Skip to main content

Privacy & Security

This page covers what CraftyAI collects, how it is stored, and how it is protected.

What we collect​

When a player triggers the AI in chat, the plugin sends the following to our servers:

  • The player's username
  • The chat message (the player's question or command)
  • Game state needed to answer the question: biome, health, hunger, coordinates, inventory snapshot, time of day, weather
  • Your server's session ID (used for rate limits and tier tracking)

That's it. We don't see player IP addresses, world saves, chest contents, or anything outside the immediate context of the question.

What we don't collect​

  • Player IP addresses
  • World save data, terrain, or chunks
  • Other players' positions or inventory (only the asking player)
  • Passwords, login tokens, or session cookies
  • Anything from outside the AI request

How long we keep data​

Chat messages​

Processed in real time. The message is sent to the AI provider, the response is sent back to the player, and the original message is not stored after the response is delivered.

Memory (taught knowledge)​

Anything you teach with /crafty learn Q | A is stored in our vector database, indexed against your session ID. It stays until you remove it or close the account.

Memory (conversation history)​

Recent chat messages are kept briefly so the AI can answer follow-up questions. After the conversation goes idle, the AI compresses the relevant parts into long-term memory and the original messages are dropped.

Long-term memory persists indefinitely until you delete it.

Telemetry​

Every 3 minutes, the plugin sends a heartbeat ping to our servers. The heartbeat contains:

  • Server version
  • Plugin or mod version
  • Online player count

That's all. No chat content, no player names, no game state.

You can disable telemetry:

  • Plugin: Set enable_metrics: false in config.yml
  • Mod: Set telemetry_enabled: false in craftyai.json

Disabling telemetry does not disable the AI. The plugin will still work for chat and actions.

Remote Connections & Endpoints​

CraftyAI communicates with our cloud infrastructure over encrypted HTTPS endpoints:

  • AI Gateway Endpoint: https://craftyai-gateway.craftyauth.workers.dev
    • Purpose: Processes AI chat interactions, natural language queries, and game action dispatch.
    • Payload: Player message, game context (coordinates, biome, health, inventory), server session ID, and API key.
  • Auto-Mint Handshake: https://craftyai-gateway.craftyauth.workers.dev/v1/handshake-no-key
    • Purpose: Generates and assigns initial server API keys on first startup.
  • Telemetry Heartbeat: Sends anonymous status pings every 3 minutes (configurable).

BYOK​

If you configure a custom provider (BYOK — OpenAI, Google Gemini, Anthropic Claude via proxy, Groq, xAI Grok, Ollama, etc.), your prompts go directly to your configured AI endpoint instead of through DemonZ AI Cloud. In that mode, your chosen provider processes the data under their respective privacy policy, and our servers do not receive or process that AI traffic.

How we protect your data​

  • All traffic between your server and our backend is encrypted with HTTPS and TLS.
  • API keys are stored as bcrypt hashes, not plaintext. We can't recover a key from our database, but we can rotate it on request.
  • Server isolation: learned knowledge is keyed by session ID, so no other server can read your facts.

Abuse detection​

We monitor for unusual traffic patterns (requests from non-Minecraft clients, requests claiming a session ID that doesn't match their API key, etc.). When we detect abuse, we send an alert to all operators on the affected server.

This is a security check, not surveillance. We only act on requests that fail client validation, we don't read chat content for abuse detection.

Deleting your data​

To have all data associated with your session ID deleted, including learned knowledge, long-term memory, and usage analytics, open a ticket in our Discord. We delete the data within 7 days and confirm by reply.

Questions​

If anything on this page is unclear or you want more detail on a specific point, ask on Discord.