Privacy policy

Last changed 26 October 2026.

ccbin.dev is a place to share and run ComputerCraft programs. We collect as little as we can, we don't sell anything, and there are no ads, trackers or analytics.

Who we are

ccbin.dev is run by 9M Västerås AB, in Sweden, who is responsible for your personal data here (the "controller" under the EU General Data Protection Regulation, GDPR). Reach us through the contact form. Our servers are in Germany.

What we collect, and why

When you just visit

• Your IP address reaches our servers with every request, as with any website. We use it, in memory only, to limit how often one network can do expensive things (searching, running programs, reporting). When a request fails, our logs keep the network it came from, not your address: the first three parts of an IPv4 address, or the first 48 bits of an IPv6 one. We never store IP addresses in our database.
• The Workbench keeps your workspace in your browser's local storage, on your device. It never reaches us unless you press Run (the files are checked and turned into a scene, then forgotten) or save it to your account.
• Cookies: none, unless you sign in.

When you sign in

• From GitHub, Google or Discord (whichever you choose): your account ID there, your username or name, and your email address if they've verified it. We keep the email only to recognise the site's administrators; we never show it, and never send you anything.
• Cookies: a session cookie that keeps you signed in for up to 30 days after your last visit, and short-lived ones that protect the sign-in itself (10 minutes, or 5 for a passkey). They're needed for signing in, so we don't ask for consent to them.
• Passkeys, if you add them: the passkey's public key and ID, the name you give it, and when you last used it. The private part never leaves your device, and your fingerprint or face never reaches us.
• Your profile: the username, display name and bio you choose. They're public.
• What you post: programs and their files, audio, preview recordings, comments, likes, collections and reports. Public and unlisted things are visible as described in the terms; private programs only to you (and to moderators, if someone reports them).
• API tokens for the in-game client: we store only a fingerprint (a hash) of each.
• Moderators and admins can also have an authenticator app's secret, stored encrypted, and backup codes, stored as fingerprints.
• Notifications about your programs, comments and reports, and the decisions moderators make.

When you report something or write to us

Reports keep the reason, your explanation, and the name and email you give (both optional). Contact messages keep what you write and the details you give. Moderators see these to handle them.

Legal bases

• To run your account and show what you post: the agreement in our terms (GDPR article 6(1)(b)).
• To keep ccbin safe (rate limits, logs, automatic screening, moderation): our legitimate interest in a service free of spam, malware and abuse (article 6(1)(f)), and our duties under the EU Digital Services Act (article 6(1)(c)).

Who else sees it

• Everyone: your public profile, and your public and unlisted programs, comments and collections.
• Cloudflare carries traffic to ccbin.dev and caches the emulator's files, so it sees your IP address and the pages you request.
• GitHub, Google or Discord, when you sign in with them, under their own privacy policies.
• Discord: when a program becomes public, our Discord server can announce its title and author. Moderators' alerts there name programs and authors, never reporters.
• Pastebin and GitHub, when you import from them or a program downloads from them: our server fetches the code, so they see our server, not you.
• Sites a program connects to with live network: only if you turn it on, after a warning. Then your browser connects to them directly and they see your IP address. Without it, nothing a program does leaves your browser.
• Authorities, when the law requires it.

How long we keep it

• Your account and what you post: until you delete them.
• Sessions: 30 days after your last visit, or until you sign out.
• Notifications: 90 days after you read them. Moderation decisions about your content: a year, so you can ask for a review.
• Contact messages: a year after we answer them.
• Reports: for as long as the content they're about exists.
• The moderators' log of decisions (which content, which action, which moderator): kept as a record of moderation.
• Rate-limit counters: in memory, for at most a day.
• Server logs and backups: usually 30 days, at most a year. Something you delete can stay in a backup until that backup is deleted, but we don't restore it.

Your rights

You can ask for a copy of your personal data, have it corrected or deleted, take it elsewhere, or object to or restrict how we use it. Change your profile and delete your account on the settings page; for anything else, use the contact form. You can also complain to a data protection authority: ours is the Swedish Authority for Privacy Protection (IMY, imy.se), or you can go to the one where you live.

Deleting your account deletes your programs, likes, collections, tokens and notifications, and blanks your comments. Programs others forked from yours are theirs, under the licence you chose.

Children

You must be at least 13 to sign in. If you think a younger child has an account, or a child's data shouldn't be here, tell us and we'll delete it.

Changes

If we change this policy in a way that matters, we'll say so on the site first.