Privacy Policy
Pink Sheep Network Manager ("Pink Sheep", "we", "us"), pink-sheep.net
Last updated: 13 October 2026
Contents
1. Who we are
Pink Sheep Network Manager is a web dashboard and set of Minecraft plugins that lets Minecraft network owners manage statistics, moderation, security, alerts, resource packs, integrations and billing.
- Operator and data controller (for customer accounts): [Legal name], trading as Pink Sheep
- Address: [Business address]
- Company registration number (if incorporated): [Company number]
- ICO registration number: [ICO registration number]
- Privacy contact: [email protected]
We operate under the UK GDPR and the Data Protection Act 2018.
2. Our two roles
| Data | Our role |
|---|---|
| Customer account data: network owners and staff who log in to the dashboard | Controller |
| Player data collected from a network's Minecraft servers: names, UUIDs, IP addresses, punishments, security events | Processor, acting for the network owner, who is the controller |
For player data, we only process it on the network owner's instructions, under data processing terms that form part of our service terms. We do not use player data for our own purposes, and we do not share it between networks.
If you are a player on a network that uses Pink Sheep, the network owner decides why your data is processed. Please contact them first about your player data. We will help them respond to you.
3. What we collect
3.1 Dashboard users (network owners and staff)
- Discord account details via Discord login: your Discord user ID, username and avatar. We request the
identifypermission (andguildsif role-based permissions are enabled). We never see your Discord password. - Account activity: last login time, the networks you belong to and your role, and an audit log of actions you take in the dashboard, such as creating a server or issuing a ban.
3.2 Network and server data
- Network name, server names, types, addresses and versions, and the API key your plugins use.
- Statistics: player counts, TPS, CPU and memory usage, and online or offline state.
- The IP address your servers use to reach our API. For networks on a free trial we also keep a salted hash of that address, not the address itself, to detect repeated free-trial sign-ups (see section 5).
- Alerts, and the alert channels you configure (Discord webhook URLs and ntfy.sh topics).
- Resource packs you upload and their file hashes.
- Integration settings, including the webhook secrets for your Tebex or PayNow store.
3.3 Player data (processed for network owners)
- Minecraft username and UUID, and punishment history (bans, mutes, warnings and kicks, with reason, staff member and expiry).
- Player IP addresses seen during join checks and security events, for example VPN or bot blocks.
- Store transactions from the Tebex or PayNow webhooks you enable (player name, package and amount).
3.4 Billing
Payments for Pink Sheep plans are handled by PayNow, our merchant of record. We do not receive or store card numbers. We store the PayNow customer and subscription IDs for your network, your plan, and billing events such as "subscription activated" or "cancelled".
This is separate from the store integrations in 3.2 and 3.3, where you connect your own Tebex or PayNow store so purchases appear in your dashboard.
3.5 Support and complaints
If you contact us by email or open a ticket in the Pink Sheep Discord, we keep what you send us so we can help you. Discord tickets are also held in Discord's own systems.
3.6 Technical data, cookies and similar storage
Our servers and hosting providers may log IP addresses and request details for security and fault-finding.
The dashboard uses a cookie to keep you signed in, which is essential for the service to work. If you choose a light or dark theme, we remember your choice in your browser, and we only do this after you have made a choice. We do not use advertising or analytics cookies.
4. Why we use your data
Where we decide why and how (we are the controller)
| Purpose | Data | Lawful basis |
|---|---|---|
| Provide the service you signed up for | Account, network and server data | Contract |
| Login and account security, audit logs | Account data, IP addresses | Legitimate interests (keeping the service secure) |
| Detect free-trial abuse | Salted hashes of API IP addresses | Legitimate interests (preventing fraud and abuse) |
| Billing, tax and accounting records | Billing events, PayNow IDs | Legal obligation |
| Support | Whatever you send us | Contract, or legitimate interests |
| Handling complaints and rights requests | Details you give us | Legal obligation |
Player data (we are the processor)
The network owner chooses the lawful basis for player data, usually their legitimate interest in keeping their community safe (moderation, VPN and bot protection) or contract for store purchases. We process it only on their instructions, including when we send player IP addresses to ProxyCheck.io for VPN detection if the owner has turned that on.
