Privacy is part of the scan boundary.
3ab3ali AntiCheat is designed for a narrow Minecraft integrity review—not general surveillance of a player's computer.
Core principles
A scan must use a short-lived server-managed session, disclose its scope before it starts, and require an affirmative consent action. Collection is bounded by item, byte, and duration limits.
A result describes only what the configured collectors could observe. It never claims that an entire PC is clean, and it should never be the sole basis for an automatic moderation action.
What is inspected locally
- Minecraft mod JAR names, sizes, central-directory metadata, and SHA-256 digests under resolved Minecraft game roots.
- Same-user Java and Minecraft process executable identity on supported Windows systems.
- Loader-visible module identity for confirmed Java processes and bounded hashes of their current on-disk files.
- Collector completion, access limitations, failures, and rule-pack verification details.
What a report is designed to contain
The backend receives opaque scan/client/rule-pack identifiers, collector status and counts, bounded SHA-256 digests, and redacted rule findings. Staff notifications should contain a further minimized summary and be delivered by the backend—not by secrets embedded in the portable application.
External staff delivery, including Discord, is backend-only. The request-specific disclosure states whether it is enabled before consent. When enabled, Discord receives only the bounded staff summary described above—not local observations or raw artifacts.
Reports are intended for authorized MaghrebSMP staff conducting the specific review disclosed in the scan request.
What is explicitly excluded
- Raw file uploads
- Raw process memory
- Browser history or cookies
- Saved credentials
- Discord account data
- Personal documents
- Screenshots
- Arbitrary command lines
Retention and deletion
The current staging backend keeps scan state in memory and loses it on service restart; it is not a durable evidence store. Discord delivery is currently disabled. If enabled under a later disclosed policy, a staff-channel message may remain until authorized staff delete it under that policy and Discord's service terms.
The website itself is built without advertising trackers or third-party analytics. Hosting infrastructure may still process ordinary request metadata needed to serve and protect the site; the final hosting policy will identify those operators.
Player choices
Players can read the scan disclosure and decline consent. Questions or deletion requests should be raised with MaghrebSMP through its official staff channels. Publishing a durable privacy contact here is a production-launch requirement.
For implementation safeguards, read the security model.