Privacy Policy

Last updated: October 30, 2026

This policy explains how McHost handles personal data when you use the Android app, this website and related services. If you do not agree with this policy, please do not use the app.

Who is responsible

McHost is run by Daniel Dobiáš, a private individual in the Czech Republic (European Union), who is the data controller for the processing described here. Contact for all privacy questions and requests: mchostappsupport@gmail.com.

Information we collect

• Google Sign-In information: Google account ID, email address, display name, and profile photo, when you sign in. Playing on the same Wi‑Fi works without signing in.
• Server information: server names, settings, selected Minecraft/Paper version, generated address, relay allocation, tunnel status, session metadata, logs, and diagnostics.
• Purchase information: Google Play purchase token, subscription status, and related entitlement status. We do not receive your full card or bank details.
• Advertising and analytics information: Google AdMob, Firebase and Google Play services may process device identifiers, the advertising ID, app activity, diagnostics, crash data, and performance data, as described below.
• Support information: messages you send to support, your email address, and information needed to investigate your request.

Friends' servers (sharing a server with friends)

If you invite friends to your server, or join a friend's server, McHost stores on our server (api.mchostapp.com):

• the Firebase user ID of each member (a pseudonymous ID, not your email) and the display name of their Google account, so the owner can see and manage who has access;
• a Firebase Cloud Messaging token of your device, only to deliver "server is on" notices you allowed (at most once in 30 minutes per server);
• the permissions the owner granted (switch on/off, restart, console) and your notification setting;
• invite codes, stored only as a one-way hash; invites expire after 7 days and are deleted 30 days later;
• while the server runs: its address and the Minecraft nicknames of players currently online (no IP addresses of players). These are removed when the server stops;
• console output and commands (including in-game chat) are only relayed live between the phone and members with console permission. They are not stored; for commands we keep only a non-reversible fingerprint, who sent it and the time for 30 days, to prevent abuse.

When a member leaves, their membership is deleted. When the owner removes a member, the member's name is deleted and only their pseudonymous ID is kept with a "removed" mark, so the old invite cannot be reused; it is deleted with the account. Deleting your account (in the app or at mchostapp.com/delete-account) deletes all of the above, including servers you own and their member lists. This data is not sold, not used for advertising and not shared, except that Google (Firebase Cloud Messaging) delivers the notices.

Optional anonymous measurement

With your consent (you can say no and change it later in the app's Profile), McHost sends usage and crash information through Firebase Analytics and Firebase Crashlytics: which screens and features are used, app crashes and errors, device type, Android version and memory class, and a Firebase installation ID. It is used only to fix bugs and improve the app, it is not used to identify you, and it is not shared for advertising. Without consent, no measurement data is sent.

Automatic reports (optional)

If you turn on Automatic reports, the app sends us server startup results and errors, versions of Minecraft, server software, Java, plugins and modpacks, the app version and basic device details (Android version, processor type). Reports are linked to your account, used only to improve compatibility, kept for 30 days and you can delete them in the app at any time. They do not contain your worlds, chat or IP addresses.

Ads

Free users may see banner ads and can choose to watch rewarded ads. Ads are provided by Google AdMob. In the European Economic Area, the United Kingdom and Switzerland the app asks for your choice through Google's consent form before personalized ads are shown; you can change it later in the app. Without consent, AdMob may still show non-personalized ads, which use limited data such as the device type, approximate location from the IP address and data needed to prevent fraud. More information: How Google uses information from apps that use its services.

Backups to Google Drive

If you turn on backups and sign in with Google, McHost uploads copies of your server world and its settings to the folder "McHost backups" in your own Google Drive, only over Wi‑Fi. Free accounts keep up to 3 copies per server, Premium up to 10; older copies are deleted automatically. The backups go directly from your phone to Google; we do not receive or store them on our servers, and only you (and anyone you share your Drive with) can access them. McHost asks only for access to the files it creates itself (it cannot see your other Drive files). You can delete the backups in Google Drive at any time.

Players joining over the internet (relay)

When friends join your server over the internet, their Minecraft connection passes through our relay servers (DigitalOcean: Frankfurt in the EU and Singapore; a US location may be used again). The app picks the relay with the best connection for the server owner. The relay sees the IP address of each connecting player because it has to forward the traffic. The IP address of each connecting player and of the host phone, with the time of the connection, is written to the relay's technical connection log, which is deleted automatically after 30 days. They are used only to run the connection and protect it from abuse, and are not sold, shared or used for advertising. The relay does not read or store the game traffic itself.

