Trraform Privacy Policy

Last updated 10/15/2025

1. Introduction

Trraform ("Trraform," "we," "us," or "our") provides an online voxel-world project accessible at trraform.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service. If you do not agree with this Policy, please do not use the Service.

For data-protection purposes Trraform is the data controller. You can reach us at support@trraform.com.

2. Information We Collect

2.1 Account Information

  • E-mail address
  • Username
  • Password hash (bcrypt)
  • Stripe customer ID (no card data stored by us)

2.2 Content & Builds

Any data you voluntarily upload to your voxel plots—such as build data, names, descriptions, or links—may be public and can contain personal data if you choose to include it.

2.3 Payment & Subscription Data

Payments are processed by Stripe. We receive and store only non-sensitive metadata such as customer IDs, subscription status, and payment timestamps.

2.4 Analytics & Usage Data

We use Cloudflare's built-in analytics to obtain aggregated traffic insights (e.g., page views, bandwidth, anonymized IP ranges). No additional first-party analytics scripts are deployed.

2.5 Cookies & Local Storage

We set first-party cookies or local-storage tokens to:

  • Keep you signed in between sessions
  • Remember whether to show onboarding modals or similar UI state

Third-party cookies may be set by Google (via Google sign-in and Google AdSense), Cloudflare (via Turnstile CAPTCHA), and advertising partners. See Section 5.2 for details on advertising cookies.

2.6 Email Verification Data

When you register with an email address or request a password reset, we send a verification code to your email. We store information related to these verification requests for security and fraud-prevention purposes.

2.7 Voluntary Reports

If you submit a plot report or support request we store the information you provide.

3. How We Collect Information

  • Directly from you: via registration forms, plot editors, reports, and e-mail correspondence.
  • Automatically: server and Cloudflare logs, first-party cookies/local storage, and third-party cookies from advertising and authentication providers.
  • From third parties: OAuth login with Google, payment metadata from Stripe, and advertising data from Google AdSense.

4. Why We Use Information

  • Operate, maintain, and improve the Service (legal basis: Contract)
  • Process payments and manage subscriptions (Contract)
  • Provide customer support and respond to reports (Contract)
  • Send transactional emails such as account-verification and password-reset messages (Contract)
  • Send service-related communications such as inactivity reminders and security alerts (Legitimate Interest)
  • Ensure security, prevent fraud, and fix errors (Legitimate Interest)
  • Measure performance with aggregated analytics (Legitimate Interest)
  • Display advertisements via Google AdSense (Consent where required; Legitimate Interest otherwise)
  • Use cookies and Google sign-in (Consent where required)

5. Sharing & Disclosure

5.1 Service Providers

We share information with vendors who help us run the Service, including:

  • Cloudflare (Pages, R2, Turnstile, analytics, edge caching)
  • Stripe (payments)
  • MongoDB Atlas (database)
  • AWS (backups, SES email delivery)
  • Discord (error-logging webhook)
  • Google AdSense (advertising)

5.2 Advertising & Cookies

We display advertisements through Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to our website and other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our Service and other sites on the internet.

You may opt out of personalized advertising by visiting Google Ads Settings. Alternatively, you can opt out of third-party vendor cookies for interest-based advertising by visiting aboutads.info.

Subscribers with an active subscription do not see advertisements while logged in.

5.3 Public Content

Usernames and all voxel builds as well as plot names, descriptions, and links are inherently public.

5.4 Legal Requirements & Business Transfers

We may disclose information if required by law or to protect the rights and safety of Trraform or others. If the project is sold or transferred, user data will transfer with it.

6. Cookie Consent

When you first visit the Service, we display a cookie consent banner. You may accept or reject non-essential cookies, including advertising cookies. If you reject advertising cookies, you will still see ads, but they will not be personalized based on your browsing history. You can change your cookie preferences at any time by clearing your browser cookies and revisiting the Service, or by using the cookie settings link in our footer.

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we obtain consent before placing non-essential cookies in accordance with the EU ePrivacy Directive and the General Data Protection Regulation (GDPR).

7. International Data Transfers

We store and process data in the United States. If you reside outside the U.S., especially in the EU/EEA, your data will be transferred to the U.S. We rely on Standard Contractual Clauses to legitimize such transfers.

8. Data Retention

We keep account data for as long as you have an account and for up to 30 days after deletion to allow recovery. Server logs are retained for up to 30 days. Backups are rotated on a regular schedule and retained for up to 90 days.

9. Your Rights & Choices

Depending on where you live, you may have the right to:

  • Access and receive a copy of your personal data
  • Correct inaccurate or incomplete data
  • Delete your account, plots, and related data
  • Port your data in a structured, machine-readable format (JSON)
  • Opt-out of non-essential emails
  • Opt-out of personalized advertising via Google Ads Settings or aboutads.info
  • Withdraw consent for non-essential cookies at any time
  • Send a Do Not Track or Global Privacy Control signal, which we honor for analytics cookies

To exercise any of these rights, email support@trraform.com.

10. Children's Privacy

Trraform is not directed to children under 13. Users aged 13–17 must have a parent or legal guardian's consent. We do not knowingly collect data from anyone under 13.

11. Security

  • All traffic encrypted via TLS
  • Passwords hashed with bcrypt
  • Web Application Firewall and rate limiting on critical routes
  • 2-factor authentication on admin accounts
  • Least-privilege staff access to production systems

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced via a banner on the homepage and will take effect when posted unless stated otherwise.

13. Contact Us

For questions or concerns about this Privacy Policy, contact us at support@trraform.com.