BentoBox Privacy Policy#

Last updated: 14 August 2026

BentoBox is open-source Minecraft server software published by the BentoBoxWorld organization. This policy explains what data BentoBox collects, what it never collects, and how server owners can opt out. It applies to BentoBox and to the official addons and game modes published under this organization.

BentoBox is installed and operated by individual server owners. The BentoBox project has no access to your server, its files, or its players. The only data that ever reaches the project is the anonymous, aggregate usage statistics described below.

Anonymous usage statistics (bStats)#

BentoBox uses bStats, the standard open-source metrics service for Minecraft plugins, to understand how many servers run BentoBox and which features are used. Data is submitted roughly every 30 minutes, is aggregate-only, and is publicly visible to anyone at https://bstats.org/plugin/bukkit/BentoBox/3555.

Standard data (sent by the bStats library for every plugin that uses it)#

• A random server identifier — a UUID generated by bStats and stored in plugins/bStats/config.yml. It exists so that one server is not counted twice, and is not derived from your IP address, hostname, or anything else about your server.
• The number of players online at the time of submission, and whether the server runs in online mode.
• The server software name and version (e.g. Paper 1.21.x).
• The Java version; operating system name, version, and architecture; and CPU core count.
• The BentoBox version.

BentoBox-specific data#

• The configured default language and database type (e.g. JSON, MySQL).
• The number of islands on the server, and the number created since the last submission.
• Player activity as a bracket only (e.g. "11–30 unique players since the last submission") — never who those players are.
• The names and versions of enabled BentoBox addons and game modes, the BentoBox API version they are built against, and the names of third-party plugins BentoBox hooks into (e.g. Vault).
• Which BentoBox config settings have been changed away from their default values, reported as named on/off toggles — never free-text values.
• Counts of failed command use, by kind of failure (unknown subcommand, missing permission, wrong world, and so on) and by the internal command path that failed most often (e.g. island.go). Only the command's stable identifier is recorded — never what a player actually typed.

Addon developers can exclude their addon from the addon charts by setting metrics: false in their addon.yml.

What is never collected#

BentoBox never sends: player names or UUIDs, chat, typed command arguments, island names, coordinates or locations, inventories, economy balances, IP addresses, or any other personal data or user-generated content. Everything submitted is a count, a version string, or a configuration category.

Like any web request, the submission reveals the sending server's IP address to bStats. bStats states that it retains IP addresses for at most 60 minutes, solely for rate limiting, and does not store them with the metrics. bStats is an independent third-party service — see the bStats privacy policy.

How to opt out#

There are two switches; either one stops BentoBox's submissions. Both require a server restart to take effect:

• BentoBox only (BentoBox 3.22.3 and later): set general.metrics: false in plugins/BentoBox/config.yml. BentoBox will not register with bStats at all, and other plugins' metrics are unaffected.
• Whole server: set enabled: false in plugins/bStats/config.yml. This is the bStats global switch: it disables metrics for BentoBox and every other plugin on the server that uses bStats.

Other network connections#

BentoBox makes a few other outbound connections. None of them are analytics, and none send data about your players beyond what is described here:

• GitHub API (api.github.com) — fetches release and addon-catalog information for the update checker and the in-game addons catalog. Nothing about your server is sent. Disable with web.github.download-data: false in BentoBox's config.yml.
• Mojang profile services (api.mojang.com, sessionserver.mojang.com) and, when panel.use-cache-server is enabled, the mc-heads.net cache — used to fetch the player-head skins shown in panels. Only the relevant player's name or UUID is looked up, which is the same public profile data any Minecraft client fetches to render a skin.
• playerdb.co — a name-to-UUID lookup utility that BentoBox exposes to addons through its API. Core BentoBox does not call it itself.

Websites and GitHub#

BentoBox's source code, issue tracker, and discussions are hosted on GitHub and are covered by the GitHub Privacy Statement. The documentation site, docs.bentobox.world, is a static site and runs no analytics or tracking of its own. When you download BentoBox from third-party platforms (Modrinth, CurseForge, Hangar, and others), those platforms' own privacy policies apply to the download.

Changes and contact#

Changes to this policy are made via pull request to this repository, so the file's Git history is its changelog. Questions or concerns: open an issue on BentoBoxWorld/BentoBox or ask on Discord.