Privacy policy

What Mizan holds about players and organizations, where it comes from, why, and how long it's kept.

Last updated October 30, 2026.

Who handles your data

KORDU LTD runs Mizan, at mizan.ac and api.mizan.ac, and is the data controller for everything on this page except a community's dashboard records and what its game servers send for detection. We process those for the community under our data processing agreement. Company number 16836154, registered in England and Wales. The registered office is First Floor Office, 3 Hornton Place, London W8 4LZ.

Most of what Mizan holds about players doesn't come from the players themselves, so we can't tell each one directly. This page is how we tell them, as Article 14 of the UK GDPR allows when writing to each person isn't possible.

What Mizan holds about players

Bans from public lists. Mizan reads the ban lists game communities publish on their own websites, and Ban lists names every one. For each ban it keeps what the list shows: the player's account ID (usually a SteamID), the name the list gives them, the reason, when the ban started and ends, the game or server it was given on, and the admin who gave it when the list names one. Where a reason says the player is another account ("alt of ..."), Mizan notes the link between the two accounts.

Lists we ask about each player. A few lists publish no whole list and answer one player at a time: Chronon Labs, the Community Ban List, Rent-a-Medic and RustBans.com. To read their bans, Mizan sends them the account IDs it already holds, a batch at a time.

Bans organizations add. An organization that contributes can send its own bans through the API, with the same kinds of details.

Public Steam details. When someone looks up a Steam account, Mizan reads what Steam publishes about it: its name and avatar, names it used before, Steam's own ban flags, its level, and its friends list and game library if they're public. Accounts with a ban on record are read again on a schedule, so their records stay current, and we keep a history of what changed between reads. Whatever Steam keeps private stays private here.

Other platforms. Lists also name Minecraft, Discord, Xbox, Epic Games and FiveM accounts, and Mizan keeps their bans the same way. Looking up a Minecraft player by name asks PlayerDB and Mojang for the account's UUID, name and skin, and the skin's face is shown on the record.

Lookups. We see the account ID that was looked up and the IP address the request came from, which is used to apply rate limits. We count how often each record is viewed each day, without keeping who viewed it, and we don't keep a history of who looked up whom.

What a community's dashboard holds

A community that uses Mizan's dashboard keeps records about the players on its own servers there. The community decides what its staff record and why, and we store it for them. Ask that community about its records first; you can also come to us.

• Each join its servers report: the account, the name used in game, when the player joined and left, which server, and Mizan's answer
• Notes, coloured flags and warnings its staff add to a player
• Accounts its staff decided are, or aren't, the same person
• The Discord account a member linked to their Steam account with /verify
• Appeals a player sends it from their mizan.ac account, and the messages on each one
• Evidence files its staff upload, such as screenshots and videos
• A log of what its staff and Mizan did, which names the players involved

What the Mizan server module sends

A community can install the Mizan server module on its game servers. When it turns on the module's link to our detection service, the module sends, for each player on the server:

• their SteamID64 when they join, and a note when they leave
• for every command their game sends, many times a second: its number and timing, the direction they're looking, how far the mouse moved, which buttons and movement keys were held, and their movement input
• whether they were dead, spectating or in a vehicle, and whether the server or their weapon's recoil moved their view
• what they were aiming at: the nearest target, as a code that lasts for the session, how far their aim was from it, and where their eye and the target's head were on the map as the game's lag compensation saw them

It also sends the server's id, the game, its tick rate and number of player slots, the module's version and when the session started. It doesn't send names, chat messages or IP addresses. Everything it sends is something the game server already receives from the player's game or works out itself.

The detection service reads this as it arrives and looks for the patterns cheats leave. It sends its results back to that server, where the community's staff see them: which detector fired, how strong the evidence is, the commands it covers and a sentence on what it measured. When detectors that measure different things agree, it opens a case for staff to review. The results don't kick or ban anyone; the community decides what to do.

Recordings. On Mizan's own test servers, and on a community's servers only where it has agreed with us, the module can also record whole sessions so we can build and test detection. Besides everything above, a recording holds, many times a second:

• each command in full, including weapon changes and the random seeds the game uses for spread
• the player's position, speed and stance, and whether they were on the ground, typing or in a vehicle
• the positions of the other players on the server, and whether the nearest one was in sight
• shots, damage dealt and taken, deaths and who caused them, armour, and their weapon, its ammunition and when it could next fire
• network figures such as latency, packet loss and how fast their game sends, and a few of their game's network settings
• the map and its file's checksum, the game mode and the server's movement settings

Recordings don't include names, chat or IP addresses. They're stored with Cloudflare in the EU. Mizan's staff, and staff of the community whose server made them who have permission, can replay them on mizan.ac.

What Mizan holds about organizations

An organization that uses the API gives us its name and description, its servers' names, games and addresses, the accounts of the people who manage it, and its API keys. Each request it makes is checked against its key and counted against its rate limit. We record each request's key, route, result, timing and the country it came from, so the organization can see its usage. The detection service remembers the addresses each game server connects from, so it can keep room for them when it's under attack.

Your account on mizan.ac

You can sign in with Steam, with Discord, with an email address and password, or with a link we email you. We keep the account's name, username, avatar and email address, the Steam or Discord account you signed in with, and two-step verification if you turn it on. Every account gives an email address and confirms it with a link we send before it can be used, one made with Steam or Discord included, so we can reach you about your account. Each sign-in session records the IP address and browser it started from, so you can see your sessions and we can spot misuse. Emails come from noreply@mizan.ac and are sent through Cloudflare. The sign-in pages use Cloudflare Turnstile to keep bots out.

