Privacy Policy
What Mizan holds about players and organizations, where it comes from, why, and how long it's kept.
Last updated .
Who Handles Your Data
KORDU LTD runs Mizan, at mizan.ac and api.mizan.ac, and is the data controller for everything on this page except where a community's dashboard says otherwise below. Company number 16836154, registered in England and Wales. The registered office is First Floor Office, 3 Hornton Place, London W8 4LZ.
Most of what Mizan holds about players doesn't come from the players themselves, so we can't tell each one directly. This page is how we tell them, as Article 14 of the UK GDPR allows when writing to each person isn't possible.
What Mizan Holds About Players
Bans from public lists. Mizan reads the ban lists game communities publish on their own websites, and Ban lists names every one. For each ban it keeps what the list shows: the player's account ID (usually a SteamID), the name the list gives them, the reason, when the ban started and ends, the game or server it was given on, and the admin who gave it when the list names one. Where a reason says the player is another account ("alt of ..."), Mizan notes the link between the two accounts.
Lists we ask about each player. A few lists publish no whole list and answer one player at a time: Chronon Labs, the Community Ban List, Rent-a-Medic and RustBans.com. To read their bans, Mizan sends them the account IDs it already holds, a batch at a time.
Bans organizations add. An organization that contributes can send its own bans through the API, with the same kinds of details.
Mizan's own findings. Mizan's anti-cheat runs on Justified's game servers. When it catches cheating, the record shows the account, what was detected and when. Justified's own privacy policy covers what its servers record while you play there.
Public Steam details. When someone looks up a Steam account, Mizan reads what Steam publishes about it: its name and avatar, names it used before, Steam's own ban flags, its level, and its friends list and game library if they're public. Accounts with a ban on record are read again on a schedule, so their records stay current, and we keep a history of what changed between reads. Whatever Steam keeps private stays private here.
Other platforms. Lists also name Minecraft, Discord, Xbox, Epic Games and FiveM accounts, and Mizan keeps their bans the same way. Looking up a Minecraft player by name asks PlayerDB and Mojang for the account's UUID, name and skin, and the skin's face is shown on the record.
Lookups. We see the account ID that was looked up and the IP address the request came from, which is used to apply rate limits. We count how often each record is viewed each day, without keeping who viewed it, and we don't keep a history of who looked up whom.
What a Community's Dashboard Holds
A community that uses Mizan's dashboard keeps records about the players on its own servers there. The community decides what its staff record and why, and we store it for them. Ask that community about its records first; you can also come to us.
- Each join its servers report: the account, the name used in game, when the player joined and left, which server, and Mizan's answer
- Notes, coloured flags and warnings its staff add to a player
- Accounts its staff decided are, or aren't, the same person
- The Discord account a member linked to their Steam account with /verify
- Appeals a player sends it from their mizan.ac account, and the messages on each one
- Evidence files its staff upload, such as screenshots and videos
- A log of what its staff and Mizan did, which names the players involved
What Mizan Holds About Organizations
An organization that uses the API gives us its name and description, its servers' names, games and addresses, the accounts of the people who manage it, and its API keys. Each request it makes is checked against its key and counted against its rate limit. We record each request's key, route, result, timing and the country it came from, so the organization can see its usage.
Your Account on mizan.ac
You can sign in with Steam, with Discord, with an email address and password, or with a link we email you. We keep the account's name, avatar and email address (Steam gives none, so an account made with Steam has a placeholder address), the Steam or Discord account you signed in with, and two-step verification if you turn it on. Each sign-in session records the IP address and browser it started from, so you can see your sessions and we can spot misuse. Emails come from noreply@mizan.ac and are sent through Cloudflare. The sign-in pages use Cloudflare Turnstile to keep bots out.
Apps and AI agents. An app or AI agent can ask to read player records on your behalf through mizan.ac/mcp. You approve it on mizan.ac, and we keep its registration, what you allowed it to do and its access tokens until you or the app revoke them. It reads the same public records as anyone else.
You need to be 13 or older to make an account.
Who Can See What
Anyone can read a player's record on mizan.ac: each ban with its reason and dates, under the name of the community or organization that published it, the admin's name where that list shows it publicly, and Mizan's own findings. Organizations with a key read the same record through the API.
A community's dashboard records are seen only by that community's members, and by Mizan's staff when they help it or answer a request. An appeal's messages are seen by the player who sent it and that community's staff.
A Steam avatar on a record is loaded from Steam's servers, so Steam can see the visitor's IP address.
How Communities Use Mizan's Answers
When a player joins a server that checks with Mizan, Mizan answers with a risk level worked out from the bans on the player's record and Mizan's own findings, and with what that community's own join policy says to do: let the player in, flag the join, or refuse it. The community sets that policy, so a refusal is the community's decision on its own servers. To have one looked at by a person, ask the community. If it rests on a finding of Mizan's anti-cheat, open a ticket as the disputes page explains.
Why We Use It
- To keep and publish player records, so game communities can keep cheaters and rule breakers off their servers and players can see what is said about them. This is our legitimate interest, and the communities'. The bans come from lists their communities already publish. We weigh it against the players' interests, with extra care for players who are children.
- To run a community's dashboard as it asks. This processing is necessary to perform our contract with it.
