Privacy

What gets hidden

Before your log is uploaded, minelog replaces IP addresses, MAC addresses, user folder names, access tokens, passwords, webhook links and email addresses. The switch next to Get link turns this on and off. With it off, the log is saved exactly as you pasted it, and it's deleted after 48 hours instead of 120 days.

It happens twice: once in your browser, so the preview shows what will be saved, and again on our server before anything is stored. Skipping the browser step doesn't get around it.

Two things it doesn't cover. Player names stay in on purpose, since you need them to debug. It also can't know what a secret of your own looks like, so read the preview before you share.

What we store

Each log is saved with its text, the type we detected, its line count, error and warning counts, whether hiding was on, when it expires, and which app uploaded it if the app said so. If hiding was off, the log page says so.

To limit uploads we keep a keyed hash of your IP address, and you can save 70 logs a minute and 300 a day. We never store the address itself.

Each server also keeps a memory-only count of how often each kind of finding appears, so we can see which errors still need their own rule. It holds no log text and no addresses, and it disappears whenever the server restarts.

Every log is deleted 120 days after it's saved, and its link stops working. If hiding was off, the log is deleted after 48 hours instead.

The person who saves a log can delete it themselves during the first hour. To make that possible, saving hands your browser a secret delete token, and we keep only a hash of it, never the token. It stays in your browser storage for that hour and is not sent anywhere else.

If you sign in

You never need an account to share a log. Signing in with GitHub or Discord is optional, and it only unlocks the dashboard.

When you sign in, we keep the name, email address and profile picture link that GitHub or Discord hand over. You can change the display name later, and names go through the same content filter as logs. We don't keep the access tokens they issue, and we never post or read anything on your behalf. A session cookie keeps you signed in on this browser. It's only set after you sign in.

Logs you save from the website while you're signed in are linked to your account, so they show up in your dashboard. Logs you saved while signed out aren't linked and can't be added later. If you use alerts, we keep the key for each server you connect (only a scrambled copy, so we can't read it back), the server software and version it reports, and the webhooks you add. A webhook address is encrypted before it's saved, because anyone who has it can post to your channel. When your server reports something, we pass it on to your webhooks and keep only whether the last delivery worked. We don't keep the events themselves. When a connected server finds an error in its log, it can send the log lines around it to your account as an alert. Alert text is encrypted before it's saved, hidden the same way as any log, and only you can open it. The same error on the same server is saved once with a counter, we keep your latest 100, and each alert is deleted 14 days after it last happened. You can also save a log as private. A private log gets a /p/ address that only works while you're signed in to the account that saved it, so having the link isn't enough. It never appears on the public pages or in the public API. You can delete any of your logs from the dashboard whenever you want, with no one-hour limit. If you delete your account, your profile, connected accounts, servers, webhooks and every log saved to it are deleted right away. Otherwise a linked log is deleted on its normal schedule, and the link between you and it goes away with it.

What we don't collect

A log page sets no cookies and loads nothing from anyone else: your browser only talks to minelog. Fonts and brand marks ship inside our own pages (the marks come from the Simple Icons set, bundled at build time), so no icon service ever sees your visit. Log addresses are never sent to any analytics service.

The home page, the guides, the API docs and this page do use Google Analytics, to count visits and see which pages people read. Google Analytics sets cookies on those pages. It sees the page, roughly where you are and your device type, and never anything from a log. It doesn't run at all for visitors in the European Union, the wider European Economic Area, the United Kingdom or Switzerland, because it would need your consent first. We work out where you are from your connection when the page loads, and we don't store it.

The other exception is the Ask AI button. When you click it, it opens Claude or ChatGPT with the error lines from your log in the question. Nothing is sent unless you click.

Who can see a log

Every log gets a random 9-character link that nobody can guess. There's no password, so anyone with the link can read the log and its raw text. Only share it with people you trust.

If you share a log by mistake, you can delete it yourself in the first hour, from the button at the bottom of its page. That button only shows in the browser that saved the log. After that hour the log stays readable until it expires, so check the preview first.

README pages show the pictures the README points to, loaded through the wsrv.nl image cache instead of straight from each site that hosts them. That means wsrv.nl can see your IP address when you open such a page, and not the sites themselves. They keep request logs for 7 days on servers in the EU and cached pictures for a while after that. The sites that host the pictures only ever see wsrv.nl fetching them, never you. minelog checks the pictures in your browser and removes any that look like adult content. Nothing is sent to us or to anyone else for that. It can only check pictures the cache can read, and no check is perfect.

Who runs minelog

minelog is run by LogicByte Studios. If you want to know what we hold about you, have it corrected or deleted, or object to how it's used, write to report@minelog.org. Signed-in users can already download a copy of their data, sign out devices they no longer use, and delete their logs and account in the dashboard.

We only keep what this page describes, and we don't sell it or use it for ads. If you live somewhere with rules about personal data, like the EU, the UK or California, you have the rights those rules give you, and we'll honour them wherever you are.