Privacy Policy
Last updated: July 2026 — v2.1
Aquarium SMP — Comunidad — Bogotá, Colombia — [email protected] — DPO: [email protected] — Discord
0. Data Controller (Law 1581 of 2012)
Controller: Aquarium SMP — Community, a player community project with no separate legal entity (not a company). Address: Bogotá, Colombia — Email: [email protected] — Privacy: [email protected] — Alt: official Discord (admin ticket). Under Law 1581 of 2012, the data controller may be a non-profit collective identified by its contact channels — no tax ID is required.
1. Information We Collect
We collect only what is necessary: - Account: Minecraft username, UUID, displayName, email, bcrypt password hash, avatarUrl. - Application (/unete): email (required — used to notify you and, if accepted, to create your account), age, country, availability, experience, branch answers (redstoner/builder/grinder/knowledgeable), links, Discord (optional), IP & user-agent on submit. - Usage: IP (activity log & rate-limit), session/access cookies, litematics/projects/historia you publish (titles, descriptions, .litematic files, WebP images, block metadata). - Support: messages via Discord webhook or email when you request access/codes. No special-category data (art. 5 Law 1581, e.g. health, sexual orientation, ethnicity) and no automated profiling.
2. Purposes
We use your data to: - Provide the service (accounts, applications, member voting, uploading/viewing litematics/projects/historia). - Security: authentication, abuse prevention, rate limiting and append-only activity logging. - Communications: transactional email (Resend, only if RESEND_API_KEY enabled) and Discord webhook notices on applications/projects. - Legal compliance and auditing. We do not sell data or share it beyond processors listed in §8. No advertising or cross-site tracking.
3. Cookies and Similar Technologies
Only essential and one preference cookie. No advertising or tracking. Legal basis: legitimate interest for session/security and technical cookies exception (Law 1581). You can reject/configure non-essential; site still works. Detail in §7.
4. Retention Periods
We keep each category only as long as necessary: - Accounts & profiles: while active + 12 months after deletion (claims & logs); deleted on request. - Rejected/withdrawn applications: 12 months (claims defence & 30-day cooldown); accepted ones linked to account. - Activity logs: append-only, 12 months min (security) up to 24 months unless law requires longer. - Password reset tokens: 10 minutes (auto-expire, max 3 OTP attempts). - Sessions: until JWT expiry or logout/password-change invalidation. - Uploaded files (R2): until you delete the content or account. - Cookies: per durations in §7. After periods, deletion or anonymisation.
5. Security
Technical and organisational measures (Law 1581, Decree 1377): - Passwords bcrypt cost 12 + invalidation of all sessions on password change. - JWT sessions (aq-session) validated against member_sessions; admin HMAC timingSafeEqual; CSRF via Origin==Host. - Cookies httpOnly, Secure, SameSite=Lax, 7 days (session) / 24h (admin) / 7 days (aq-known). - Headers: CSP, HSTS, X-Frame-Options, rate limit. - R2 random keys + validation; escapeHtml; zod. We notify breaches to the SIC and to data subjects when high risk.
6. Your Rights (Law 1581 of 2012)
Rights to know, update, rectify, delete, revoke authorisation and file complaints (arts. 8 and 15 Law 1581). How to exercise: email [email protected] or [email protected] with subject 'Habeas Data Rights', stating right and affected account; ID copy if needed. We reply within 10 business days (consultations) or 15 business days (claims), extendable per Decree 1377. Complaint: you may complain to the Superintendence of Industry and Commerce (SIC) — www.sic.gov.co.
7. Specific Cookies Used
Current table (audited): • aq-session — Member session. Signed JWT (jose) validated against member_sessions. httpOnly, Secure, SameSite=Lax. 7 days. Essential (auth). No login without it. • aq-admin-token — Admin session. HMAC base64.hex. httpOnly, Secure, SameSite=Lax. 24 hours. Essential admin panel. • aq-known — Protected litematics access. HMAC. httpOnly, Secure, SameSite=Lax. 7 days. Essential access control. • NEXT_LOCALE — Language preference (es/en). Not httpOnly. 1 year. Preference (rejectable). • aq-cookie-consent — Banner preference (localStorage, not HTTP cookie). Persistent until you change settings. Preference. No third-party, analytics, advertising or fingerprinting cookies. You can configure/reject NEXT_LOCALE and aq-cookie-consent without losing essential access.
8. Processors and International Transfers
Processors (art. 25 Decree 1377 — transmission contracts): - Cloudflare R2 (file storage) — US. - Resend (transactional email) — US — only if RESEND_API_KEY enabled. - Hosting/DB: VPS/Postgres provider (default Colombia/US). - Discord webhooks — US. No transfers beyond processors. If transferred to country without adequacy, it is backed by data subject authorisation and art. 26 Law 1581 measures.
9. Legal Basis (Law 1581)
Mapping by purpose (art. 9 Law 1581 — prior authorisation): - Registration/login and service provision: authorisation upon creating account/applying + pre-contractual relationship. - Essential cookies, security logs, rate limiting: legitimate interest and service security. - Language & banner preference: authorisation via banner consent (revocable). - Application data (/unete with checkbox): express authorisation. - Transactional emails: legal duty and authorised purposes. You may revoke authorisation at any time (art. 8 Law 1581) without retroactive effect; revoking before decision means we cannot evaluate it.
10. Minors
Service for 14+ (art. 12 Law 1581). If 14-17, you need parent/guardian authorisation. We do not knowingly collect data from under-14s; if detected, we delete the account. Parents/guardians: [email protected].
11. DPO and Complaints
Privacy: [email protected] (reply within 10-15 business days by type). Controller: [email protected]. Complaints: you may complain to the SIC — www.sic.gov.co — and bring action before Bogotá courts (see Terms §11).
12. Changes and Contact
We update this policy if purposes, processors or retention change; we publish the new version dated and, for material changes, notify via banner/email 15 days in advance. Contact: [email protected] / [email protected]. Prior version available on request.