Amaryn Pulse Privacy Policy

1. Who we are

Amaryn Pulse is a monitoring service for Minecraft servers. It consists of the Amaryn Pulse iOS app, the Amaryn Pulse server plugin, and the backend at pulse.amaryn.app. This policy covers all three.

The controller responsible for your data is:

Jelle Meinesz, trading as Amaryn
Chamber of Commerce (KvK) number: 42138186
Box C0984, Oder 20, 2491 DC Den Haag, the Netherlands
Privacy questions: [email protected]
General support: [email protected]

We built Amaryn Pulse so that we cannot identify you. We do not ask for your name, email address, phone number or location. The sections below list exactly what we do process.

2. What data we process

We process the following data, and nothing else.

We treat server addresses as personal data, because a hostname or IP address can sometimes be traced back to the person who runs the server.

What we never collect: your name, email address, postal address, phone number, location, date of birth or payment details. Apple handles all payments, so we never see your card details. We do not store your IP address; we use it only briefly to limit abuse of our service. We do not collect behavioural or usage analytics.

3. The Amaryn Pulse plugin

The plugin sends data from your Minecraft server to pulse.amaryn.app. It registers the server and starts sending metrics as soon as it starts. Nobody can see that data until someone links the server to an account with a pairing code (/pulse follow). A server that nobody links within 7 days is deleted automatically, together with its data.

The plugin sends performance metrics every 30 seconds by default. These include player count, TPS, MSPT, memory, CPU, disk space, chunk and entity counts per world, uptime, restart and crash detection, and the server software and version.

• Player names and UUIDs from your server are never stored. The live player list can be shown in the app, but it is never written to our database or logs. Next to each name the list can show the group the server owner assigned (such as "admin") and, on a network, which of its servers the player is on; these are handled the same way. We keep only aggregate counts. The server owner can turn the live list off with send_player_list: false.
• Watchlists are checked inside the plugin. If you add a player name to a watchlist in the app, we store that name as one of your settings and send it to the plugin. The plugin checks it locally and sends back only an event with that name when it matches, never a player list.
• Server logs are never sent. The plugin only sends a count of error lines per interval, never their contents.

Run /pulse unlink at any time to stop the plugin from sending data and delete that server's data from our service.

4. Why we process it, and on what legal basis

We process your data only to provide the monitoring service: signing you in, showing your servers' status and history, sending your alerts and managing your subscription.

The legal basis is the performance of our agreement with you (Article 6(1)(b) of the GDPR). We do not use your data for marketing, profiling or advertising, and we do not sell it.

5. Who receives your data

We use a small number of service providers. Each one processes data only on our instructions, under a data processing agreement.

We store your data in the EU. Cloudflare may process IP addresses outside the EU. For those transfers we rely on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses in Cloudflare's data processing agreement.

We never share your data with anyone else, unless the law requires us to.

6. How long we keep it

Server data belongs to the server, not to a user account. A plugin server's name, address and metrics are kept for as long as the plugin is linked, and are deleted within an hour of the server being unlinked with /pulse unlink, or of you removing a server you added by address. While the server stays linked, older metrics are still removed on the schedule above. Encrypted backups are overwritten in the normal backup cycle, within 30 days.

7. No tracking, and how we protect your data

The app contains no analytics, advertising or tracking software. We do not use cookies or tracking pixels. We do not track you across other apps or websites, so the app never asks for tracking permission. For login, the app stores a session token and a random device identifier in the iOS Keychain. The device identifier only helps us detect a stolen session.

We protect your data with:

• Encryption in transit (TLS) for all connections
• Hashed server tokens, so a stolen database cannot be used to impersonate your plugin
• Restricted access to our systems
• Encrypted backups
• Logs that never contain your Apple identifier, push tokens, server addresses or player names

8. Your rights

You can delete your account in the app at any time, under Settings, Delete account. This immediately deletes your account and everything tied to it, including your push tokens, subscription status, settings, the servers you added by address and the link between your account and your plugin servers. Server data is not tied to your account: to stop a server from sending data and delete its data, run /pulse unlink on that server. You do not need to email us.

Under the GDPR you also have the right to:

• Access the data we hold about you
• Have incorrect data corrected
• Have your data deleted
• Restrict or object to processing
• Receive your data in a portable format

To use any of these rights, email [email protected]. Because we hold no name or email address, we may ask you to confirm the request from inside the app so we know it is your account. We respond within one month.

You also have the right to file a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens, or with the authority in your own EU country. We would appreciate the chance to resolve your concern first.

9. Other things you should know

Children. Amaryn Pulse is meant for people aged 16 and over. Younger users need permission from a parent or guardian. We do not ask for anyone's age, and we collect nothing that could be used to profile a child.

Data breaches. If a breach affects your data, we report it to the Autoriteit Persoonsgegevens within 72 hours where the law requires it. We also inform affected users through the app when there is a high risk to them.

California residents. We do not sell or share personal information as defined by the CCPA. Because we do not track users across sites or apps, we do not respond differently to Do Not Track signals. You can use the rights in section 8 regardless of where you live.

Changes to this policy. If we change this policy, we update the date below and announce significant changes in the app before they take effect. Earlier versions are available on request.