Legal

What MineScan actually does

MineScan uses two distinct checks. We're specific about the difference rather than lumping them together.

Status ping. The same handshake any Minecraft client sends when you add a server to your list. The server responds with whatever it broadcasts to that request - MOTD, player count and sample, version, icon. Every already-known server gets this check, every time.

Auth-mode check. To label a server offline-mode, online-mode, or whitelisted, we open a login handshake with a placeholder username, but never complete it - we read only the server's first response (disconnect / encryption request / login success), then the connection ends. No session, no real credentials, nothing past that one packet. Runs once per server, on first discovery only; every check after that is status-ping only.

Player "sightings" come from the status ping's player sample - the same list visible in the in-game multiplayer tab - or a normal join, never from server files, databases, or plugin data.

Why this isn't "hacking"

Laws like Germany's §202a StGB and equivalents elsewhere in the EU criminalize circumventing an access control to reach data specially protected against unauthorized access. Legal analysis of this statute is explicit that a scan only becomes a problem when it overcomes a security barrier to reach something behind it.

The status ping never touches an access control at all - it's a public response, no credentials required. The auth-mode check goes a step further by opening a login handshake, but still never overcomes anything: whitelisted servers reject it immediately, online-mode servers halt it at an encryption request no session ever completes, and nothing protected is ever reached. It reads how the door responds, not what's behind it.

This pattern - a partial protocol exchange used to identify a service without completing a session or accessing anything behind it - is standard practice for services like Shodan, Censys, and the Shadowserver Foundation, and for tools like nmap's service/version detection.

Data protection (GDPR)

MineScan is operated from within the EU. Server IPs and player identifiers can qualify as personal data under GDPR, so we treat them that way: we only collect what's already publicly exposed by the server's own configuration, the auth-mode check runs once and never repeats, and we provide a working self-service removal mechanism for anyone to opt out. That's the actual compliance mechanism a data protection authority looks for, not just a courtesy feature.

Remove your data

Received a legal threat about MineScan?

1. Use the opt-out portal above to remove and permanently blacklist your server or account - a few minutes, no back-and-forth needed.
2. If you still want to raise a concern, read the reasoning above first - most "unauthorized access" or "spying" claims don't hold up against what's actually happening technically.
3. If you believe MineScan is doing something beyond what's described here, reach out on Discord with specifics so it can actually be looked into.