Personal Data Processing Notice (KVKK / GDPR)
1. Data Controller and Contact
Personal data processed through alhasdev.com and its Cloud AFK service is controlled by Alhas Dev, the operator of the service. Contact: [email protected].
This notice is provided under Article 10 of Turkish Law No. 6698 (KVKK) and, where applicable, the GDPR.
2. Personal Data We Process
• Account data: internal user ID, username, email address, email verification date, password hash and salt, account creation date, last login date, email-based two-factor authentication status, and any administrator suspension date and reason.
• Email verification data: a short-lived challenge token and six-digit code are held only as SHA-256 hashes in backend memory for registration, first verification, password recovery and email-based 2FA. The plaintext code is sent through the configured email delivery provider.
• Bot activity confirmation data: while an account has active or connecting bots, a single-use confirmation-link token is stored only as a SHA-256 hash together with its send time, 24-hour expiry, last confirmation time and next reminder time. One reminder is sent per user every seven days after confirmation; unconfirmed active bots are stopped when the link expires.
• Minecraft and service configuration: Minecraft username, authentication type, selected server hostname/IP and port, protocol version, bot slot ownership, anti-AFK, auto-eat and reconnect preferences, and an encrypted server auto-login password when supplied.
• Authentication data: hashed AlhasDev session token records and Microsoft/Xbox/Minecraft authentication cache files when Microsoft login is used. We do not receive or store your Microsoft password.
• Security and access data: IP address, access time, requested endpoint, HTTP method and technical request metadata in reverse-proxy logs; temporary IP-based rate-limit counters; and a keyed, non-reversible network fingerprint attached to new accounts to enforce registration limits. The raw IP address cannot be recovered from this fingerprint.
• Audit data: timestamp, action type and internal target ID for successful ban, unban, deletion, bot disconnect/chat and activity-confirmation events, plus the relevant bot count. Audit records do not contain the chat message, username, email address, ban reason, confirmation token or administrator key.
• Runtime bot data: up to 200 recent Minecraft chat/system messages per slot, connection errors, queue state and temporary Microsoft device codes. These runtime values are held in server memory and are not written to the bot configuration file.
• Browser storage: AlhasDev session token, saved Minecraft account metadata without the server auto-login password, language selection, and consent choice with timestamp.
• Correspondence data: your email address, identifier and message content when you contact [email protected].
3. Collection Method, Purposes and Legal Grounds
Data is collected electronically from registration and configuration forms, API and WebSocket requests, the Microsoft authentication flow, the Minecraft servers selected by the user, browser localStorage and infrastructure logs.
Account and bot configuration data is processed to create and perform the requested service relationship (KVKK Article 5/2(c)). Authorized administrators may inspect runtime bot telemetry and chat and send operational or moderation notices through connected bots to operate, secure and support the service. Security records, abuse prevention and service diagnostics are processed for the controller's legitimate interests, provided fundamental rights are not harmed (Article 5/2(f)). Records required by applicable law are processed to fulfil legal obligations (Article 5/2(ç)). Consent is requested separately where no other lawful condition applies.
The service does not use personal data for advertising, sale, behavioural profiling or solely automated decisions producing legal or similarly significant effects.
4. Recipients and International Transfers
Data may be processed by infrastructure providers necessary to operate the service, including Cloudflare for DNS, edge security and delivery, the VPS hosting provider for the backend, and Resend for delivery of account verification, two-factor authentication and bot activity confirmation emails.
If Microsoft authentication is selected, authentication data is exchanged with Microsoft, Xbox and Mojang/Minecraft services. When a bot connects, the Minecraft server selected by the user receives the Minecraft protocol connection and account identifier required for that connection.
Cloudflare, Microsoft group services and other selected providers or game servers may process data outside Türkiye. International transfers must be handled under the applicable safeguards in KVKK Article 9 and the relevant provider arrangements. Data may also be disclosed to competent public authorities where legally required.
Production user records and Microsoft token caches are excluded from the Git repository.
5. Retention
AlhasDev session records expire after 30 days and the active session is removed earlier when the user logs out. Reverse-proxy logs rotate at 10 MiB; up to five rolled files are retained and rolled files older than 168 hours are removed. The active log's age can vary until rotation occurs.
Runtime chat and telemetry is limited to 200 messages per slot in memory and is cleared when the backend process restarts. The browser session token is removed on logout or expiry detection; saved account metadata, language and consent preferences remain until changed, unlinked where applicable, or deleted through browser settings.
Email verification and password-recovery challenges expire after 10 minutes, allow at most five incorrect code attempts and are also cleared whenever the backend restarts. No account record is created from a new registration until the emailed code is verified.
Bot activity confirmation links expire after 24 hours and are single-use. After confirmation, the next reminder becomes due seven days later. Pending and last-confirmation scheduling metadata remains in the restricted backend data file while required to operate the reminder cycle; the record is removed when the account is deleted or no longer eligible.
Account data, any suspension reason, its abuse-prevention network fingerprint, bot configuration, Microsoft authentication cache, administration audit records and backup copies are retained while needed to provide and secure the service or satisfy a valid legal requirement. Active user, session, slot and Microsoft cache records are removed by an administrator deletion; audit records and existing operational backups remain subject to their security or legal retention need. No automatic account-deletion or fixed backup/audit purge period is currently implemented; users may request deletion using the contact address below.
6. Your Rights and Requests
Under KVKK Article 11, you may ask whether your data is processed, request information, learn the purpose and recipients, request correction, deletion or destruction where the legal conditions are met, request notification of such actions to recipients, object to qualifying automated outcomes, and claim compensation for unlawful processing.
Send requests to [email protected]. Sufficient information may be requested to verify identity and prevent disclosure to another person.