1. Controller & Scope
This Privacy Policy applies to all Chaos Dev services. It explains what personal data is processed by the related systems we operate, all under the same responsible party:
- The Website:
chaosdev.devand its subdomains: the overview page, the bot dashboard (bot.chaosdev.dev) with its login system, and the public pages you're reading now. - The Bot: the Chaos Dev Discord Bot and its features (XP, suggestions, support forums, anti-raid protection, release tracking, etc.).
- The Patcher: the Actions & Stuff RTX Patcher desktop application and its optional, opt-in diagnostics feature.
- The Minecraft servers: the game servers we host, such as
mc.chaosdev.dev. - E-mail: messages you send to us, e.g. to
[email protected]. We use them only to answer you.
The data controller responsible for all of them (Art. 4(7) GDPR) operates Chaos Dev as a private, non-commercial project in personal capacity, not a company. Full identity and contact details, including the postal address required under German law (§5 TMG), are listed in our Impressum.
2. Website Data
The overview page and these legal pages need no login and set no cookies. The dashboard only processes data connected to an account you actively choose to log into with Discord:
- Login (Discord OAuth2): When you sign in, Discord provides us your Discord user ID, username, avatar hash, and the list of servers/roles needed to show you the servers you can manage. We request only the minimum OAuth2 scopes needed for this (
identify,guilds); we never see your Discord password, email, or messages through this login. - Session data: A server-side session record (who you are, created at login) is kept in our session store so you stay logged in between page loads. The cookie in your browser holds only a random session ID, no personal data by itself (see Section 8, Cookies).
- Dashboard preferences: Which server and tab you last viewed is saved against your Discord user ID, purely so the dashboard reopens where you left off. This is a convenience feature, not usage tracking.
- IP addresses: Like virtually any website, every request necessarily passes through and is briefly seen by our own web server and by Cloudflare, which delivers our websites (IP address, timestamp, requested page; see Section 7). We additionally, and only for security, keep a short-lived automated count of suspicious requests per IP address (see Section 9). This is a basic function of operating a server, not something we can turn off while still being reachable.
Legal basis: processing your login and preferences is necessary to provide the dashboard functionality you actively request by signing in (Art. 6(1)(b) GDPR, by analogy, as this is a free service rather than a paid contract). Security-related IP processing rests on our legitimate interest in keeping the service available and free of abuse (Art. 6(1)(f) GDPR).
3. Bot Data
The Bot stores the minimum data needed to run the features a server's administrators choose to configure:
- Server configuration: Discord Server (Guild) IDs and the channel/role IDs administrators configure (XP settings, suggestion boards, forum support channels, sticky messages, reaction roles, release-tracking subscriptions, etc.).
- XP & leveling: Your Discord user ID plus an XP count and level, per server, used for leaderboards and automatic level roles.
- Suggestions & support: Discord user IDs tied to suggestions you submit or support threads you open, so we can show authorship and route responses back to you.
- Anti-raid / honeypot protection: Per-server strike counts tied to a user ID for members who trigger our automated raid/spam defenses, plus a self-built list of SHA-256 and perceptual (visual-similarity) hashes of known raid/spam images. This image-hash list identifies repeat offending images, not people directly. The hash cannot be turned back into the original image, and matching it doesn't require knowing who posted it.
- Temporary bans & verification: Short-lived records (user ID, server ID, expiry) for time-limited bans and anti-bot verification challenges, which expire and are cleaned up automatically.
- Role snapshots: A backup of which roles a member held (role ID/name, user ID, timestamp), so roles can be restored if needed (e.g. after a rejoin).
- Bug reports submitted through Discord: Your Discord user ID and Discord tag, linked to a support case. If you additionally use the Patcher and choose to attach its diagnostic data to the same report, see Section 6 below: that is the one place Bot data and Patcher data can become linked.
Legal basis: operating the specific features a server's administrators have opted into is necessary to provide the service you or your server request (Art. 6(1)(b) GDPR, by analogy); anti-raid/anti-spam processing rests on our legitimate interest, and that of the server community, in preventing abuse (Art. 6(1)(f) GDPR).
4. Patcher Data & Anonymization
The Actions & Stuff RTX Patcher includes an optional, opt-in only diagnostics feature, entirely separate from your Discord identity unless you choose to link them yourself (Section 6). Nothing is ever sent without your explicit consent, and you can withdraw that consent at any time in the Patcher's Settings tab.
