1. Scope
Personal-data operator: Калягин Андрей Владиславович, self-employed, taxpayer ID 773323995948. Processing started on 14 August 2026. Privacy contact: team@maralys.com; phone: +7 995 905-26-55.
This Policy applies to maralys.com, MARALYS ID/SSO, game servers, launcher, official mods and support.
2. Data categories
Account data includes email, username, display name, date of birth and language; the password is stored only as an Argon2id hash. When an official mod signs in, the API receives the entered password over HTTPS only long enough to verify it and does not store it in plaintext. We also process IP, user-agent, sessions, security logs, launcher and operating-system versions, launcher installation/session identifiers, diagnostics and notification preferences, game identifiers/progress/sanctions, MCOIN balance and wallet transaction history, support correspondence, consent evidence, order metadata and, if voluntarily linked, SteamID64 and public Steam fields. Pixel Battle data includes season ID, cell coordinates and colour, action time, linked MARALYS ID, username, canvas version, contribution statistics, change history and reports. Coordinates, colour, time and username are public on the canvas and in replay; a profile link appears only for a public profile. Authoring data includes article drafts and revisions, Markdown, linked-image URLs, categories, tags, moderation status, moderator feedback and action timestamps. MARALYS does not store full payment-card data.
3. Purposes and legal grounds
We process data to enter and perform the User Agreement, provide accounts and servers, prevent abuse, deliver support, meet legal obligations and pursue proportionate legitimate interests. Separate consent is used where legally required. Marketing uses separate optional consent.
4. Recipients
Access is role-limited. Authorities receive data only under a valid legal requirement.
- RS-Media LLC (MyArena) hosts the primary database, files and backups in Russia. Official company address: 127434, г. Москва, вн. тер. г. муниципальный округ Тимирязевский, ул. Большая Академическая, д. 44, к. 2, этаж 2, ком. 29, 29А.
- VK Digital Technologies LLC (VK WorkSpace) delivers service email and optional marketing email.
- YooMoney NBCO LLC (YooKassa) processes payments when enabled; MARALYS receives order and status data, not full card details.
- Yandex LLC (Yandex Metrica) receives analytics data only after optional-cookie consent.
- No separate web-push provider is used.
5. Russian localisation and cross-border transfers
The primary recording, systematisation, accumulation, storage, update and retrieval of Russian citizens’ personal data use a database and backup storage hosted with RS-Media LLC (MyArena) in Moscow, Russia. Steam is a separate foreign service. Any cross-border transfer is enabled only after the Operator completes the applicable assessment and Roskomnadzor procedure. Steam linking is optional unless licence proof is required for a specific server.
6. Retention
Account data remains while the account is active, then is deleted or depersonalised unless law, accounting, security or legal claims require limited retention. Web sessions last up to 30 days, mod refresh sessions up to 90 days, and one-time codes no longer than their documented lifetime. Backups expire under a controlled rotation schedule.
7. Security
Controls include TLS, access separation, Argon2id, hashed tokens, refresh rotation, logs, backups, dependency updates and incident response. No system is absolutely secure; use a unique password and report suspicious activity immediately.
8. Your rights
You may request processing information and a copy, correction, blocking, deletion, withdrawal of consent and a review of the Operator’s actions. Use the account form or privacy email. Identity verification may be required. Withdrawal is prospective and does not stop processing based on another lawful ground.
9. Children, cookies and changes
MARALYS ID is designed for adults aged 18+. Essential cookies secure sessions and forms; optional categories require a choice. Material policy changes receive a new version and renewed consent where law requires it.
10. Playtime and referrals
To display statistics and operate referrals, MARALYS processes server ID, MARALYS ID, Minecraft UUID and username, game/server session identifiers, Connector version, heartbeat sequence, cumulative active time, last contact, AFK state, one-time imported legacy hours, referral code, attribution and reward status.
A server's public page shows a participant's position, display name, username, total, active and imported playtime. The avatar and MARALYS ID profile link appear only when the public profile is open; email, UUID and session identifiers are not included in the ranking.
This confirms active play, prevents replay and abuse, displays time and balance, maintains the server ranking, credits MCOIN and supports reviews. Heartbeat receipts are retained for up to 48 hours; aggregate time, attribution and the immutable MCOIN ledger remain while the account is active and afterward only for security, disputes and mandatory records. Server secrets are stored only as cryptographic hashes.
11. Permanent-privilege checks
To avoid charging MCOIN for a temporary privilege already covered by a permanent one, the official Connector reports positive permanent LuckPerms group names and the observation time. The backend retains only groups referenced by active privilege products on the selected server; unrelated groups and individual permission nodes are discarded.
The snapshot is replaced on an authenticated game-session start and heartbeat, is used only for purchase and delivery checks, and is deleted with the account or server. Group names are never included in the public catalog or website responses: the interface receives only identifiers of products already owned. The last confirmed state may temporarily keep a purchase blocked after connectivity is lost to prevent an incorrect debit; a new authoritative snapshot updates it.