5. Free trials and abuse detection
Every network gets a 2 month free trial with no payment details, limited to one per network. To stop repeated trials, we compare the IP addresses that trial networks' servers use to reach our API.
- We store only a salted hash of each address, together with the network it was seen from. Because a hash can still be linked back to a person or business, we treat it as personal data.
- If a new trial network's servers use an address already used by another network, the network is automatically blocked for 72 hours and flagged.
- A member of Pink Sheep staff reviews every flag and can lift the block or suspend the network. No permanent penalty is applied automatically.
- Shared hosting can cause false positives. If you think you were blocked in error, email [email protected] or open a ticket in the Pink Sheep Discord, and ask for a person to review it.
Hashed addresses are deleted 12 months after they were recorded. They are kept even if the network is deleted sooner, because that is how repeat sign-ups are detected.
6. When a trial or plan ends
If a trial ends, or a paid plan is cancelled or charged back, and no plan is chosen:
- The network moves to an "expired" state. You have 14 days to choose the Pro or Flex plan. We warn you in the dashboard and through your configured alert channels.
- After 14 days, the network and its data are deleted: servers, statistics, punishments, security events, alerts, resource packs, channels, integrations, members and audit log.
- We keep only the records described in section 7, which are the billing records and the hashed trial IP addresses.
You can also delete a network yourself at any time from its settings page, which has the same effect.
7. How long we keep data
| Data | Retention |
|---|---|
| Statistics | Per plan: Trial 24 hours, Pro 30 days, Flex 1 year |
| Security events | 30 days |
| Plugin command queue | 7 days |
| Network data: servers, punishments, alerts, packs, members, audit log and so on | While the network is active. Deleted 14 days after a plan ends with no plan chosen, or immediately when you delete the network |
| Hashed trial IP addresses | 12 months after they were recorded |
| Billing events and a record that a network existed: network name, owner's Discord ID, creation and deletion dates, PayNow customer ID, reason for deletion | 6 years, to meet UK tax and accounting obligations and to handle disputes or chargebacks |
| Discord account record: ID, username, avatar | Until you ask us to delete it, unless we need to keep it for the billing records above |
| Support emails and tickets | [Retention period] after the issue is resolved |
| Server and security logs | [Retention period] |
Data in backups is overwritten within [30] days of deletion.
8. Who we share data with
- PayNow: merchant of record for payments and tax on Pink Sheep plans.
- Discord: login, and delivery of alerts to webhooks you configure.
- ntfy.sh (or a server you configure): delivery of alerts to topics you configure.
- ProxyCheck.io: when VPN detection is enabled, player IP addresses are sent to check whether they belong to a VPN or proxy.
- Hosting and infrastructure providers: [Hosting provider(s)].
- Tebex and PayNow stores you connect: we receive purchase data from them. We do not send them your players' data.
- Authorities, where we are legally required to.
Where we use these providers to handle player data, we do it as the network owner's processor, and we make sure each provider is bound by data protection terms. We do not sell personal data.
9. International transfers
Some of the providers above are based outside the UK, including Discord, which is based in the United States. Our hosting is in [country or countries]. Where personal data is sent outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, as applicable.
10. Your rights and complaints
Under UK GDPR you can ask us for:
- access to your data, and correction of anything wrong;
- deletion or restriction of your data;
- a portable copy of your data;
- an end to processing based on legitimate interests (the right to object);
- a person to review any decision made automatically, such as a trial block.
Where we are a processor for a network owner, we will pass your request to them.
Deletion has limits: we must keep the billing records in section 7 for 6 years.
Making a complaint
If you are unhappy with how we have used your data, please tell us first at [email protected]. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
11. Security
API access uses per-network keys. Dashboard access uses Discord login with server-side sessions. Webhooks are signature-checked, and the IP addresses used for trial-abuse detection are stored only as salted hashes.
No system is perfectly secure. If a breach affects your data, we will tell you, and the ICO where required. If it affects player data, we will tell the network owner without undue delay so they can meet their own duties.
12. Children
The service is for network owners and staff and is not directed at children. You need to be old enough to have a Discord account to log in, which is 13 or over. Network owners may process data about players under 18, and they are responsible for their own lawful basis and age-appropriate practices.
13. Changes
We will update this page when our processing changes, and change the date at the top. For material changes we will also tell dashboard users.