How Zuppilo looks after your information

Last updated 3 October 2026. This policy explains what information we collect when you use the Zuppilo website (zuppilo.com and store.zuppilo.com), your Zuppilo account and the Minecraft server at play.zuppilo.com, why we collect it, and the choices you have.

The short version, for younger players

We only collect what we need to run Zuppilo and keep players safe.
We never sell your information, and there are no adverts on Zuppilo.
Your password is scrambled, so even we can't read it.
Staff can read chat to keep everyone safe. Chat logs are deleted after 30 days.
You or your grown-up can download your information or ask us to delete it at any time.

1. Who we are

Zuppilo is run by Online Till Ltd, a company registered in England and Wales (company number 11802761), with its registered office at Flat 1, 6 Brent Road, Birmingham, B30 2TP, United Kingdom. Online Till Ltd is the data controller: the organisation responsible for your personal information under UK data protection law. You can contact us at info@zuppilo.com.

2. What we collect

Account details: your email address, whether it's verified and when you joined. Your password is stored only as a scrambled code (a hash) that can't be turned back into the password.
Minecraft details, if you link your account: your Minecraft username and player ID, and what happens on our server, such as your rank, level, stats, badges, friends and friend requests. When you play, the server also records connection details such as your IP address, to protect the server and enforce bans.
Sign in with Google, if you use it: Google tells us your name, email address, profile picture and Google account ID. We keep only the email address and the Google account ID.
Discord, if you link it (13 and over only): your Discord user ID and username, and a record of linking actions.
Your settings: profile and privacy choices, notification choices and cosmetics.
Messages to us: support tickets, player reports and appeals, and our replies.
Chat on the server: messages sent in game chat, kept so staff can deal with reports.
Purchases: what was bought, the price, the order status and the payment provider's reference. We never see or store full card details. If you buy a rank without a Zuppilo account, we also keep the Minecraft username you typed and the email address Stripe or PayPal gives us, so we can deliver the rank, send your receipt and handle refunds.
Security records: sign-ins, account changes and staff actions, plus a cookie that keeps you signed in.
Emails we send you, such as verification links and replies, kept encrypted so we can check they were delivered.
Website logs: like most websites, our server records the IP address, browser type, page requested and time of each visit.
Site statistics: daily totals, such as how many times a page was viewed. These counts contain no personal details.

We don't ask for your real name, home address, school or phone number, and we don't collect your precise location.

3. How we use it, and why

UK data protection law says we need a lawful reason for each way we use personal information. Ours are:

To run your account and give you what you ask for (signing in, linking Minecraft, cosmetics, support and purchases): we need it to provide our service to you.
To keep players safe (moderating chat, handling reports and appeals, banning rule-breakers): our legitimate interest in keeping Zuppilo safe, especially for children.
To protect accounts and the server (security records, website logs, blocking attacks): our legitimate interest in security.
To keep financial records: a legal obligation under UK tax law.
Optional extras, such as analytics or live chat: only with your consent, or a parent's for younger children. None are switched on at the moment.

We don't sell personal information, we don't show adverts, and we don't use personal information to build marketing profiles. We only send news emails if you choose to receive them, and that's off unless you turn it on.

4. Children and parents

Zuppilo is made for players aged 6 and over, so we design it with the ICO's Children's code in mind.
Players under 13 need a parent or guardian to set up and manage their account, and to agree to anything that needs consent.
Some settings start in the more private position: for example, your online status is hidden until you choose to show it. You can change your profile and leaderboard settings in My Zuppilo.
A parent or guardian can ask to see, correct or delete their child's information by emailing us.
Guardian controls link a parent's or carer's account to their child's. We store the link between the two accounts and the guardian's settings: chat mode, monthly spending limit, friend-request approval and purchase receipts. Email us if you want the link removed.

We only share information with organisations that help us run Zuppilo, and only what they need:

IONOS, which hosts our servers in London.
Stripe (and PayPal, if you choose it), which take the payment. If you're signed in, we give Stripe your email address for the receipt; if you buy without an account, you give it to them directly.
Google, if you choose Google sign-in. Our pages also load fonts from Google Fonts, which sees your IP address.
jsDelivr, which delivers the code for our 3D graphics and sees your IP address.
Discord, if you link your Discord account.
Mojang and Microsoft: when you join the server, Minecraft checks your account with them.
The police or other authorities, when the law requires it or to protect a child from harm.

Our servers are in the UK. Some of these providers may handle information outside the UK; when they do, they use safeguards approved under UK law.

6. Cookies and your device

__Host-zuppilo_session keeps you signed in. Your account can't work without it. It lasts 8 hours.
__Host-zuppilo_oauth is used only while you sign in with Google. It lasts 10 minutes.
Your browser also remembers your Lite mode setting (zup-lite) and your cookie choices (zup-consent) on your device.

We would only use analytics, advertising or live-chat cookies after you agree. None are switched on at the moment.

7. How long we keep it

Account, game and settings information: while your account is open. When you ask us to delete your account, we delete it within one month, apart from anything we must keep by law.
Chat logs: 30 days.
Sign-in links and codes: between 10 minutes and 24 hours, and each works only once.
Sign-in cookie: 8 hours.
Support tickets, reports and appeals: while the account is open, or longer if we need them to protect someone.
Purchase records: 6 years, because UK tax law requires it.
Security records and copies of emails we sent: for as long as we need them to protect accounts and check delivery.
Website logs: deleted automatically as newer logs replace them.

8. Your rights

You have the right to:

get a copy of your information (use "Download my data" in My Zuppilo, or email us);
have wrong information corrected;
have your information deleted (use "Request account deletion" in My Zuppilo, or email us);
object to, or ask us to limit, how we use it;
take your information to another service;
withdraw your consent at any time, where we rely on it.

A parent or guardian can use these rights for a young child. We reply within one month. If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

9. Keeping it safe

Connections to Zuppilo are encrypted (HTTPS). Passwords are hashed, sensitive settings and stored emails are encrypted, and staff need two-factor sign-in to reach the back office. No system is perfectly secure, so if a data breach ever puts you at risk, we'll tell you and, where the law requires it, the ICO.

10. Changes to this policy

We'll update this policy when the way we use information changes. The date at the top shows the latest version, and we'll tell account holders about important changes by email or on the website.

Contact us

Email info@zuppilo.com, or sign in to open a support ticket in My Zuppilo.

By post: Online Till Ltd, Flat 1, 6 Brent Road, Birmingham, B30 2TP, United Kingdom. Company number 11802761, registered in England and Wales.

Read the Terms of Service Open My Zuppilo