Anticheat Player Privacy: What to Disclose to Players

What should a privacy notice for an anticheat say?

A privacy notice should list the gameplay and connection data your anticheat and related plugins process, the purpose of each item, who can see it, and how long you keep it. Write it for players, not lawyers. This page is general information for planning. It is not legal advice, so ask a qualified professional about the rules that apply to you and your players.

Which data does your stack actually handle?

List what your setup writes, displays, or sends, not what the plugin could theoretically access. Each row below is a question to answer from your own configuration and docs.

How do you collect less data?

Less stored data means less to disclose, less to protect, and less to delete. Start with the smallest set that lets a reviewer decide a case.

• Turn off logging for any category that no one reviews.
• Send staff alerts with only the fields a reviewer needs to decide.
• Keep raw evidence separate from summaries, so the summaries can be shared more widely.
• Limit access to staff roles that need the data for their work.
• Write a retention period for each category.

How do you write the retention schedule?

Keep one table that names every category, where it lives, how long you keep it, and who or what deletes it. The alert-log article in this series covers how to set retention windows and run cleanup safely. Use this table as the summary you publish.

Category         Stored where          Kept for     Deleted by
Alert summaries  <STAFF CHANNEL OR LOG> <N> days     <ROLE OR SCRIPT>
Raw evidence     <FILE PATH>           <N> days     <ROLE OR SCRIPT>
Punishments      <DATABASE OR PLUGIN>  <POLICY>     <ROLE>

What should players see in the notice?

Put a short notice on your rules or privacy page. Include what is processed, why, who sees it, the retention period, and how a player can ask a question. Do not promise deletion timelines that your backups cannot meet. If a backup keeps data for longer, say so.

What about webhooks and other outside services?

A webhook or bot that copies alerts outside your server makes that service part of your data flow. List each destination in the notice, including the channel name, and check who can read it. Remove fields the destination does not need, and rotate any webhook address that may have leaked.

Review the list when you add a plugin or change a staff channel. A new integration that copies alerts is easy to forget, and it is the most common reason a notice falls out of date.

Which data should players be able to ask about?

A player should be able to ask what you hold about their account and why. You do not have to hand over raw evidence to answer that question. A short, accurate summary of the categories, the purpose, and the retention period is usually enough for a first reply.

Write the reply template before you need it. Include the place to send the request, the time you expect to take to answer, and the fact that some records, such as punishment history, may be kept for a set period under your policy.

How do you keep the notice accurate over time?

Date the notice and list the plugin versions it describes. Review it whenever you add or remove a plugin, change a log destination, or change a retention period. A notice that describes last year's setup is worse than a short one that is current, because players will rely on it.

What have we not verified?

This article does not describe how any specific anticheat writes logs, what its defaults are, or whether its data leaves your server. Confirm those details in the plugin's documentation and your own configuration before you publish a notice.