What MineSpecs collects and keeps

When a page opens, your browser sends a small beacon to the site’s own server (a Cloudflare worker). The beacon holds the page’s path, the address you came from, and whether this is the first page of a visit that arrived from another site. Each record keeps:

• the page path;
• the referring site's host name only (for example google.com), never the full address;
• your country, as Cloudflare works it out from your IP address;
• device type (desktop, mobile or tablet), browser family and operating-system family, read from your browser's user-agent — the full user-agent string is not stored;
• the time;
• a visitor ID (explained below);
• whether it was an entrance (the first page of a visit from outside the site).

The visitor ID. The server makes it by running your IP address and user-agent, together with a value that changes every UTC day, through a one-way hash. All your page views on one day share it, and the next day you get an unrelated one, so visits on different days can’t be linked to each other. The IP address and user-agent themselves are not written down.

Events. Some actions are counted as short labels that ride along with the next page view instead of being sent on their own: a file download (the file’s name), a click on a link to another site (that site’s host name only), a copy button (what kind of thing was copied, never the text), and a site search that found nothing (the search words, cut to 48 characters). If any are still waiting when you close the tab, one last beacon carries them.

“Live now.” A separate record of the page you’re on, your country and device type, under the same daily ID, powers the operator’s live-visitor count. It expires after 5 minutes.

Visits from crawlers that identify themselves as bots are not recorded. The admin dashboard itself is not tracked.

The first time you play the word game, the server creates an anonymous player for you and your browser keeps its key (_ms_player, below). The server stores:

• a random player ID, and a one-way hash of the secret half of your key (the secret itself is not stored);
• your player name: a generated one such as "Silly Seal", or one you choose (up to 16 characters, checked by the same filter as leaderboard names);
• the word you're playing, if any: the word, your guesses so far and when you opened it, so the server can check every guess. Once the word is over, only your stats keep it;
• for each mode (Mix, Minecraft and General): your stats (games played, wins, current and best streak, guesses per win) and this week's counted scores, your best 25 words;
• the words you've already had, per list, so they don't come round again too soon, and how many words you started in the last minute, hour and day, for the limits below;
• for a challenge link: its mode, the words or game seed, who made it, who joined, each player's result and the word they're playing.

Opening a new word, or starting a game in the arcade, gets your browser a short note signed by the server: which mode or game, when it started and, in the arcade, a random number for that one game. Nothing is stored for it. When the note comes back with your first guess or your score, the server checks the signature, so it knows when the game really started. The signing key is a random value kept in the game database.

No address, email, IP address or device details are stored with any of it. To limit how many new players one network can create, the server also keeps a one-way hash of your network address combined with a value that changes every UTC day, and the time, for 2 days.

Clearing this site’s data in your browser forgets your player there; the server-side record is then deleted after 365 days without play, or sooner if you ask (below).

• Page-view and event records: 90 days, then deleted automatically.
• “Live now” record: 5 minutes.
• Daily totals (counts per page, referring site, country, device, browser, system, hour, event and landing page): 400 days. They are counts only and contain no visitor IDs.
• Leaderboard entries: kept while they stay in their game’s top 100 — an entry pushed out by higher scores is dropped. Oredle’s daily boards are deleted after 120 days.
• Skin submissions waiting for review: deleted on approval or rejection, and after 30 days at most.
• Per-day skin submission counters: 26 hours.
• Word-game players, with their stats, streaks and weekly scores: deleted after 365 days without play. A week’s scores are replaced by the next week’s.
• Word-game results shown in the activity pop-ups: 7 days.
• Challenge links and their results: 14 days from when the link was made.
• New-player counters per network: 2 days.
• Approved skins: kept until removed.
• Abuse counters (below): no more than 2 days, in Cloudflare’s cache rather than the database.

To stop scripts flooding the site, the server counts requests per network address: page-view beacons and skin submissions per day, arcade game starts and score submissions per minute (set high, since many people can share one address) and wrong admin-key attempts per ten minutes. Each arcade game can post its score at most three times, counted under that game’s random number. Each counter holds only a one-way hash of the address or number (for IPv6, of its first half, the network part) and a count. A counter exists only once a request of that kind has been made.

The word game’s limits are per player, not per address: how many words you start (counted on your player record), how fast you guess, how often you rename and make challenge links, and how many words that aren’t in the list you try (a short-lived counter in Cloudflare’s cache, under your player ID). Only the number of new players is also limited per network, generously. Solves faster than a person could type don’t count towards scores, streaks or the boards; your stats only note how many there were.