Downloading server software, plugins and modpacks

When you create a server or install plugins or modpacks, your phone downloads files from PaperMC, Modrinth, GeyserMC and CurseForge (CurseForge searches go through our proxy at api.mchostapp.com, the files come from CurseForge's download servers). These services see your IP address and the files requested, like any download, and process it under their own privacy policies. McHost does not send them your account information.

Online play time

Online play time (the welcome hours, hours for a rewarded ad and purchased hours) is stored on our server with your account. To give the welcome time only once, we also keep a salted one-way hash of a device identifier (never the IMEI, serial number or advertising ID). When you finish a rewarded ad, AdMob confirms the reward to our server using your pseudonymous account ID.

Support

When you contact us (the envelope in the app or our support email), we receive your message, your email address, the app and Android version and any details you add, and use them only to answer you. Bug reports that earn a Premium reward are matched to your account for that purpose.

This website

mchostapp.com is served through Cloudflare. It uses no analytics, no advertising and no tracking cookies. Cloudflare processes technical data such as IP addresses to deliver the pages and protect them from attacks.

Why we may use your data (legal bases)

• To provide the app you asked for (account, servers, relay addresses, friends' servers, play time, Premium, backups, support): performance of a contract, Art. 6(1)(b) GDPR.
• Optional measurement, automatic reports and personalized ads: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time in the app; this does not affect processing before the withdrawal.
• Security and abuse prevention (relay connection logs, command fingerprints, device hash for the welcome time), non-personalized ads that keep the free version running, and this website's technical data: our legitimate interests, Art. 6(1)(f) GDPR.
• Payment and accounting records where the law requires them: legal obligation, Art. 6(1)(c) GDPR.

Service providers

McHost uses these providers to operate the app and related services: Google (Firebase, Google Sign-In, Google Play Billing, Google Play services, AdMob, Google Drive), DigitalOcean (backend and database in Frankfurt, EU; relay servers in the EU and Singapore, and possibly the US) and Cloudflare (website, DNS, proxy). They process data on our behalf or as independent controllers under their own privacy policies and service terms.

Transfers outside the EU

Some providers (Google, DigitalOcean, Cloudflare) process data in the United States, Singapore or other countries outside the EU. These transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses included in the providers' data processing terms.

Sharing

We do not sell personal information. We share information only when needed to operate the app, process payments, serve ads, provide analytics you agreed to, host relay infrastructure, comply with law, prevent abuse, or protect users and the service.

How long we keep data

• Account, servers, play time and friends' server data: until you delete your account.
• Relay connection logs: deleted automatically after 30 days.
• Automatic reports: 30 days, or sooner if you delete them in the app.
• Command fingerprints: 30 days. Invites: expire after 7 days, deleted 30 days later.
• Support emails: as long as needed to handle your request and follow-ups; deleted on request unless we must keep them.
• Purchase records: as long as required by payment, tax or accounting rules.

Account deletion requests are handled within 30 days. See the account deletion page.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability, to object to processing based on legitimate interests, and to withdraw consent at any time. To use these rights, email mchostappsupport@gmail.com; we answer within one month. You also have the right to complain to a data protection authority, in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz), or the authority in your own EU country.

Local server files

McHost stores Minecraft-compatible server files on your Android device. These local files may include worlds, logs, configuration files, and server assets. You can remove them from the app, Android storage settings, or by uninstalling the app.

Children

McHost is not directed to children under 13. In the Czech Republic, children under 15 need a parent's or guardian's consent for optional measurement and personalized ads (the age can differ in other countries). Users who are under the age required by their country to manage a Google account or make purchases should use the app only with permission and supervision from a parent or guardian.

Security

We use reasonable technical and organizational measures to protect information, including encrypted transport for app communication where supported. No online service is completely risk-free.

Changes

We may update this Privacy Policy when the app or legal requirements change. The date at the top shows the latest version. If a change significantly affects how we use your data, we will also tell you in the app.

Contact

For privacy questions, contact mchostappsupport@gmail.com.