What this site records, and what it does not.

Page views on the website

hwic.dev and docs.hwic.dev keep a server-side log of page views so the owner can see what gets read. It is built from the request your browser already sends; nothing runs in your browser to make it. Each view records:

• The page path, such as /server. Query strings are dropped before anything is stored, so a licence key or checkout token in a link is never logged.
• The time of the request.
• Your IP address (IPv6 as its /64 network) and an approximate location (country, region, city), looked up in an offline database on this server. It is coarse, often wrong for mobile, VPN and proxy connections, and never sent to a third party.
• The referring page, if your browser sent one, without its query string.
• Your browser's user-agent string, and the browser, operating system and device type read from it.

Visitor counts use a one-way hash of the day, IP and browser string, so you are one visitor for a day and a new one the next. Records are deleted automatically after a set number of days (90 by default) and can be deleted earlier by the owner at any time. Nothing under /api, the admin panel, downloads, images or fonts is recorded, and there is nothing for an ad blocker to block. Separately, the web server keeps ordinary access logs that include your IP address; those roll over after 14 days.

Your licence, the mod and the overlay

• The licence record. A fkdr licence works on the computer it is set up on, so the service keeps a hardware id for each of those computers. This is a one-way value worked out from the machine, which is not a name, a serial number or anything that identifies you. The IP address(es) a key has been used from are kept as a security record (IPv4 in full, IPv6 only as its /64 network, so the half that identifies your individual device is never stored), with the first and last time each was seen; they never limit where you can play. You can free a device yourself from your key page, twice, and ask through the contact above to erase an address.
• Minecraft accounts. Every Minecraft account that launches or plays on a key is recorded against it: the account's UUID and username, when it was first and last seen, how many times it has launched, and the fkdr version it ran. The most recent 60 accounts per key are kept; older ones are dropped.
• “Playing now”. While the game is running the mod sends a heartbeat about once a minute. At the title screen or in menus it carries only your Minecraft name and UUID and the fkdr version, so “playing now” can tell “game open” from “not running”. In a world it also carries the address of the server you are connected to, and (on Hypixel) the game, mode, map and lobby it reports. Your IP address is sent with every heartbeat and only ever shown masked. This is what makes “playing now” and a friend's “where they are” work. It is held in memory only and is gone a few minutes after you stop; what is written down is the account's last-seen time, name and version.
• Module states. Every few seconds the overlay also reports which fkdr modules you have switched on, with your Minecraft name, so the key page can show your session and turn modules on, off or lock them remotely. These are held in memory; the settings the owner has locked are stored against your account.
• Licence and integrity checks. The mod sends the key and your Minecraft UUID when it starts and when it asks for stats or an update. Builds carry a customer id derived one-way from your key. The key itself is never written into a jar. The mod also reports whether its own files are intact: file hashes, whether a debugger is attached, the file names (not the paths) of any Java agents loaded alongside it, and, once per launch, a short diagnostic line that includes the process id and the full path fkdr was launched from, which on Windows and macOS normally contains your computer account name. The mod also works out a hardware id for the computer it runs on and sends it with the licence check: it is a one-way value used only to count computers, and the network adapter's address or your computer account name is only ever read to work it out, never sent as itself. The outcome is kept on the key as a status, a few true/false flags and a short note, together with an event log (time, key, Minecraft UUID and name, version, IP address), capped at the most recent 5,000 entries. Short-lived signed session tokens are issued to the mod and are not stored on the server.
• Discord. If you link the key to Discord, your Discord user id and tag are stored with it. A key from a Discord boost is tied to the boosting account.
• Purchases. A purchase stores the Stripe order id and, if you gave one, the email you typed at checkout, next to the key it paid for.
• Your social account. The overlay's social features create one account per licence key: the username you choose, the Minecraft names you have played under, and when you were last seen.
• Appearing offline. You can choose to appear offline in the overlay. Your friends and other players then see you as offline: no location, no Minecraft account, and a last-seen time that stops at the moment you turned it on. Messages you read stay unread to their sender until you show yourself again. This hides you from other players only. The administrator can still see your real online status, where you are and which account you are playing on, and the presence information described above is still recorded. Things you actively do, such as messages you send, friend requests, scripts and comments, still carry their own times.
• Friends and messages. Friend lists, friend requests and blocks are stored. Direct messages are stored on the server as plain text, are not end-to-end encrypted, and are kept until they are deleted. The administrator can read any message, including yours, and can delete messages and accounts. This is how abuse gets handled. Treat overlay messages as you would any moderated chat, not as private correspondence.
• Scripts and comments. A script you upload or share stores its name, description, source code, version and share code, plus who installed or voted on it and any comments. The administrator can open any script, including a private one. A script you install is code written by another user and can send data anywhere it likes. Only run ones you trust.
• Player tags. Tag sharing is on by default. When you tag another player, the tag stores your Minecraft UUID and name, their UUID and name, the label, any note you wrote and when you added it; only the Friend label stays on your computer. Tags are public as soon as you post them, with no approval step, and other players see each one with your Minecraft name and the date you added it. Write tags and notes on that basis, or switch sharing off in the module's settings. Other players can react to a tag and comment under it: reactions are shown only as counts, though the site records which accounts reacted so each can react once, and a comment is shown with its author's Minecraft name. Anyone can report a tag or comment; a report stores the reporter's account, name, reason and time. The owner can delete any tag or comment and can withdraw a key's ability to post tags, comments or both, for a set time or permanently; that record keeps a one-way hash of the key, the Minecraft names on it, the reason (which is shown to you), and when and by whom it was set.
• Other players. To show stats and tags in a lobby, the mod sends this site the UUIDs and names of the players around you, and the site asks Hypixel and Mojang about them; those answers are cached for a few minutes and not written down. Depending on which sources you enable, your own copy of the mod may also ask Hypixel, Mojang and the third-party stats services directly, using keys you supply. Nothing about another player's gameplay or chat is recorded here.
• On your own computer. fkdr keeps your licence key, your settings, your tags and notes, and a year of your own match history in a folder on your machine (~/.fkdr). The match history is never uploaded.
• How long, and deleting it. All of the above is kept for as long as the key exists; there is no automatic expiry. Ask and the key, the licence record, the social account, its messages, scripts and tags are deleted, and the key stops working.

