Legal · v1 · effective 24 May 2026

Privacy

Vagabond's Fragments ("Fragments") is operated by Vagabonds Studio. This policy covers data we collect when you use the Fragments website + companion mod. It's short on purpose — there isn't much we need to track, because peer-to-peer means most of what you do never crosses our server.

What we collect

·Email address and Discord ID (if you sign in with Discord).

·The display name + Minecraft UUID you bind to your account.

·Link-key metadata: a name you give it, the prefix (first 12 chars), a SHA-256 hash of the full key, and timestamps. Raw key values are never stored — they're shown once and only kept by you.

·An immutable record of when you accepted these terms.

·If you redeem an access code that belongs to an affiliate, the fact that your account redeemed it — used to count referrals. The code's owner sees totals (how many redeemed, how many run worlds, how many pay), never who you are.

What we don't collect

·Your Minecraft world contents — those live on peers' machines and optionally in your own S3 bucket.

·Chat messages, in the ordinary case — they flow peer-to-peer over WebRTC, encrypted in transit, and never reach us. The one exception is named in section 03.

·Advertising or profiling data of any kind, and we never sell anything we do hold.

What the mod sends, and when

·To run the mesh at all: your Minecraft name and UUID, which world you are in, which regions you hold, and how to reach your peers. Without this there is no shared world.

·Automatically: an update check carrying your build version and channel.

·Automatically, and only in worlds where you have turned map sharing on: once a second, your position, facing, dimension, name, and the chat you send. This is the exception to section 02 — the coordinator receives it and applies that world's consent settings before anyone else sees any part of it.

·Only when you ask: filing a bug report or suggestion sends your text plus your mod version, operating system, Java version, the dimension and coordinates you are standing at, your peer count, and whether you are holding a lease.

·Only when you ask: /vbf log share sends the last 5MB of your log, with anything shaped like a credential scrubbed first. Sending a crash report sends the crash file, which contains file paths, your mod list and system details.

·Never: another player's names, positions or chat, and nothing outside your game folder.

·Setting VBF_PHONE_HOME=off stops all of the above except the coordinator calls that run the mesh itself. The same list is shown in-game under “What Fragments sends”.

Your rights

Email hello@vagabonds.studio to request export, correction, or deletion of your data. We'll respond within 30 days.

Cookies

We use a single first-party cookie issued by Supabase Auth to keep you signed in. No analytics, no third-party tracking.

Data retention

·Account + bind data is kept while your account is active.

·Soft-deleted worlds are hard-deleted after 24 hours.

·Audit log entries (admin actions) are kept for the lifetime of the world they relate to.

·If you delete your account (email us), we wipe your account row + sign you out of every linked client. Audit log entries you authored stay for the world owner's record but are decoupled from your identity.

·If we have ever paid you (affiliate commission), the payment record itself is kept for six years — UK law requires it — but it is decoupled from your deleted account the same way.

Beta status + future changes

This is our v1 policy, written for the beta period. We expect to revise it as the product matures. Any change material to your account will be announced via email at least 14 days before it takes effect — you can object or close your account in that window and we'll honor it.

This document is honest about what Fragments does, not a formal legal contract. If you intend to scale Fragments operations to EU, UK, or California residents at meaningful volume, a lawyer should review GDPR / UK GDPR / CCPA wording before that point.