Privacy and Data Erasure

NeroAgriculture is built to be POPIA- and GDPR-friendly: it stores the minimum player data, never a name, and everything it does keep can be erased through Neroland Core.

What player data is stored#

Only two kinds, both keyed by UUID only (never a username or display name):

• Machine ownership — the Planter, Harvester, Fertiliser Applicator, Terraforming Controller, fabrication machines (Extractor/Infuser/Synthesizer/Research Bench), crop towers and grow beds may record the placing player's UUID so a claims/protection mod can authorise their edits and so progression (gate unlocks, research checks) is credited to the machine's owner rather than whoever stands nearby. This is opt-out via automation.track_owner = false, in which case no owner is stored and player-gated automation cannot resolve a player. The UUID is server-only — it is never sent to clients.
• Material milestones / research — which materials and seeds a player has discovered or researched is tracked through Core's shared progression store, not by this mod directly.

Plus one transient, in-memory value: each online player's last-seen dimension, used by the Nerospace planet-visit adapter on Fabric to notice that they changed world. It is never written to disk, never logged, dropped when the player disconnects and when the server stops, and cleared immediately by an erasure request. When Nerospace is installed, the same adapter also reads the joining player's own Nerospace planet-visit list once per join to credit planet-bound research; nothing from it is kept beyond the resulting Core milestone.

Everything else — the material catalog, greenhouse state, tower crops and contents, terraformed regions, cycle phases — is world data with no player attribution.

What is never stored#

No usernames or display names, no chat, no location history, and no play-time analytics. Aggregate world/environment data is never linked to a player.

Companion clients (the NeroLink module)#

NeroAgriculture registers a link module with Neroland Core so a companion client can show you your own farm. This is a data-processing surface, so it is worth stating exactly what it exposes:

• It stores nothing new. The module is a read view over live block-entity state and Core's existing milestone store. It adds no table, no log and no per-player record of its own.
• Own machines only. Every section is scoped to the requesting player's UUID before anything leaves the mod — the machines that UUID owns, and nothing else. It does not widen for operators, and it never falls back to "the nearest player". Crop towers are not yet included in the link schema.
• What leaves the mod: your grow beds and machines with their positions and state, the greenhouses enclosing your beds, and your per-tier fragment-ladder progress. A shared greenhouse reports how many crops are inside, never whose.
• What a client may change: one thing — marking your own alert read. No link action can plant, harvest, fertilise or alter crops, yours or anyone's.
• Erasure is automatic. Every read starts from the owner UUID on a block entity, so an erased player owns nothing and every section answers empty for them; no extra eraser is needed.
• Opt out with link.module_enabled = false, which registers nothing at all.

The bridge that actually serves this to a device is the separate NeroLink mod, with its own disclosure; without it installed nothing reads Core's registry. Full detail: NeroLink module.

Anonymous crash reporting (opt-out)#

Like the rest of the Neroland family, NeroAgriculture includes crash/error reporting, on by default and opt-out, via Sentry (EU-region servers) so bugs can be fixed. It is disclosed here for the POPIA/GDPR and CurseForge transparency rules:

• Opt-out: on by default, client-local. Set telemetryEnabled = false in config/neroagriculture.properties to switch it off (takes effect on restart).
• NeroAgriculture errors only: an event is sent only if its stack trace touches za.co.neroland.neroagriculture; everything else is dropped before sending.
• No personal data: never a name, UUID, IP, hostname or world data. Home-directory paths (which contain the OS account name) are scrubbed. The payload is a stack trace plus public version strings — mod / Minecraft / loader / OS / Java versions and the loaded-mod list.
• Bounded: per-session de-duplication and a hard cap of 10 events per session; nothing is stored on disk locally.

Erasure#

Erasure is requested through Neroland Core: /neroland data eraseme for your own data, or /neroland data erase <uuid> for an operator-initiated request. Core's inactivity retention sweep triggers the same path.

No export command. Neither NeroAgriculture nor Core ships an in-game data-export command, and Core's data.PlayerDataErasure hook covers erasure only. Core does expose a programmatic MaterialMilestones.exportPlayer(server, uuid) for milestone rows, but nothing calls it at runtime, and machine ownership has no export path at all. To exercise a right of access, contact info@neroland.co.za — the only player-linked values are the owner UUID on machines and Core's progression store, both readable from the world save by an operator.

• Milestones/research erase through Core's shared data.PlayerDataErasure hook — a single erasure request purges a player across every Nero mod that registers with it.
• Machine ownership registers its own eraser with the same hook: an erasure request clears the owner UUID from every loaded owned machine (the machine simply becomes unowned). Breaking a machine also drops its owner.
• Unloaded chunks: an erasure request additionally stores a UUID tombstone in world saved data so machines whose chunks were unloaded at erasure time drop the owner the moment they load. Tombstones are pruned after a retention window (privacy.erasure_retention_days, default 90 days) and the UUIDs in them are never logged.
• Session state: the planet-visit adapter's in-memory last-seen-dimension entry is dropped in the same request, so an erasure leaves no trace of the player in memory either.
• Crash-safe tombstones. The tombstone file is read on every owned-machine load, so a corrupt or unreadable copy used to be a double failure: a repeating server crash and a silently failed erasure, because the tombstones that drop owners out of saved chunks were unreachable. It now loads through a recovery guard that falls back to a last-known-good backup and then to a fresh (empty) store, so the worst case is a degraded server rather than one that will not stay up.
  That backup is a second copy of the same UUIDs, so it is kept in step deliberately: a new tombstone is written to it in the same request that creates it, and an expired tombstone is removed from it in the same pass that prunes it. The retention window applies to both copies.

For administrators#

Set automation.track_owner = false to disable ownership recording entirely. Set link.module_enabled = false to stop exposing anything to companion clients. Player-data erasure is performed through Core's mechanism; NeroAgriculture participates automatically once Core processes a request.

See also: Administration, Configuration, NeroLink module.