Payments

Keys are arranged in a ticket in the fkdr Discord and paid for on whichever service you and the owner agree on: Zelle, Venmo or a cryptocurrency. This site never sees the payment: no card number, no account details, nothing about the transfer. What is stored against the key is the key itself, when it was issued and any note the owner writes on it, which may say which method was used. Whatever the payment service keeps is theirs, under their own privacy policy. Purchases made before 20 September 2026 went through Stripe, which collected card and billing details on its own pages (stripe.com/privacy); for those, the order id and the email typed at checkout are still stored against the key, and Stripe still keeps the records it is legally required to keep.

Cookies and storage

• Four cookies are strictly necessary for something you asked for: hwic_gate remembers the licence key you entered at the front door (6 hours), hwic_docs keeps you signed in to docs.hwic.dev (30 days), hwic_admin is the owner's own session, and hwic_consent remembers your answer to the notice below for a year. None of them is shared with anyone.
• The music player remembers its state (track, position, whether you paused it) in your browser's local storage so it carries on between pages. That stays on your device.
• One cookie is not necessary and is only set if you allow optional analytics: hwic_vid, a random visitor id kept for a year, mirrored in local storage, with a matching session id in session storage. Choosing “Essential only” deletes it. Nothing else is stored in your browser.
• The small notice in the corner asks once whether optional analytics may run, and you can change your answer any time from the “Cookies” link in the footer. “Essential only” is a complete answer; a browser that sends the Global Privacy Control signal is treated as having said it without being asked.

Analytics with your consent

If you choose Allow on the notice, a small script on this site (first-party, nothing from any other company) records, for the pages you visit here: the page, its title and the page that referred you, including any campaign tags in the link; a random visitor id (the hwic_vid cookie) and a session id; your device and browser: screen, window and pixel size, colour depth, orientation, touch or mouse, dark or light mode, reduced-motion and contrast preferences, languages, time zone, processor count, memory class, platform, connection type and speed, whether the page is installed as an app, and the browser, operating-system and device-model details your browser is willing to hand over; how you use a page: how long it was open, how long it was in front of you, how far you scrolled, and which links or buttons you tapped, by their text and address, never anything you typed; music player plays, pauses and skips; whether a licence-portal attempt succeeded or failed (never the key itself), and if it succeeded, that this visitor holds that key; page speed measurements and any script errors, with the file and line they came from; and your IP address and the same approximate location as the page-view log. A dated record of your decision, with your IP address, is kept as proof of consent. It is used to understand how the site is used and to fix what breaks; it is never sold or shared, and it is deleted on the same schedule as the page-view log. Choose Essential only from the “Cookies” link in the footer and it stops at once and everything recorded under your visitor id is deleted. A browser that sends Global Privacy Control or Do Not Track never runs it.

Where data goes

Nothing is sold, and nothing is shared for advertising or cross-context behavioural advertising in the CCPA sense. So there is no “Do Not Sell or Share” switch to flip, because there is nothing to opt out of. Everything described above lives on the owner's own servers. It leaves them in only a few ways: Stripe takes payments; Mojang and Hypixel are asked about Minecraft UUIDs and usernames so names, skins and stats can be shown, and two avatar services are asked for a head image by UUID; Discord holds whatever you do in the Discord itself. The Discord bot keeps its own records for the things it does: verification (your Discord id with the Minecraft name you gave and who invited you), moderation cases, levelling and voice activity, giveaway entries and winners. Those are kept indefinitely, while joins, leaves, nickname changes and bridged chat are posted into Discord log channels and then live under Discord's own retention. Links to Discord and Instagram are plain links; those sites only learn about you once you visit them.

Your rights

Wherever you are, you can ask what is held about you, have it corrected or deleted, get a copy of it, or object to the page-view log. Some of it you can do yourself: free a device from your key page, choose “Essential only” to erase your analytics visitor id, delete your own tags, scripts and comments, and switch off tag sharing and the stats sources in the mod's settings. There is no self-service button for the rest, so ask through the contact above and the owner will do it by hand; expect an answer within 30 days, usually much sooner. Deleting page-view records for your IP address needs only the address. Under the GDPR / UK GDPR the legal basis for the visit log, the licence and security records and the moderation of messages and tags is our legitimate interest in running and protecting the service; for purchases it is the contract with you; for the optional analytics it is your consent, which you can withdraw at any time. You also have the right to complain to your local data-protection authority. Under the CCPA/CPRA you have the rights to know, delete and correct, and you will never be treated differently for using them.

Children

This site is not directed at children under 13 and does not knowingly collect personal data from them; the store is for adults, or for minors buying with a parent or guardian's permission. If you believe a child under 13 has given us personal data, contact us and it will be deleted.

Questions

Ask in the Discord at discord.gg/fkdr. This page changes when the site does; the date below says when.