What we keep, why, and how to have it removed. The site and accounts first, then each product on its own.
The data controller is Nikita Orlov, QwU World. Based in Warszawa, Poland. E-mail: dragon4ik.QwU@gmail.com. Use these contacts to ask for a copy of your data, a correction or deletion.
Every QwU World privacy notice lives here: the qwu.world site with its accounts and forum, then one block per product. Each mod and game has its own notice because each handles different data.
In short: we keep only what the site needs to work, we do not sell data, and there are no ad trackers.
When you register we store a username, a display name, your email address, a password hash (we never see or keep the password itself), your date of birth, your interface language, and an avatar and bio if you fill them in.
The date of birth is there for the age limits: an account starts at 13, and the Blocky Music Workshop at 16. Nobody outside sees the date, and the Workshop never receives it: it is told only whether the account is old enough. Accounts made before 18 September 2026, or through a sign-in provider, never gave one, so the Workshop asks them instead.
Signing in with Discord, Google, Steam or X stores only your id and handle at that provider, so we can recognise you next time. We do not request your friends, messages or anything else from those services.
A linked service is yours to see and nobody else's until you say otherwise. In the account settings you can show it on your profile: the icon and your handle there then appear beside your name for anyone to see. Google cannot be shown that way.
Between the two steps of a sign-up we hold your username, display name, address and password hash for ten minutes, then delete them if the code never comes back.
A six digit code is delivered by Resend when you create an account or recover a password: it receives your address and the message with the code, nothing more.
After signing in your browser holds one session cookie for 30 days. For each session we record the browser string and a shortened network prefix (the first groups of the IP address, never the full address) so we can show you your active sessions and stop abuse.
The session cookie is shared with QwU World's own services on qwu.world subdomains, today the Blocky Music Workshop: one sign-in covers them, and signing out of any of them ends the session everywhere (details below).
There are no other cookies: no analytics, no advertising counters. Preferences such as the sound toggle in the world stay in your browser and never reach the server.
Whatever you post on the forum is public, including your username and the time of posting. Posts can be edited and deleted; reports and moderator actions are written to a log so decisions can be checked.
Your message, subject and the address you give are stored on our server and forwarded to a private studio channel on Discord so we see them. We use them only to reply. A shortened network prefix is kept briefly to stop spam.
Fonts load from Google Fonts, so Google sees your browser request the font file. The counters on the home page come from the public Modrinth, GitHub and Discord APIs, fetched by our server; nothing about you is sent there.
We do not keep page access logs.
Your account, the sign-in, the forum, the workshop and everything else you came here for are processed to perform our contract with you, which is the site rules (GDPR Art. 6(1)(b)). Without that data the service does not work at all.
Rate limits, network prefixes, moderation logs, bans and spam defence rest on our legitimate interest in keeping the site alive and safe for everyone else (Art. 6(1)(f)). You can object to that processing by writing to us; we weigh it again and answer.
Legal cases, copyright notices, statements of reasons and records of which rules you accepted are kept because the law requires it, chiefly the EU Digital Services Act (Art. 6(1)(c)), and because without them neither your position nor ours could be defended in a dispute (Art. 6(1)(f)).
The optional things (showing a linked Minecraft account on your public profile) happen only with your consent (Art. 6(1)(a)), and you can take that consent back at any time by turning the setting off.
Your account and what is in it: while the account exists. Delete the account and the profile, preferences, favourites, notifications and Minecraft links go with it.
Sessions last 30 days. An unfinished sign-up is held for 10 minutes. Network prefixes kept against spam: up to 30 days.
In the workshop, the periods for notices, cases and moderation logs are published in the rules themselves, in section 16 of the copyright page and section 12 of the moderation page (blocky-music.qwu.world/legal/copyright#records and /rules/moderation#records). In short: legal cases 3 years after they close, then names and contact details are erased; reports 2 years; deleted comments a year; the moderation log 3 years.
The site runs on servers in the EU. Four things nonetheless reach outside it: the codes we email are delivered by Resend (US), urgent moderator alerts arrive in a private Discord channel (US), fonts load from Google Fonts (US), and the Minecraft ownership check, names and skins go to Mojang and Microsoft (US).
All four transfer on the basis of the European Commission's adequacy decision (the EU-US Data Privacy Framework) or standard contractual clauses. We send them nothing beyond what they need: Resend gets an address and the text of the message, Discord a username and a link, Mojang a player id.
You can ask for a copy of your data and receive it in a machine-readable form, correct what is wrong, delete your account entirely, restrict processing while we look at an objection, object to processing that rests on legitimate interest, and withdraw consent wherever we asked for it. Write to it.qwuworld@gmail.com; we answer within 30 days.
If you think we handled your data badly, you can complain to a supervisory authority. In Poland that is the Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You may also complain to the authority of the country you live in.
This page changes with the site: the date at the top is the last update, and material changes are announced in the news.
A client-side Minecraft mod. Nothing leaves your computer until you agree on first launch. Camera, screen and voice are encrypted end to end and pass through a relay that cannot read them. There are no accounts.
The server companion for Qcord. The lobby key lives on your server; the relay never sees it. Players install nothing extra.
The Blocky Music Workshop (blocky-music.qwu.world) is where Blocky Music beatmaps are published, found and installed, on the site and from inside the game. QwU World runs it on your qwu.world account with the same sign-in: the session cookie is shared with that subdomain, so being signed in on qwu.world means being signed in on the workshop, and signing out of either ends the session for both. To know who is signed in, the workshop asks qwu.world on the same server and receives your account id, username, display name, the avatar you uploaded to qwu.world (not a picture from a sign-in service), role, interface language, account creation date, ban state, and when your password last changed or a ban was issued. It never receives your email address, your password or your list of sessions.
The workshop keeps what it needs to run. Beatmaps you publish are public, with their charts, audio, cover, credits and your username, and anyone may download them; installed copies stay on players' computers and servers. Comments are public. Ratings, favourites and notification settings are kept with your account. Reports go to moderators only, and the person reported is never told who reported them. Moderation decisions, statements of reasons, strikes and appeals are kept so that decisions can be checked and challenged. To stop abuse, rate limits and download counts store a shortened network prefix (the first groups of the IP address), never the full address.
Legal notices (copyright and other unlawful content) and counter-notices are kept with the details you give. The notifier's name and the notice, never their address or phone number, may be shared with the uploader; a complete counter-notice is forwarded to whoever sent the original notice. If you give an email address, receipts and decisions are sent through Resend. Urgent reports alert the moderators in a private Discord channel, with usernames and links only.
Linking a Minecraft account stores its UUID and current name. Ownership is checked with Mojang's session server, the same check a Minecraft server makes when you join, and names, profiles and skins are looked up from Mojang and Microsoft. The workshop never receives your Minecraft or Microsoft password or tokens.
Two decisions in the workshop are made automatically. Uploads stop for 30 days at two active copyright strikes and for good at three; a comment is hidden pending review when three established accounts report it within a day. A person checks both within 72 hours, the decision arrives with its reasons, and you can appeal it; an appeal is decided by someone who was not involved.
Comments written on a Minecraft server that runs Blocky Music are stored on that server by its operator, not by QwU World; ask the server's operator about them.
Besides the shared session cookie, the workshop sets one cookie of its own, which remembers the interface language for a year. For a copy of your workshop data, a correction or deletion, write to it.qwuworld@gmail.com, as for the rest of the site.
In development. Each gets its own notice before release, and it will appear here.
One account for the forum, your profile and everything the studio ships next.
