Privacy is part of the scan boundary.

Core principles

A scan must use a short-lived server-managed capability, disclose its scope before it starts, and require an affirmative consent action. The public self-service app obtains that capability automatically and shows no ticket field. Collection is bounded by item, byte, and duration limits.

A result describes only what the configured collectors could observe. It never claims that an entire PC is clean, and it should never be the sole basis for an automatic moderation action.

What is inspected locally

• Current Minecraft mod JAR names, sizes, ZIP central-directory metadata, declared nested-JAR and selected structural identities, and SHA-256 digests beneath the selected JVM's exact canonical game root.
• The active version's bounded inheritsFrom lineage and bounded manifest fields, conventional declared Java libraries, and paired client JARs, plus exact validated JAR entries from the selected JVM's declared classpath.
• A size-bounded tail of logs/latest.log, parsed locally for normalized active-version, mod-loader, and mod-JAR references. Raw log lines are discarded after extraction.
• Exactly one same-user Minecraft JVM on supported Windows systems, selected only when it has a validated canonical game root, safe version, reviewed launch class, and declared JAR classpath. V3.0 pins its PID lifetime, parent, canonical Java image, and game-root identity; ambiguity, reuse, missing launch data, or a helper/decoy JVM makes coverage incomplete. A renamed host additionally needs an exact GLFW/LWJGL window PID and adjacent loader-visible jvm.dll in a normal runtime layout.
• The pinned JVM's executable, validated declared -javaagent/-agentpath files, local-only typed -agentlib signal, and Toolhelp-visible module identities, with bounded hashes of current on-disk files.
• Collector completion, access limitations, failures, and rule-pack verification details.
• On Windows, at most 64 Minecraft mod-history facts from only the current user's Recycle Bin. Each accepted fact contains a normalized JAR basename and the UTC time Windows recorded the item moving into the Recycle Bin. Retained deleted-file content is not opened, recovered, hashed, or uploaded.

Raw process command lines are reduced locally to typed launch signals and discarded. Local paths, process IDs, agent options, window captions, and nonmatching hashes are not included in the report. The scanner does not read the target JVM's raw environment or arbitrary effective properties. Completed coverage describes only the declared bounded command-line and loader-visible scope.

What a report is designed to contain

The backend receives opaque scan/client/rule-pack identifiers, collector status and counts, bounded SHA-256 digests, and redacted rule findings. It may also receive normalized current mod JAR names, active version and loader identifiers, installed version IDs, and normalized absent-now JAR references with their log-reference times. It may additionally receive at most 64 current-user Recycle Bin mod-history facts, each limited to a normalized basename and UTC move time. For an incomplete process, module, or latest-log check, it may also receive at most eight fixed, path-free diagnostic codes. Free-form collector errors remain local. The backend never receives local paths, raw process command lines, agent options, or the raw latest.log lines from which bounded facts were extracted. It does not receive or inspect a retained Recycle Bin file or its original path.

Authorized scan policies enable a backend-only Discord staff summary. The portable EXE neither contains the webhook nor contacts Discord directly. The request-specific disclosure names this delivery before consent, and the backend sends only the bounded staff-facing report—not raw files or raw log lines.

Every accepted completed Discord report includes one fixed 1200×1200 PNG staff card rendered by the backend solely from fields already present in the accepted structured report. The card summarizes the verdict, case, selected Minecraft setup, bounded mod context, governed detections, injection-check coverage, optional NIM advisory state, and collector coverage. It is not captured from the client, desktop, or game window.

Accepted Recycle Bin mod-history facts are rendered into a separate bounded staff attachment. It contains no more than 64 entries and only the normalized basename plus UTC move time for each entry. It is separate from the current mod inventory and does not describe a complete deletion history.

If one or more normalized mod-JAR names are included in an accepted report, the backend renders every such name into one fixed generated UTF-8 text attachment for staff. The current report contract permits at most 512 names. The attachment states its scope and coverage and may not represent every locally examined entry; it contains no file bytes, paths, hashes, process data, or additional filesystem observations.

Reports are intended for authorized MaghrebSMP staff conducting the specific review disclosed in the scan request.

Under privacy-v7-private-case-portal, the backend may publish an encrypted, sanitized projection of those same accepted report fields to a private staff case page. The projection adds no new client collection: it contains no raw files, paths, logs, memory, command lines, screenshots, credentials, or other device data beyond the accepted bounded report.

V3.0 reports declared device-check completeness separately from live game/server-session association. A completed self-service device review remains unbound and cannot support session-level clearance or a clean-device conclusion.

Optional NVIDIA NIM advisory review

NVIDIA NIM review is optional and backend-only. It runs only when the request-specific disclosure says it is enabled and the player consents to that request. After validating the complete report, the backend may send NIM a deterministic subset of at most 32 normalized current mod JAR names and at most 32 other bounded version, loader, or absent-now identifiers; it never sends raw latest.log lines, raw files, or unrestricted paths.

Model output is untrusted advisory context for manual staff review. It cannot turn a filename, missing file, partial scan, or other heuristic into proof of cheating, and it must never trigger automatic enforcement.

What is explicitly excluded

Third-party processing, retention, and deletion

For scans authorized under privacy-v7-private-case-portal, the backend may retain the encrypted sanitized case projection no later than 720 hours after scan completion. Expired projections are no longer available through the case page and are removed under the service retention job. This retention applies only to the bounded accepted report fields described above and does not authorize raw or additional collection.

Each case uses a separately generated access code. Staff enter it only in the locked page; it is sent in the HTTPS POST body, never in the URL, and the website keeps it only in the active page component's memory. The code is not placed in browser local storage or session storage. The backend stores neither the plaintext code nor a reusable code verifier; it derives the comparison value from its protected server key and the case ID. Because both the case link and code are delivered through the same private Discord staff channel, this gate is access control—not multi-factor authentication.

An authorized Discord staff-channel message may remain until authorized staff delete it under the community policy and Discord's service terms. Read Discord's retention information and privacy policy.

When optional NIM review is explicitly enabled, NVIDIA processes only the normalized bounded identifiers described above. Its handling is also subject to NVIDIA's privacy policy and the terms applicable to NVIDIA-hosted API Catalog access. Trial API access is not treated here as authorization for production use; the operator must confirm an applicable production agreement before enabling hosted review. The scan disclosure must identify this third-party review before consent; otherwise NIM is not used.

The website itself is built without advertising trackers or third-party analytics. Hosting infrastructure may still process ordinary request metadata needed to serve and protect the site; the final hosting policy will identify those operators.

Player choices

Players can read the scan disclosure and decline consent. Questions or deletion requests should be raised with MaghrebSMP through its official staff channels. Publishing a durable privacy contact here is a production-launch requirement.

For implementation safeguards, read the security model.