Privacy notice

Who this notice covers

This Privacy notice explains how Mayhem Client (“Mayhem”, “we”, “us”) handles personal data when you visit mayhemclient.xyz, create an account, use the launcher and licensing service, make a purchase or contact support.

For a privacy request, open the support chat on this website and say that your message concerns personal data. Support is handled by the Mayhem operator and authorised administrators. Do not send passwords, wallet recovery phrases, private keys or unnecessary identity documents.

Data we actually use

• Accounts: email address, internal user ID, account creation and sign-in dates, email-code challenges, session records and account changes. Sign-in uses email codes; Mayhem does not ask for your Minecraft or Microsoft password.
• Orders and access: selected plan, price, currency, payment method, order identifiers, payment status, provider references, subscription dates and administrative changes. The payment provider receives payment information on its own page. Mayhem does not collect full card numbers or card security codes in its checkout.
• Devices and licensing: a pseudonymous device identifier, a device public key, linking and reset dates, and licence/session activity. The launcher derives its identifier locally; it does not upload the raw Windows MachineGuid or your selected Minecraft folder path through the current licensing API. A hash linked to your account is still personal data.
• Support: the text you send, replies, message dates, conversation identifier and, if you sign in, the account linked to the conversation. Messages may be forwarded to the connected Telegram support bot.
• Security and delivery: your IP address and request information reach Cloudflare to deliver and protect the service. Application rate limits use a keyed IP-derived identifier. This is separate from optional browser analytics.
• Optional analytics, only after permission: a rotating browser-session identifier, page route, theme and catalogue choices, checkout actions, broad device/browser class, country and referrer category. If signed in, an event may be linked to your user ID. We do not store a raw referrer URL, raw user-agent string or raw IP address in the browser analytics table.

Purposes and legal grounds

We use account, order and licence data to provide the service you request and administer access. We use limited security and operational records to prevent abuse, investigate failures and protect accounts. Where applicable, the corresponding grounds are steps toward or performance of a contract and legitimate interests in service security and administration. Records required by applicable accounting or other law may be retained to meet a legal obligation.

Optional website analytics and optional browser storage rely on your permission. Rejecting them does not prevent sign-in, support or access to your account. Essential operational records are not switched off by the analytics setting. We do not use optional analytics for advertising, sell personal information, or use it to make decisions with legal or similarly significant effects about you.

Services that receive data

Our providers may process information outside your country, including outside the European Economic Area. International transfers and the safeguards they require are subject to applicable data-protection law. Contact support to request information about processing locations and transfer arrangements relevant to your data. We may also disclose information when legally required or necessary to establish or defend legal claims.

• Cloudflare provides hosting, network security, Workers, D1 storage and private R2 release storage.
• Resend delivers sign-in codes to the email address you submit.
• Telegram carries support messages to the operator and replies back to the website. This is not an end-to-end encrypted support channel.
• PayGate.to / withoutkyc.to and the payment provider selected in its checkout process payment information when you proceed to their payment page. They apply their own privacy and verification rules.
• YouTube receives connection/device information only when an enabled video is loaded with your permission. Fonts and product screenshots are served from this site.

Retention

Raw analytics and operational telemetry in the analytics table are scheduled for deletion after 180 days. Expired sessions, email-code challenges and temporary rate-limit entries are cleaned up automatically. Website sign-in sessions last up to 30 days; launcher sessions can be renewed while you use the launcher.

Account, order, device/reset, administrative audit and support records remain stored until an authorised deletion. In deciding what can be deleted, we consider whether your account or access is active, whether a support matter or payment dispute is unresolved, whether a record is needed to prevent fraud or establish a legal claim, and whether a legal retention obligation applies. You can request deletion through support; records that must be retained may be excluded from deletion.

Browser storage lifetimes are listed in the Cookie policy. Withdrawing analytics permission stops new optional tracking and removes its browser identifier. It does not automatically erase previously stored server records; you can request their review or deletion through support.

Your choices and requests

Depending on the law that applies, you may request access, correction, deletion, restriction or portability of your data; object to processing based on legitimate interests; and withdraw consent. You can also complain to the competent data-protection authority. These rights may have legal exceptions, including records needed for a legal obligation or claim.

Use the website support chat for a request. We may ask for proportionate proof that you control the relevant account. Do not include sensitive documents unless a secure, necessary verification method has been agreed. Changing cookie settings is immediate for this browser; other requests require review.

Global Privacy Control and Do Not Track signals disable our optional browser analytics. The website does not require optional consent to use your account.

Children and changes

Mayhem is not directed to children below the age at which they can lawfully consent or contract in their country. We do not collect dates of birth or run a verified age-assurance system. If you believe a child supplied personal data without required permission, contact support so the operator can review it.

We update this notice when the service or its processing changes. The version date identifies this text. A material new use requiring consent will not be authorised merely by changing this page.