1. Scope and controller
Schematio operates Schemat.io and is responsible for the personal information described in this policy. Our primary application infrastructure is hosted in Germany, while service administration occurs from Australia and some providers may process information in other countries.
This policy covers the Schemat.io website, accounts, APIs, community features, uploads, downloads, reports, authenticity tools, and related services. Contact us at contact@schem.at.
2. Information we handle
Account and identity information
- Minecraft or Microsoft identifiers, UUIDs, player names, avatars, linked identities, and authentication records.
- Email address and limited profile or social information received from you or an identity provider where enabled.
- Account settings, team and community memberships, roles, permissions, API tokens, and security preferences.
Content and community activity
- Schematics, files, renders, previews, scripts, descriptions, tags, comments, profiles, collections, and other material you submit.
- Creator credits, source and publication history, licences, content hashes, provenance events, and watermark evidence.
- Reports, authorship claims, moderation decisions, supporting attachments, communications, and appeal information.
Technical and usage information
- IP address, user agent, session identifiers, timestamps, referring pages, requested URLs, and basic device or browser information.
- Login, security, API, upload, conversion, download, quick-share, view, rate-limit, error, and diagnostic events.
- Approximate or derived signals used to prevent abuse, maintain security, understand service reliability, and measure feature usage.
Authenticity checks
Images submitted to the authenticity tool are processed in memory to detect a watermark and are not intentionally retained as uploads. We may retain ordinary request security data, such as IP address, timestamp, rate-limit events, and errors. If you separately attach an image to a report, that attachment is retained with the report.
3. How we collect information
We collect information:
- directly from you when you use the service, upload content, configure an account, communicate, or submit a report;
- from linked identity and integration providers, such as Microsoft, Minecraft, or Discord, when you choose or are required to connect them;
- automatically from your browser, device, API client, plugin, server integration, cookies, and service logs;
- from community administrators or other users when they credit, invite, report, or otherwise interact with you; and
- from public records or public webpages where needed to confirm attribution, provenance, abuse, or a rights claim.
4. Why we use information
- Provide the service: authenticate accounts, host and deliver content, operate downloads and conversions, run communities and APIs, and respond to requests.
- Protect users and creators: preserve attribution and provenance, process reports, detect abuse, enforce rules, resolve disputes, and prevent fraud or unauthorized access.
- Operate and improve: diagnose errors, monitor performance, understand aggregate usage, develop features, maintain backups, and communicate service changes.
- Comply and defend: meet legal obligations, respond to valid legal process, preserve evidence, and establish, exercise, or defend legal claims.
Where the GDPR or similar law applies, our legal bases are performance of our contract with you, our legitimate interests in operating and protecting a content-sharing service, compliance with legal obligations, and consent where we specifically ask for it. You may withdraw consent prospectively, but that does not affect earlier lawful processing.
5. Public information
Public profiles, player names, creator credits, public schematics, previews, descriptions, tags, comments, licences, communities, and activity intended for publication can be seen, indexed, downloaded, copied, or shared by others. Do not publish personal information you do not want made public.
Removing content from Schemat.io does not remove copies previously downloaded, independently archived, quoted, or hosted by others. We may retain non-public provenance and moderation records after public content is removed where needed for security, disputes, creator protection, and legal claims.
6. Cookies and measurement
Schemat.io uses essential cookies and similar storage for login sessions, security, CSRF protection, preferences, and service functionality. We also use server-side logs and operational monitoring to measure reliability, diagnose errors, enforce limits, and understand use of features.
As of the effective date, we do not sell personal information or use third-party behavioural advertising cookies. If we introduce non-essential advertising or analytics technology, we will update this policy and provide consent choices where required.
7. When information is shared
We may disclose information:
- publicly, when you choose to publish it or the feature is clearly public;
- to hosting, storage, content-delivery, email, identity, integration, error-monitoring, security, and infrastructure providers that process it for us;
- to community administrators where needed to operate a community, membership, moderation, registry, or integration you use;
- to a claimant, affected user, adviser, court, regulator, law-enforcement body, or other person where reasonably necessary to handle a report, protect rights or safety, comply with law, or resolve a dispute;
- during a merger, financing, reorganisation, or transfer of the service, subject to appropriate confidentiality and continued protection; or
- with your direction or consent.
We do not disclose more information than reasonably necessary. A content notice may be shared with the affected user so they can understand and respond to it, unless doing so would be unlawful or create a material safety risk.
8. International processing
Primary service data is hosted in Germany. Schematio is administered from Australia. Identity, email, monitoring, community integration, support, and infrastructure providers may process information in the European Economic Area, Australia, the United States, and other countries where they operate.
Privacy laws differ between countries. Where required, we use contractual protections, provider safeguards, access controls, and other lawful transfer mechanisms. You may contact us for more current information about relevant provider locations and safeguards.
9. Retention
We keep information only for as long as reasonably needed for the purposes above. In general:
- account information is kept while the account is active and for a reasonable period afterward for restoration, security, disputes, and legal compliance;
- public content remains until it is removed under account controls, moderation, community rules, or a valid request;
- session, rate-limit, access, and operational logs are kept for shorter periods where practical, but security incidents and abuse records may be kept longer;
- reports, provenance, watermark evidence, attribution history, sanctions, and legal records may be retained for longer because they protect creators, users, and legal claims; and
- encrypted or access-controlled backups expire through normal backup rotation and may not be edited immediately.
We delete or de-identify personal information when it is no longer reasonably needed, unless law, safety, fraud prevention, freedom of expression, another person's rights, or legal claims require retention.
10. Security
We use reasonable technical and organisational measures designed to protect information, including access controls, separation of private source files, signed provenance evidence, rate limits, monitoring, backups, and transport security. No online service is completely secure. Keep independent copies of important content and report suspected account or security compromise promptly.
11. Your choices and privacy rights
Depending on your location, you may have rights to be informed; access, correct, or delete personal information; restrict or object to processing; receive portable data; withdraw consent; and complain to a privacy or data-protection authority. We aim to offer these core choices to all users where reasonably possible, even where a particular law does not require every right.
You can change available account settings or use account deletion controls. For another request, email contact@schem.at. Describe the account or data involved and the right you want to exercise. We may verify your identity and may limit a request where required to protect another person, public records, security, freedom of expression, legal obligations, or legal claims.
If GDPR applies, you may complain to the data-protection authority where you live, work, or believe a breach occurred. People in Australia may complain to the Office of the Australian Information Commissioner after first giving us a reasonable opportunity to respond. Other users may contact their local authority.
12. Children
Schemat.io is not intended for children under 13. A higher minimum age or verifiable parental permission may apply depending on the user's country and the legal classification of the service. If you believe a child provided personal information contrary to applicable requirements, contact us so we can investigate and take appropriate action.
13. Automated processing
We use automated tools for spam and abuse controls, rate limiting, file conversion, provenance checks, recommendations or ordering, and operational security. Moderation decisions with significant account impact may use automated signals, but users can request human review where required by law or offered by the relevant appeal process.
14. Changes and contact
We update this policy when practices, providers, or laws materially change. We will publish the updated date and provide reasonable notice of material changes. Earlier versions may be retained for accountability.
Privacy questions, requests, and complaints: contact@schem.at. We will acknowledge complaints and aim to provide a substantive response within a reasonable period, normally within 30 days where applicable.