- Random install ID: A random UUID (version 4) generated locally on first launch and stored on your device. It is not derived from any hardware or personal identifier, and by itself identifies nothing about you or your PC.
- Anonymized hardware fingerprint (hashing): So we can recognize "this is the same physical PC as before" across reinstalls, without which the same computer could be miscounted as several different machines in our hardware statistics, the Patcher takes the Windows-generated
MachineGuidon your device and computes a one-way SHA-256 cryptographic hash of it locally, before anything is sent. Only this hash is ever transmitted; the raw MachineGuid itself never leaves your computer and cannot be recovered from the hash. A cryptographic hash is a one-way function: it can be computed forward from the original value, but there is no way to compute backward from the hash to recover the original value, so the hash on its own does not identify your PC to anyone who doesn't already know the input. - Hardware & RTX diagnostics: GPU model, driver version and VRAM, CPU model, RAM size, Windows build, which Minecraft Bedrock edition is installed, your in-game graphics/RTX settings, your installed BetterRTX build, and which Actions & Stuff subpack is active. This is collected fresh on every app start, but only actually uploaded if something changed since the last successful upload (compared via a local content hash), so you aren't re-sending identical data on every launch.
- What is deliberately excluded: your name, Windows username, file paths, disk serial numbers, MAC addresses, or IP address are never part of this payload.
- Transparency: every payload the Patcher would send is also written to a local file (
last_hardware_ping.json) next to your settings, whether or not it ends up being uploaded that run, so you can inspect exactly what left your machine at any time. - Optional bug-report attachments: if you submit a bug report, you can additionally choose to attach your Minecraft content log (Windows usernames are automatically stripped from file paths before upload) and recent GPU driver event log entries (timestamp, provider, error code, and the driver's own diagnostic message, containing no personal data).
- Anonymous known-issue reports: for specific, actively-tracked bugs (e.g. the NVIDIA mob-texture-corruption issue), the Patcher offers a one-click report that skips asking for a Discord name entirely and always attaches your content log, hardware info, and GPU driver events, since diagnosing that particular bug needs all three. These reports are kept only as long as the underlying issue stays open (see Section 10) rather than falling under the standard 30/90-day schedule.
- Right of access: the "Download My Data" button in the Patcher's Settings tab saves every server-side record tied to your install ID and hardware hash as a JSON file.
- Right to erasure: the "Delete My Data" button in the Patcher's Settings tab deletes every server-side record tied to your install ID (and any hardware-hash-linked history) and then rotates your local install ID, so no future telemetry can ever be linked back to your prior history.
Legal basis: Patcher telemetry is processed exclusively on the basis of your explicit, freely revocable consent (Art. 6(1)(a) GDPR). If you decline or later withdraw consent, no diagnostic data is collected or sent at all.
5. Minecraft Server Data
When you join one of our Minecraft servers (e.g. mc.chaosdev.dev), the server software necessarily processes:
- Account identifiers: your Xbox/Minecraft gamertag and account ID (XUID), which Minecraft itself sends when you connect.
- Connection data: your IP address and the times you join and leave, written to the server log.
- Gameplay data: your player data in the world (position, inventory, builds), plus chat messages and commands, which appear in the server log.
This data stays on our own server and is only used to run the game world, to moderate it and to fix problems. Server logs are only kept as long as needed for that; your player data stays part of the world until you ask us to delete it.
Legal basis: running the game you choose to join (Art. 6(1)(b) GDPR, by analogy); logging and moderation rest on our legitimate interest in a safe, abuse-free server (Art. 6(1)(f) GDPR). Microsoft / Mojang process your account data as separate controllers under their own privacy policies.
6. Cross-System Linkage
The Website, Bot, and Patcher are designed to be independent of one another: Patcher telemetry (Section 4) is keyed only to a random install ID and a one-way hardware hash, never to your Discord account, unless you take an action that connects them yourself.
The one place this can happen: if you submit a bug report through Discord and choose to attach hardware/log data collected by the Patcher, that specific support case then contains both your Discord identity (user ID, Discord tag) and your Patcher install ID/hardware data together, because you provided both pieces in the same voluntary submission. Outside of a report you choose to file this way, the Bot and the Patcher never cross-reference each other's data.
Using "Delete My Data" in the Patcher also removes this linked bug-report data, since those records are stored keyed to your install ID/hardware hash, alongside the automatic anonymization described in Section 10.