Apps and AI agents. An app or AI agent can ask to read player records on your behalf through mizan.ac/mcp. You approve it on mizan.ac, and we keep its registration, what you allowed it to do and its access tokens until you or the app revoke them. It reads the same public records as anyone else.

You need to be 13 or older to make an account.

Who can see what

Anyone can read a player's record on mizan.ac: each ban with its reason and dates, under the name of the community or organization that published it, and the admin's name where that list shows it publicly. Organizations with a key read the same record through the API.

A community's dashboard records are seen only by that community's members, and by Mizan's staff when they help it or answer a request. An appeal's messages are seen by the player who sent it and that community's staff.

Detection results go back to the server they came from, where that community's staff see them. Recordings are seen by Mizan's staff, and by staff of the community whose server made them who have permission.

A Steam avatar on a record is loaded from Steam's servers, so Steam can see the visitor's IP address.

How communities use Mizan's answers

When a player joins a server that checks with Mizan, Mizan answers with a risk level worked out from the bans on the player's record, and with what that community's own join policy says to do: let the player in, flag the join, or refuse it. The community sets that policy, so a refusal is the community's decision on its own servers. To have one looked at by a person, ask the community.

Why we use it

• To keep and publish player records, so game communities can keep cheaters and rule breakers off their servers and players can see what is said about them. This is our legitimate interest, and the communities'. The bans come from lists their communities already publish. We weigh it against the players' interests, with extra care for players who are children.
• To run a community's dashboard as it asks. This processing is necessary to perform our contract with it.
• To detect cheating on a community's servers with the server module. The community decides to run it, so it's the controller and relies on its own lawful basis, usually its legitimate interest in keeping cheating off its servers. We process the data for it under our data processing agreement.
• To build and test Mizan's detection with recordings. This is our legitimate interest. We weigh it against the players' interests, with extra care for players who are children.
• To apply rate limits and keep Mizan running and safe from abuse. This is our legitimate interest.
• To provide your account, an organization's account and API access. This processing is necessary to perform our contract with you or it.
• To answer requests from the police or a court. This processing is required to meet our legal obligations.

A list's reason is shown in that list's own words. If one accuses a player of a crime or reveals sensitive details about them, such as their health, tell us and we'll hide it and show only its category.

Cookies

mizan.ac uses no advertising cookies. If you sign in, a cookie keeps you signed in, and a second one remembers which way you signed in last, so the sign-in page can offer it first. Your browser also keeps your account's name and picture in its local storage, so the account button shows straight away; it is cleared when you sign out. The network in front of the site, and the bot check on the sign-in pages, may set their own cookies to keep the site up and block attacks.

We use Cloudflare Web Analytics to count page views and see how fast pages load. Its script, from static.cloudflareinsights.com, reads each page's load timings and stores nothing in your browser: no cookies and no local storage. Cloudflare says it doesn't fingerprint visitors or follow them across sites.

You can object to both at no cost. Blocking static.cloudflareinsights.com in your browser or with a content blocker stops the analytics, and the site works the same without it. Clearing mizan.ac's cookies and site data removes the sign-in preference and the saved name and picture.

Who else handles it

• Our hosting, database and network providers, including Cloudflare, which also sends our email, runs the sign-in bot check and Web Analytics, and PlanetScale, which runs our database
• OVHcloud, which hosts the detection service's server in Canada
• Steam, for public profile details and the avatars shown on records
• PlayerDB and Mojang, for Minecraft names and skins
• Chronon Labs, the Community Ban List, Rent-a-Medic and RustBans.com, which receive account IDs so they can answer with their bans
• Discord, if you sign in with it, verify with Mizan's bot, or a community sends its alerts to a Discord channel
• jsDelivr, which serves the script the API documentation at api.mizan.ac/docs runs on
• Organizations with an API key, which read player records
• The police or a court, when the law requires it

We don't sell personal data, and we don't work with advertisers or data brokers. Some of our providers process data outside the UK, including in the United States and, for the detection service, Canada. Where a US provider is certified under the UK Extension to the EU-US Data Privacy Framework, that covers the transfer. For any other transfer, contact us and we'll tell you which safeguard applies.

How long we keep it

We keep each kind of data for as long as its purpose needs and then delete it. Counts that name no one are kept for the statistics.

Your rights

Under UK data protection law you can ask us to:

• Give you a copy of the personal data we hold about you
• Correct anything inaccurate
• Delete it
• Restrict how we use it
• Give it to you in a format you can take elsewhere

You can also object to anything we do on the basis of our legitimate interests, including publishing your record. We'll stop unless we have compelling grounds to continue, and we'll tell you what they are.

A ban from a community's list is that community's decision, so the quickest way to get one corrected or removed is usually through them. The disputes page explains how, and what we do when you come to us directly.

Mizan's staff at KORDU LTD handle every request; the contact page says what to send. We'll ask you to prove the account is yours, then answer within one month of having that proof, as Article 12(3) of the UK GDPR requires. A complex request, or several from you, can take up to two months more, and we'll tell you why within the first month. The Information Commission explains these time limits.

Complaints

If you think we've got something wrong with your data, complain to us first, by email or by post as below, and say it's a complaint. We'll confirm we have it within 30 days, look into it, and tell you what we found and did.

You can also complain to the UK's data protection regulator, the Information Commission, at ico.org.uk. If you live in the EEA, you can also complain to your local data protection authority.

Changes

We update this page when what Mizan holds or how it uses it changes. The date at the top shows the current version.

Contact

Email contact@mizan.ac. By post, write to KORDU LTD, First Floor Office, 3 Hornton Place, London W8 4LZ, and say your letter is about Mizan.