

Confidentiality

We do not share which Minecraft account is linked to which Discord account with other players. Other users cannot view this association.

Legal Basis?

Linking only happens at your initiative and with your consent pursuant to Art. 6 para. 1 lit. a GDPR. For login and notifications you enable, contract fulfillment pursuant to Art. 6 para. 1 lit. b GDPR applies.

Unlinking

You can unlink your Discord account at any time in your profile settings. After unlinking, we immediately delete your Discord data, the association with your Minecraft account, and any pending or previously delivered Discord notifications from our database. Pending in-game notifications are not affected. You can link again at any time.

How Long?

Discord data is stored only while the link is active, or until your account is deleted.

8. Storage Period

We store your data only as long as necessary for the respective purpose or as required by law:

• Transmission data: Only temporarily, not stored permanently
• Security logs: 7 days, possibly longer in case of disruptions
• Account data: Until account deletion
• Discord link: Until unlinking or account deletion
• Discord notifications: Until unlinking or account deletion
• Market data: Stored for historical purposes

9. Your Rights

Regarding your data, you have the following rights:

• Right of access (Art. 15 GDPR): You can request information about your data processed by us.
• Right to rectification (Art. 16 GDPR): You can request correction of incorrect data.
• Right to erasure (Art. 17 GDPR): You can request deletion of your data.
• Right to restriction (Art. 18 GDPR): You can request restriction of processing.
• Right to data portability (Art. 20 GDPR): You can request transfer of your data to you or a third party.
• Right to object (Art. 21 GDPR): You can object to processing based on legitimate interests.
• Right to withdraw (Art. 7 para. 3 GDPR): You can withdraw given consent at any time.

To exercise your rights, please contact: [email protected]

10. SSL/TLS Encryption

This website uses SSL/TLS encryption for security and to protect the transmission of confidential content. You can recognize this by the closed lock symbol in your browser's address bar and the "https://" designation in the URL.

11. Cookies and Local Storage

This website uses the following storage technologies:

• Session cookies: Only when logged in to maintain your session
• LocalStorage: For local settings like theme

Session cookies are stored without your express consent as they are essential for login. LocalStorage data stays in your browser and is not transmitted to us.

12. External Services

We use the following external services. Some are called directly by your browser (in which case the provider sees your IP address). Others are called only from our server. Legal bases are contract performance (Art. 6 para. 1 lit. b GDPR), consent (Art. 6 para. 1 lit. a GDPR) or legitimate interest (Art. 6 para. 1 lit. f GDPR), depending on the purpose. Some providers are located outside the EU (in particular in the USA). Their privacy policies apply.

Discord

Optional login, optional direct-message notifications, and links to our Discord servers. Provider: Discord, Inc. (USA). Details are in section 7. Privacy policy: discord.com/privacy.

Minotar

Player avatars are loaded from minotar.net. Your browser sends your IP address and the Minecraft name or UUID. We use this to show heads on profiles and lists.

Mojang / Microsoft

To resolve Minecraft names and UUIDs we call api.mojang.com and sessionserver.mojang.com from our server. We send the player name or UUID, not your IP address. Privacy policy: privacy.microsoft.com.

mcprofile.io

Additional server-side lookup of Java and Bedrock profiles (name, UUID, gamertag). Your IP address is not sent to mcprofile.io.

GeyserMC

For Bedrock players we call api.geysermc.org from our server to map UUID and gamertag. Your IP address is not sent to GeyserMC.

HugoGuard

Trust status and scam reports on the marketplace. We call api.hugoguard.net from our server and send the Minecraft name or UUID plus reports you submit. Links may lead to hugoguard.net. hugoguard.net.

GitHub

For schematic 3D previews your browser loads block textures from raw.githubusercontent.com (misode/mcmeta). GitHub then sees your IP address. Privacy policy: docs.github.com/privacy.

unpkg

The embedded schematic viewer loads JavaScript from unpkg.com (deepslate, gl-matrix). Your browser sends your IP address. npm privacy policy: npmjs.com/policies/privacy.

Ko-fi

The Ko-fi link (ko-fi.com/hugomarket) takes you off this website. Ko-fi and its payment providers process payment data under their own responsibility. This website itself does not collect payment data. Privacy policy: more.ko-fi.com/privacy.

13. Changes

We reserve the right to change this privacy policy. The current version can always be found on this page.

Version: September 24, 2026