Privacy Policy

1. Who we are and what this policy covers

This policy covers two informational websites: the Exylia hub at hub.exylia.net, which presents Exylia and links to its services, and the documentation at docs.exylia.net, which documents Exylia's Minecraft plugins (together, the "Sites"). They are operated by Cristobal Aranda, a natural person domiciled in Chile ("we", "us"), who is the controller of the personal data described here. Contact: [email protected].

Each Exylia service that you sign in to or install (for example Analytics, Staff, Tickets, Licenses, Stats, Link, Hosting, Practice, Seller, Skins or Utils) has its own privacy policy, listed at https://hub.exylia.net/en/legal. Pages of the documentation that describe what a plugin collects (such as the ExyliaAnalytics data page) explain that plugin, not the Sites.

2. What data we process

You can read the Sites without telling us who you are. We do not offer accounts, comments, newsletters or contact forms on them, and we do not use advertising or advertising profiles. We process only:

• Technical data: to deliver each page, our network provider and our servers process your IP address, your browser's user agent, the address you requested and the page that linked to it. The documentation's web server records these in its access log for pages and search indexes; the hub's server does not keep a request log.
• Your language choice: the hub remembers the language you pick in a cookie, and the documentation in your browser's local storage (see section 4).
• Your cookie choice: whether you accepted or rejected analytics (see section 4).
• Usage data, only if you accept analytics: the pages you visit (their address path and title), the page that linked to you, your device, browser and operating system, your screen size, an approximate location that Google and Microsoft derive from your IP address, and your clicks and scrolling, including Microsoft Clarity session recordings and heatmaps of how the pages are used. The Sites show no personal data, so their recordings are not masked.
• Communications: if you write to us by email, your address, your message and our replies.

The documentation's search runs entirely in your browser: the Site downloads a search index and filters it on your device, so what you type is never sent to us or to anyone else. Buttons that copy code or AI prompts only write to your clipboard.

3. Why we use the data and on what legal basis

• To deliver the Sites and keep them secure and working: serving pages, protecting against attacks and abuse, and diagnosing errors. Basis: our legitimate interest in running secure websites (GDPR art. 6.1.f).
• To show the Sites in the language you chose. Basis: our legitimate interest in giving you the version you asked for; the cookie or storage entry is set only when you choose a language (and, on the hub, it is strictly necessary for that choice to persist).
• To measure and improve the Sites with usage analytics and session recordings (Google Analytics and Microsoft Clarity): which pages are read, where people come from and what fails or confuses them. Basis: your consent (GDPR art. 6.1.a), given in the cookie banner and withdrawable at any time; in Chile, your consent under Law 19.628 and Law 21.719. Without it, no analytics runs.
• To answer you when you write to us. Basis: legitimate interest, or the steps you request before a contract (GDPR art. 6.1.b).
• To comply with legal obligations and lawful requests from authorities. Basis: legal obligation (GDPR art. 6.1.c).

In Chile we process data only as Law 19.628 allows and, once in force, under the legal bases of Law 21.719, in particular legitimate interest, your consent for analytics and the handling of your own requests. We make no automated decisions about you.

4. Cookies and local storage

The Sites use no advertising cookies. On your first visit a banner asks whether you accept analytics cookies; Accept and Reject are equally easy, and nothing optional is stored before you choose. The Sites store:

• exylia_consent (.exylia.net, shared by every Exylia site): your cookie choice, granted or denied. 180 days. Strictly necessary.
• NEXT_LOCALE (hub.exylia.net): the language you chose. 1 year. Preference. The hub also reads an older cookie named exy-lang if your browser still has one, but no longer sets it.
• exylia-docs-lang (docs.exylia.net, local storage): the language you chose. Kept until you clear your browser's storage; it never leaves your device.

Only if you accept analytics: _ga and _ga_<id> (Google Analytics, 2 years); _clck (1 year) and _clsk (1 day) from Microsoft Clarity; and CLID and MUID (1 year), which Microsoft sets on its own domains. Google Analytics runs with every advertising feature off (no Google Signals, ad storage and ad personalisation denied) and Clarity with ad storage denied.

