Privacy Policy
Last updated May 23, 2026 · Beta program v1
What we collect
- Email — for sign-in + account-recovery email.
- Password hash — bcrypt, salted, 12 rounds. Plaintext never stored or logged.
- Device keys — SHA-256 of a random per-device secret. The raw key never leaves the mod (or your browser).
- Minecraft username + UUID — optional. Only stored if you link an account.
- Activity logs — sign-ins, device pairings, admin grants. 30-day retention.
- Payment metadata — handled by Stripe. We see only the customer ID and subscription status, never card numbers.
What we do NOT collect
- Your gameplay or screen contents (the relay only carries control-plane messages).
- Plaintext passwords or raw device keys.
- Analytics or third-party trackers.
- Your IP address beyond standard AWS request logs (14-day rotation).
Where data lives
- AWS DynamoDB in ap-southeast-2 (Sydney). Account rows + audit logs.
- AWS S3 for mod release artifacts.
- Stripe for payments (separate processor; their privacy policy applies to payment data).
- Your machine for everything else: mod config, recordings, evidence bundles, macros. Sentinel never uploads these.
Cookies
We set two cookies on sentinel-mc.com:
sentinel_access+sentinel_refresh— httpOnly auth tokens.sentinel_theme— your chosen theme. Not httpOnly so the picker can read it.sentinel_dk— your per-browser device key (httpOnly).
We use AWS SES to send verification + password-reset emails. Bounce and complaint notifications loop back via SNS so we can de-list dead addresses. No marketing email — we don't have a mailing list.
Account deletion
You can delete your account from the Account page. Deletion wipes your profile row, all paired devices, refresh tokens, and audit rows within 30 days. Stripe customer records (if any) are deleted on the Stripe side via the API.
Children
Sentinel is not directed at children under 13. If you believe a child has created an account, email us and we'll delete it.
Contact
Privacy questions / data requests: Lutti99g4ming@gmail.com.