- To apply rate limits and keep Mizan running and safe from abuse. This is our legitimate interest.
- To provide your account, an organization's account and API access. This processing is necessary to perform our contract with you or it.
- To answer requests from the police or a court. This processing is required to meet our legal obligations.
A list's reason is shown in that list's own words. If one accuses a player of a crime or reveals sensitive details about them, such as their health, tell us and we'll hide it and show only its category.
Cookies
mizan.ac uses no advertising cookies. If you sign in, a cookie keeps you signed in, and a second one remembers which way you signed in last, so the sign-in page can offer it first. Your browser also keeps your account's name and picture in its local storage, so the account button shows straight away; it is cleared when you sign out. The network in front of the site, and the bot check on the sign-in pages, may set their own cookies to keep the site up and block attacks.
We use Cloudflare Web Analytics to count page views and see how fast pages load. Its script, from static.cloudflareinsights.com, reads each page's load timings and stores nothing in your browser: no cookies and no local storage. Cloudflare says it doesn't fingerprint visitors or follow them across sites.
You can object to both at no cost. Blocking static.cloudflareinsights.com in your browser or with a content blocker stops the analytics, and the site works the same without it. Clearing mizan.ac's cookies and site data removes the sign-in preference and the saved name and picture.
Who Else Handles It
- Our hosting, database and network providers, including Cloudflare, which also sends our email, runs the sign-in bot check and Web Analytics, and PlanetScale, which runs our database
- Steam, for public profile details and the avatars shown on records
- PlayerDB and Mojang, for Minecraft names and skins
- Chronon Labs, the Community Ban List, Rent-a-Medic and RustBans.com, which receive account IDs so they can answer with their bans
- Discord, if you sign in with it, verify with Mizan's bot, or a community sends its alerts to a Discord channel
- jsDelivr, which serves the script the API documentation at api.mizan.ac/docs runs on
- Organizations with an API key, which read player records
- Justified, our own game community, which uses the registry to protect its servers
- The police or a court, when the law requires it
We don't sell personal data, and we don't work with advertisers or data brokers. Some of our providers process data outside the UK, including in the United States. Where a US provider is certified under the UK Extension to the EU-US Data Privacy Framework, that covers the transfer. For any other transfer, contact us and we'll tell you which safeguard applies.
How Long We Keep It
We keep each kind of data for as long as its purpose needs and then delete it. Counts that name no one are kept for the statistics.
| What | How long |
|---|---|
| A ban in force on a community's list | While the list publishes it |
| A ban that has ended, been lifted or left its list | Six years after it ended, then deleted |
| Bans an organization adds through the API | While the organization keeps them, then six years after each one ends |
| Findings of Mizan's anti-cheat | Six years after the last finding. A finding a review clears is deleted at once |
| The history of changes to each ban | 90 days |
| Public Steam details, and the history of how they changed | Six years for an account with a ban on record. Otherwise 12 months after it was last looked up |
| Joins a community's servers report | 90 days |
| A community's dashboard log of what its staff and Mizan did | One year |
| A community's notes, flags, warnings, alt decisions and Discord links | Until the community deletes them, and no longer than 30 days after the community is deleted |
| Appeals, their messages and evidence files | While the ban they concern is kept, and at least two years after the appeal is decided |
| The IP address a request comes from | Counted against the rate limit for the minute it covers. Our hosting provider's request logs keep it for up to 7 days |
| The IP address and browser of a sign-in session | 30 days after the session ends |
| Records of each request an API key makes | Three months |
| Organization accounts, their servers and keys | While the organization exists |
| Your mizan.ac account | Until you ask us to delete it, or three years after you last signed in |
| An app or AI agent's access to your account | Until you or the app revoke it |
| Backups of the database | Two days, so deleted data is gone from them two days later |
| Counts by list, game, server and day, which name no one | Kept indefinitely |
Your Rights
Under UK data protection law you can ask us to:
- Give you a copy of the personal data we hold about you
- Correct anything inaccurate
- Delete it
- Restrict how we use it
- Give it to you in a format you can take elsewhere
You can also object to anything we do on the basis of our legitimate interests, including publishing your record. We'll stop unless we have compelling grounds to continue, and we'll tell you what they are.
A ban from a community's list is that community's decision, so the quickest way to get one corrected or removed is usually through them. The disputes page explains how, and what we do when you come to us directly.
Mizan's staff at KORDU LTD handle every request; the contact page says what to send. We'll ask you to prove the account is yours, then answer within one month of having that proof, as Article 12(3) of the UK GDPR requires. A complex request, or several from you, can take up to two months more, and we'll tell you why within the first month. The ICO explains these time limits.
Complaints
If you think we've got something wrong with your data, complain to us first, by email or by post as below, and say it's a complaint. We'll confirm we have it within 30 days, look into it, and tell you what we found and did.
You can also complain to the Information Commissioner's Office at ico.org.uk. If you live in the EEA, you can also complain to your local data protection authority.
Changes
We update this page when what Mizan holds or how it uses it changes. The date at the top shows the current version.
Contact
Email contact@mizan.ac. By post, write to KORDU LTD, First Floor Office, 3 Hornton Place, London W8 4LZ, and say your letter is about Mizan.