To withdraw your consent, use the "Cookies" or "Cookie settings" link in the footer and choose Reject: the Site deletes the analytics cookies it can reach and reloads, and the choice applies to every Exylia site. The Exylia Cookie Policy at https://hub.exylia.net/en/legal/cookies describes these cookies and the shared consent in full.

5. Who receives the data

The Sites run on our own servers, which also host the images they show (s3.exylia.net). Fonts are served from our servers too, so loading a page sends no request to a font provider. We share personal data only with:

• Cloudflare, Inc. (United States; global network): DNS, TLS and network protection. All traffic to the Sites passes through Cloudflare, which processes technical data under its own data protection terms.
• Google LLC (United States): Google Analytics, only if you accept analytics. It receives the usage data in section 2 and processes it on our behalf.
• Microsoft Corporation (United States): Microsoft Clarity, only if you accept analytics. It receives the usage data in section 2, including session recordings, and processes it under the Microsoft Clarity terms and the Microsoft Privacy Statement.
• Authorities, when required by law or by a court or competent authority, or to defend our legal rights.

The Sites link to other websites, such as BuiltByBit, Modrinth, GitHub and Discord. When you follow a link, the other site's privacy policy applies to what it collects.

6. How long we keep data

• Access logs of the documentation's web server: kept by our hosting platform only for a limited time for security and diagnostics, and then overwritten as the logs rotate. We do not combine them with any other data.
• Technical data processed by Cloudflare: according to Cloudflare's own retention terms.
• Usage analytics: Google Analytics keeps event data for 14 months (the period set in our account) and Microsoft Clarity keeps recordings for 30 days.
• Your cookie choice: the exylia_consent cookie expires after 180 days, and the banner then asks again.
• Your language choice: the cookie expires after 1 year; the local storage entry stays until you clear it. You can delete either at any time from your browser.
• Emails with us: as long as needed to handle the matter and for up to 2 years afterwards, unless the law requires longer.

7. International transfers

Our servers are in Chile, Cloudflare operates a global network from the United States, and, if you accept analytics, Google and Microsoft process usage data in the United States. Google LLC and Microsoft Corporation are certified under the EU-U.S. Data Privacy Framework. When data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on our providers' safeguards, such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

8. Security

All traffic to the Sites is encrypted with HTTPS/TLS. The documentation is a set of static files with no database behind it, and neither Site stores personal data in a database of ours. No system is completely secure; if a personal data breach occurs, we will notify the competent authority and affected people where the law requires it.

9. Your rights

Depending on where you live, you have the right to access your data, rectify it, erase it, restrict or object to its processing, receive it in a portable format and withdraw any consent you gave, without affecting earlier processing. In Chile, Law 19.628 grants the rights of access, rectification, cancellation and blocking, and from Law 21.719 taking effect also objection, portability and the right not to be subject to automated decisions.

To exercise them, write to [email protected]. As the Sites do not know who you are, we may need details (such as the date, time and IP address of a visit) to find any data about you. We will answer without undue delay and within the time the applicable law allows (under the GDPR, one month, extendable where necessary).

You can complain to a data protection authority: in the European Union, the authority of your country of residence or work; in Chile, the Personal Data Protection Agency created by Law 21.719 once it is operating, or the courts under Law 19.628. We would appreciate the chance to resolve your concern first.

10. Minors

Anyone can read the Sites, including minors, and since they collect no data beyond what is described above, they do not ask for or record anyone's age. We do not knowingly collect other personal data from minors; if you believe a minor has sent us personal data by email, write to us and we will delete it.

11. Changes and contact

We will update this policy when the Sites or the law change, and show the date of the latest version at the top. If we ever add anything that collects more data, such as a contact form, we will update this policy before it goes live.

Questions or requests: [email protected].