Leaderboards. Submitting a score stores the name you type (up to 16 characters), the score, the time and that game’s random number (so one game holds one place on the board) — nothing else, no address. The name and score appear on the game’s leaderboard and can appear in the activity ticker shown across the site. Names pass an automatic filter every time they are shown, and a blocked name shows as “Anon”. Please don’t use your real name.

The word game. Your player name appears on each mode’s weekly-points and best-streak boards, and a word solved in one or two guesses or a streak milestone can appear in the activity pop-ups. Anyone with a challenge link can see the names, scores and per-word results of everyone who joined it. Challenge pages are kept out of search engines. Your guesses are never shown to anyone else.

Skins. A skin you submit is stored with its name, the credit name you give (optional, up to 16 characters), the arm model and the time. Only the image data is kept from the file — text and other embedded data are stripped. While it waits for review the entry also holds a one-way hash of your network address, used only to limit each address to three skins in the queue; that hash is not kept when the skin is approved. A moderator reviews every submission by hand. Once approved, the skin is public, anyone can download it, and your credit name is shown with it.

These live in your browser’s storage, and the server never reads them. Three leave the browser only in the ways already described: queued events go out with a page view, your leaderboard name is sent when you submit a score, and your word-game key is sent with each word-game request. Clearing this site’s data removes them all.

Ads on MineSpecs are served by WeForAds and the advertising companies it works with. The companies allowed to sell ad space on this site are listed in its ads.txt file, which WeForAds keeps up to date.

The ad code loads from WeForAds’ servers when you first scroll, tap, click or press a key on a page, or 3 seconds after the page starts loading, whichever comes first. Your browser then connects to WeForAds and its partners, which receive your IP address, details of your browser and device, and the address of the page. They may set and read cookies and similar identifiers (such as browser storage and your device’s advertising ID) to choose which ads to show, limit how often you see the same one, measure how ads perform and detect fraud, and they may show ads based on your interests, worked out from your activity on other sites. They handle that data under their own policies: see WeForAds’ privacy policy. MineSpecs’ own code still sets no cookies and never receives those identifiers.

Some pages carry no ads at all: the arcade at /play/ and every game in it, this page, the terms, about and contact pages, error pages, and pages kept out of search engines.

Turning off personalised ads. You will still see ads, but they won’t be chosen from what you do on other sites:

• Google’s ads: switch off personalised ads in My Ad Center.
• Many other ad companies at once: the opt-out pages of the Network Advertising Initiative and the Digital Advertising Alliance, or, in Europe, Your Online Choices.
• Your browser: block or clear third-party cookies in its settings. On a phone, you can reset or limit your device's advertising ID in its privacy settings.

These choices apply to the browser or device you make them on, and clearing your cookies can undo the ones stored as cookies. The analytics switch at the bottom of this page covers MineSpecs’ own analytics only, not ads.

• WeForAds and its advertising partners serve the ads, as described under Advertising.
• Cloudflare hosts the site and runs its server code, so it handles every request, including your IP address. Its own handling is described in Cloudflare’s privacy policy.
• Modrinth. Some catalogue pages show cover images loaded straight from Modrinth’s image server (cdn.modrinth.com). Your browser then connects to Modrinth, which receives your IP address and, under this site’s referrer policy, only the site’s address rather than the page you were on. See Modrinth’s privacy policy.
• Fonts are served from this site, not from a font provider.
• Links to Discord, Modrinth and other sites take you to those sites, whose own policies apply once you're there.

MineSpecs is a general-audience site about Minecraft. It is not directed at children under 13, and we don’t knowingly collect personal information from them. The arcade and its games carry no ads. No part of the site asks for an email address, and the names on leaderboards and in the word game are nicknames: please don’t use a real name. If you believe a child under 13 has given us personal information, contact us (below) and we’ll remove it.

Because there are no accounts and no stored addresses, analytics records can’t be looked up by person. Public things can: to have a leaderboard name, a word-game player or a skin you submitted removed, or to ask anything about this page, contact us on Discord and say which game or skin, and where it appears. See also the contact page.

This stops your browser sending page views and events. It doesn’t affect anything else on the site, ads included: for those, see Advertising. Browsers that send a Global Privacy Control signal are treated as opted out without doing anything here.