9. Data Security
We are committed to securing your data, and to processing as little of it as possible in the first place (data minimization by design). Concretely:
- Sandboxed file uploads: all submitted bug logs are served with download-forcing and execution-disallowing HTTP security headers (CSP, Content-Disposition, and MIME-sniffing protection).
- Parameterized database queries throughout, to prevent SQL injection.
- Automated, short-lived detection and temporary blocking of IP addresses that probe the dashboard for common injection/attack patterns.
- Access restriction: only designated guild moderators can view dashboard administration settings, scoped strictly to the servers they actually manage.
- One-way hashing (Section 4) used by design so raw hardware identifiers never need to be stored or transmitted at all.
10. Retention & Deletion
We only keep data as long as the Bot resides in a given server, or as required to provide the feature it belongs to:
- Bug report uploads (logs/zips): automatically, permanently deleted from our server after 30 days.
- Bug report records: the personal identifiers on a report (Discord user ID, Discord tag, Patcher install ID/hardware ID, hardware details) are automatically stripped after 90 days, leaving only anonymous diagnostic statistics behind.
- Exception for specific tracked issues: reports tagged against a specific, still-open known issue (Section 4) are exempt from both of the above schedules for as long as that issue stays open. Once we mark the underlying issue resolved, the normal 30/90-day schedule applies to that report from then on.
- Self-service deletion: on the "My data" card of the dashboard (Personal bot settings, or the
/mydatacommand) you can delete your bot records at any time. XP, dashboard settings, saved roles, booster claims, Monster Radar regions, Crowdin links and dashboard access granted to you are deleted. Suggestions, votes, support tickets, file requests and bug reports stay visible on their servers, but without your Discord ID or name. Bans, blacklist entries, anti-spam strikes and moderation or audit records are kept, because deleting them would lift a ban and expose the servers to the abuse they record (Art. 17(3) GDPR; legitimate interest, Art. 6(1)(f) GDPR). They are part of your data download, so you can always see them. - Minecraft player data: deleted on request; write to [email protected] with your Minecraft name.
- Guild removal: when the Bot is removed from a server, that server's configuration becomes inactive and can be purged on request.
- IP-based security records: the abuse-detection counters and temporary bans described in Section 9 automatically expire within hours and are never kept as a long-term visitor log.
- Patcher telemetry: retained until you use "Delete My Data" (Section 4), which erases it immediately, or until it becomes part of an anonymized bug report per the 90-day rule above.
11. Your Rights (GDPR / DSGVO)
Under Articles 15–21 GDPR, you have the right to:
- Access the personal data we hold about you. For bot data, the "My data" card in the dashboard shows it and lets you download it right away.
- Rectification of inaccurate or incomplete data.
- Erasure ("right to be forgotten") of your data, subject to any legal retention obligations. Bot data can be deleted on the "My data" card, Patcher data with "Delete My Data" in the Patcher (Section 10).
- Restriction of how we process your data in certain circumstances.
- Data portability, i.e. receiving your data in a structured, machine-readable format: the downloads from the dashboard and from the Patcher are JSON files.
- Object to processing based on our legitimate interest (Sections 2, 3, 5 and 9 above).
- Withdraw consent for Patcher telemetry at any time, with no effect on the lawfulness of processing before withdrawal. The in-app "Delete My Data" button (Section 4) does this instantly and without needing to contact us.
- Lodge a complaint with a data protection supervisory authority. As our registered address is in North Rhine-Westphalia, the competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW); you may also contact the supervisory authority in your own EU member state.
For anything the self-service tools do not cover, contact us at [email protected], via the details in our Impressum, or through a Direct Message / support channel on Discord.
12. Discord as a Separate Controller
Using Discord itself, such as sending messages, joining servers, or using slash commands, means Discord Inc. / Discord Netherlands B.V. also processes your data as its own, independent data controller, under Discord's own privacy policy and terms, regardless of anything described here. Our Bot only ever accesses the data Discord's official API exposes to it, limited to the permissions a server's own administrators grant when adding the Bot. We do not control, and are not responsible for, Discord's own data retention or processing.
13. Changes to this Policy
We may update this Privacy Policy from time to time to reflect operational or legal changes. Any modifications will be posted directly on this page with an updated revision date. Your continued use of the Bot, Website, Patcher or Minecraft servers after a policy update constitutes your acknowledgment of the revised policy; where we rely on your consent (Section 4), any material change affecting that consent will ask you to confirm it again.