Privacy Policy

Last updated October 25, 2026

This notice explains how DonutSpins processes information when you use donutspins.pages.dev. For questions or privacy requests, contact the DonutSpins operator at DonuttSpins@gmail.com.

1. Information we process

• Account verification: the Minecraft username you enter, payment amount and recipient, request and expiry times, verification status and the payment event identifier supplied by the bot.
• Account sessions: random login tokens in essential cookies and hashed token values on the server. Your Minecraft or Microsoft password is not requested.
• Security: a salted hash of your IP address for login rate limits. Cloudflare also receives connection and request information, including your IP address and browser metadata, to host and protect the site.
• Public profiles: Java UUIDs, Bedrock XUIDs and skin texture information retrieved to show your avatar.
• Support: your email address and the information you choose to send when you contact us.

2. Why we use it

We use this information to verify account ownership through in-game payment events, maintain your login, display your avatar, limit abuse, investigate payment issues and answer requests. Providing a username and the required verification information is necessary to complete login. You can browse the main and policy pages without logging in.

Depending on applicable law, processing is based on providing the service you request, legitimate interests in operating and securing it, responding to you, or a legal obligation. Optional uses requiring consent will not be introduced without the appropriate notice and choice.

3. Essential cookies

These cookies are marked Secure, HttpOnly and SameSite=Lax. Blocking them prevents login from working. This version does not add advertising cookies, analytics tracking scripts or marketing pixels. Hosting security features may process additional technical information.

4. Skin lookups and service providers

Cloudflare hosts the website and stores verification records in D1 when verification is enabled. Minecraft profiles and textures may be requested from Mojang/Microsoft, GeyserMC, PlayerDB and MineTools.

Your public username or profile identifier is sent to the relevant provider to resolve a skin. If the site's profile endpoint fails, the browser can contact the profile providers directly. In that case the provider also receives your IP address and normal connection information. Skin images may be downloaded directly from Minecraft's texture service or through our server. These requests do not include your Minecraft password or our session cookies. Providers may cache public profile data and process requests under their own policies.

Support email is handled through the email service used for the published contact address. We do not sell your personal information or use it for targeted advertising.

5. Retention and security

Verification commands expire after ten minutes and login sessions after seven days. Expiry of a cookie does not automatically delete server records. Verification and security records may be retained while needed to secure accounts, investigate misuse, handle disputes or meet legal obligations; request details or deletion through the contact below. Public profile responses can be cached for five minutes, and providers may apply their own cache periods.

Access controls, HTTPS and hashed server tokens help protect the service. No online service can guarantee absolute security. Do not send passwords or recovery codes in support messages.

6. Your choices and requests

You can log out, block or clear cookies, stop using the service, and ask what personal information we hold about you. Depending on the law that applies to you, you may have rights to access, correct, delete or restrict information, object to processing, obtain a copy, or complain to a relevant data protection authority. We may need proportionate proof that a request relates to your account. Some records may need to be retained for a valid legal or security reason.

7. Age and international processing

DonutSpins is intended for adults aged 18 or over, subject to any higher local age requirement. Contact us if you believe a child has supplied account information. Providers may process data in countries other than your own; applicable transfer requirements depend on the operator and the services used.

8. Updates

This notice may be updated when the service or data practices change. The update date appears above. Material changes will be brought to users' attention through the service where practicable.