Privacy Policy for CraftDroid

1. Introduction & Core Privacy Philosophy

CraftDroid ("we", "us", or "our", operated by TheWhiteCarp) is built with an uncompromising local-first, privacy-by-design architecture. CraftDroid enables users to run, configure, and manage Minecraft Java Edition (Vanilla, PaperMC, PurpurMC, FabricMC), Minecraft Bedrock Dedicated Servers, and Java + Bedrock Crossplay servers directly on their Android devices utilizing local container runtimes (PRoot and Box64).

We firmly believe that your server worlds, player inventories, private chat logs, and game configurations belong exclusively to you. To ensure absolute transparency, we delineate our application's direct operations and third-party network integrations below:

• Zero Developer Data Collection (First-Party): We do not operate external application servers, central player databases, analytics trackers, or user profiling systems. We do not collect, monetize, log, or transmit your personal data, email address, IP address, or game world files. No account registration or sign-in is required to use CraftDroid.
• 100% On-Device Local Server & Credit Execution: Minecraft server processes, JVM environments, world saves, player data files, server properties, and promotional Server Credit / runtime balances are executed and stored entirely within your device's private, sandboxed app storage.
• Third-Party Networking, Advertising & Store Services: To allow friends over the internet to connect to your local server without complex router configuration, CraftDroid integrates the optional Playit.gg tunneling client. Ad-supported Google Play builds integrate Google AdMob (Rewarded Video and App Open advertisements) to fund ongoing maintenance, along with official Google Play In-App Updates and In-App Review APIs. Third-party data handling is detailed in Section 4.

2. What Information We Do NOT Collect

Unlike cloud server hosting providers, CraftDroid maintains a strict zero-telemetry policy for the developer. Specifically:

• No Personal Identifiers: We do not ask for or collect your name, email, phone number, physical address, or account credentials.
• No World or Gameplay Inspection: Your world seed, map files, inventory data, server console logs, operator lists (ops.json), player whitelists (whitelist.json), and in-game chat messages are never transmitted to or visible to the developer.
• No Biometric or Device Location Data: CraftDroid does not access or collect GPS location, Bluetooth beacons, camera, microphone, or contacts.
• No First-Party Analytics or Crash Scraping SDKs: CraftDroid contains zero first-party behavioral analytics, Firebase tracking, or session recording SDKs.

3. Local Storage, World Custody & Data Retention

All server installations, JVM dependencies, configurations, Server Credit balances, and world files reside strictly in local storage on your Android device:

• Sandboxed Internal Storage: Server runtime files (OpenJDK, Paper/Purpur JARs, Bedrock server binaries) and device-bound preferences (such as Server Credit runtime state and Playit tunnel tokens, excluded from cloud backup) are stored inside the app-specific internal directory (/data/data/com.thewhitecarp.craftdroid/).
• User Storage Access Framework (SAF): When creating world backups, importing Bedrock add-ons (.mcpack / .mcaddon), or exporting server archives (.tar.gz / .zip), CraftDroid uses Android's native Storage Access Framework. You retain complete custody over selected files and directories.
• Complete User Deletion Rights: You can completely erase any server environment, reset credentials, or delete worlds at any time through the in-app Worlds, Packs, and Settings menus. Clearing application data via Android System Settings or uninstalling CraftDroid permanently deletes all local server instances, world data, configurations, and Stored Credits immediately from your device.

4. Third-Party Services & Network Data Transits

To provide multiplayer internet connectivity, fetch official game server binaries, deliver advertisements, and verify app updates, CraftDroid interacts with the following external services:

A. Playit.gg (Encrypted Tunneling Service)

CraftDroid integrates the open-source Playit.gg agent daemon to enable multiplayer internet connections without port forwarding:

• Network Transit: When a tunnel is activated, incoming Minecraft multiplayer packets (TCP port 25565 for Java, UDP port 19132 for Bedrock) are routed securely through Playit.gg's global edge network to your Android device.
• Data Processed by Playit: Playit.gg routes connection traffic and processes connecting player IP addresses to establish routing channels and mitigate DDoS attacks. Playit does not inspect the contents of your Minecraft world files.
• Playit Account Management: Account claiming and tunnel assignment occur directly between your browser and Playit.gg. Your Playit secret tokens are saved exclusively in your local Android device storage.
• Privacy Policy: For details on Playit.gg's data handling, consult the Playit.gg Privacy Policy.

B. Google AdMob (Rewarded Video & App Open Advertising)

Public releases of CraftDroid on Google Play display optional Rewarded Video advertisements (to grant promotional Server Credits) and foreground-resume App Open advertisements via Google AdMob:

• Data Processed by AdMob: The Google Mobile Ads SDK may collect device identifiers (such as the Google Advertising ID / GAID), coarse IP-based approximate location (for geographical ad serving and fraud detection), device model, carrier, diagnostic performance metrics, and ad interaction telemetry.
• User Choice & Privacy Regulations (GDPR / CCPA): Users in the European Economic Area (EEA), UK, and applicable jurisdictions are presented with a consent modal (via Google User Messaging Platform / UMP) to select personalized ads, non-personalized ads, or manage privacy choices at any time in Settings. All users can reset or delete their Advertising ID via Android System Settings: Settings > Google > Ads > Delete advertising ID.
• AdMob Governance: Review Google's Advertising Privacy & Terms for additional information.

