Policy
Privacy Policy
This policy explains what data SharedWorld stores, for how long, and how you can delete it.
1. Data we access
SharedWorld requests Google access through the openid,
email, and drive.appdata scopes. The
drive.appdata scope is limited to the hidden application
data area associated with the app and does not grant access to your
normal Google Drive files, documents, or photos. SharedWorld does not
request your Google profile (name or photo).
2. What we store
The SharedWorld backend stores:
- Your Minecraft player UUID and username — the identity worlds, memberships, and backups are keyed by.
- For a connected Google Drive account: an opaque Google account identifier, the account's email address, and the OAuth tokens needed for storage operations. The email and tokens are encrypted at rest, with the key held separately from the database and its backups. Your email is shown only to you — other members of your worlds never receive it.
- World and backup metadata (names, membership lists, backup indexes). World content itself lives in the world owner's Google Drive app data area, not on SharedWorld's servers.
- Short-lived session tokens, removed automatically on expiry.
We keep no request or IP logs. Diagnostic server logs are retained for at most one month; local database backups for two weeks. Data obtained through Google APIs is not used for advertising.
3. Routing and storage
When a world is synchronized, snapshot data may transit through the SharedWorld backend selected for that session before it reaches the configured storage provider and before it is delivered to authorized players. For the maintainer-operated hosted service, the backend is operated by the project maintainer. If you use a self-hosted or third-party backend, that operator's privacy practices also apply.
4. Authentication tokens
SharedWorld processes the OAuth tokens needed to complete storage operations against the Google Drive app data area. Those credentials are stored encrypted at rest and used only to provide the storage and synchronization features the user has requested.
5. Sharing with other players
SharedWorld is a multiplayer system. If you create or join a shared session, snapshot data for that world may be delivered to the specific players who are authorized to participate in that session so they can continue the world when host ownership changes.
6. Google API Services disclosure
SharedWorld's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. Data deletion and revoking access
SharedWorld's Account screen (reachable from the top-left of the Shared Worlds list in Minecraft) lets you disconnect your Google Drive account — which revokes SharedWorld's Google authorization and deletes the stored link — and delete all of your SharedWorld data: every world and backup you own, everything SharedWorld stores in your Google Drive, your account record on our servers, and the mod's local files on your computer.
Independently of the in-game controls, you can revoke SharedWorld's access from your Google Account security settings at any time, and delete the hidden application data associated with SharedWorld from Google Drive's Manage Apps settings. Revoking access invalidates the stored authorization for future sync operations.
8. Contact
Questions about SharedWorld should be directed through GitHub Issues for the public repository.