C. Google Play Core Services (In-App Updates & In-App Review)

Google Play Store builds integrate the official Google Play In-App Updates and In-App Review libraries (com.google.android.play) to check whether a newer release is available on Google Play while servers are offline and to occasionally display Google Play's native rating sheet. These APIs communicate directly with the Google Play Store app installed on your device under Google's Privacy Policy and do not transmit personal data to the developer.

D. Upstream Server Binary & Engine Repositories

When you install or update a server engine, CraftDroid communicates directly with official upstream repositories via encrypted HTTPS:

• Java Edition Engines: Mojang Official Version Manifest, PaperMC API (api.papermc.io), PurpurMC API (api.purpurmc.org), and FabricMC Meta (meta.fabricmc.net).
• Bedrock Edition Binaries: Mojang Official Bedrock Dedicated Server CDN (minecraft.net).
• Crossplay Bridges: GeyserMC & Floodgate API (download.geysermc.org) and ViaVersion repositories.
• Runtimes: Termux / Debian / OpenJDK headless ARM64 & container packages.
• Transit Scope: Only standard HTTPS GET requests are executed to download the requested release packages. No personal data, telemetry, or device identifiers are shared with these repositories.

5. Android Device Permissions & Technical Justifications

In adherence to the Google Play Developer Policy and the Principle of Least Privilege, CraftDroid requests only the permissions strictly required to host a local multiplayer server environment:

CraftDroid does not request or access sensitive permissions including: Camera, Microphone, GPS Location, Contacts, Call Logs, SMS, or External Broad Storage (MANAGE_EXTERNAL_STORAGE).

6. Mojang Studios EULA & Brand Compliance

All users hosting Minecraft servers using CraftDroid must acknowledge and comply with Mojang Studios' legal guidelines:

• End User License Agreement (EULA): Before starting a server, users must affirmatively review and agree to the official Minecraft EULA (https://www.minecraft.net/en-us/eula).
• Bedrock Dedicated Server EULA: Bedrock server instances are governed by the Minecraft Bedrock Server EULA and Privacy Policy.
• Commercial Usage Guidelines: Server monetization, donation stores, and VIP ranks run on your server must comply strictly with the Mojang Commercial Usage Guidelines. CraftDroid does not facilitate, manage, or take cuts from in-game monetization.

7. Hardware Safety, Thermal Protection & Battery Notice

Hosting a dedicated game server on mobile hardware produces sustained CPU computation and heat generation. CraftDroid incorporates protective features, including:

• Automatic Thermal Shutdown: Monitors device thermal zones and gracefully initiates server shutdown when temperatures exceed safe limits (default: 48°C emergency stop).
• User Operational Responsibility: Users should operate servers in well-ventilated conditions, avoid thermal-insulating protective cases during long sessions, and use quality chargers to preserve battery health. The developer is not liable for device thermal wear or battery degradation resulting from continuous server operation.

8. Children's Privacy (COPPA & Age Restrictions)

CraftDroid is a technical utility designed for server administration. CraftDroid is not directed to children under the age of 13 (or under 16 within the EEA). We do not knowingly solicit, collect, or store personal information from children.

Users must meet the age requirements established by Mojang Studios and Microsoft to manage game accounts and agree to the Minecraft EULA.

9. International Privacy Rights & Regulatory Compliance

A. European Economic Area (EEA) & United Kingdom (GDPR)

Because all personal server data resides strictly on your physical device, you maintain full data sovereignty. You can inspect, modify, or erase all data at any time by clearing application data or deleting your worlds. For AdMob advertising data, consent preferences are managed via Google's UMP consent dialog.

B. California Privacy Rights (CCPA / CPRA)

CraftDroid does not sell or share personal information or sensitive personal information to data brokers or third parties. Device identifiers processed by AdMob for contextual or interest-based advertising can be opted out through Android device settings.

10. Policy Updates & Amendments

We may update this Privacy Policy periodically to reflect app updates, new upstream server engines, or regulatory revisions. Updates will be published on this GitHub Pages site with an updated Last Updated date. The latest policy is always accessible in-app via the Settings menu and online at:

https://thewhitecarp.github.io/CraftDroid.github.io/privacy.html

11. Developer Contact Information

If you have any questions, suggestions, or concerns regarding CraftDroid's privacy practices or legal terms, please reach out to us:

• Developer / Publisher: TheWhiteCarp
• Contact Email: thewhitecarp@protonmail.com
• Project Repository: https://github.com/TheWhiteCarp/CraftDroid.github.io
• Application: CraftDroid (com.thewhitecarp.craftdroid)