Privacy

The short version

• A Paradox account is needed to use the launcher. It is free, and creating one asks for a name and a password - or a Google or GitHub sign-in - and nothing else.
• No advertising, no analytics SDK, no tracking pixels, no cookies. Nothing is sold or handed to a data broker, an ad network or an analytics company.
• Passwords are stored as PBKDF2-SHA256 hashes with a random salt per account, never in plain text.
• Your Microsoft and Minecraft credentials never reach our servers. They live on your own machine.
• Direct messages are end-to-end encrypted. The server keeps ciphertext it cannot read.
• Where you are standing in the game is sent to friends you accepted, from memory, and is never written to disk.

Playing does not require us

The client runs on your own machine, wherever the launcher installed it. It talks to our server only when you sign in to a Paradox account inside it, and only for the parts that need a server: friends, messages, voice calls and cloud settings. Everything else - the HUD, the waypoints, the modules, the settings on your disk - runs with the network unplugged, and the game never waits on us.

The launcher, if you use it, asks our server three things: the update manifest, the launch plan that says which files the current build is made of, and the two public counters shown in its window. The plan request sends the launcher version, your operating system, the CPU architecture and the release channel. It carries no account, no name and no identifier of your machine.

A Paradox account

An account exists so that friends, messages and cloud settings can work. It is the only record we keep about a person, and this is what is in it:

name

The name you chose, 3 to 20 characters. It is not your email.

uid

Eight random characters, so friends can add you without anyone guessing short names. It never changes.

salt, hash

A random 16-byte salt and a PBKDF2-SHA256 hash of your password at 600,000 iterations. The password itself is checked and dropped; it is never written anywhere. An account created through Google or GitHub has both fields empty and cannot be entered with a password at all until you set one.

mojang, nick

If the account is tied to a Minecraft account: that account's uuid, and the last in-game name we saw you under. The uuid comes from Mojang's answer to our own request, never from something the client claims about itself.

created

When the account was registered.

friends, invites

Who you are friends with, and pending invitations either way.

privacy

Your own switches: whether friends see your position, dimension, game mode, health, inventory or waypoints, and whether the client badge shows next to your name.

key, identity

Public keys only - an X25519 key for message encryption and an Ed25519 key that signs it. The private halves are generated on your device and stay there.

mail, receipts

Encrypted messages waiting for you because you were offline, and delivery marks waiting to go back to whoever wrote to you.

configs

Your saved client settings as JSON, each with a name, a share code and the name of whoever built it.

role

Whether the account is an ordinary user, a beta tester, an admin or the owner. Almost every account is the first one.

banned

Whether the account was closed, and by that alone - the reason is not kept in the record. See the terms for what closes one.

providers, email

Linked Google, GitHub or Discord accounts, and an email address if one arrived with a link or you gave us one. See below for what the address does and does not do.

avatar

An optional profile square you uploaded on the account page, cropped and stored on our server so friends and the config catalogue can show it.

plus, cosmetics

If you have or had Paradox Plus: when it started, when it runs out, and any individual cosmetic items granted to the account.

device

Whether the account last connected from the desktop launcher (pc) or the mobile launcher (mobile).

A session is a random 32-byte token that expires after 72 hours; an account keeps at most five at once, and the oldest falls off when a sixth is issued. The server keeps only a hash of the token, so a stolen database does not sign its thief in. Signing out deletes the session on the server, not just in your client.

Signing in with Google or GitHub, and linking Discord

You never type a Google, GitHub or Discord password into anything of ours - the sign-in happens on their site, and we get back a code. We ask for the smallest scope each provider offers for the one thing we need, which is to know who came back: openid email profile at Google, read:user at GitHub, and identify at Discord when you link your Discord account from the profile page to receive the linked role on our server. No repositories, no contacts, no drive, no guilds list, no permission to act as you.

We exchange the code for a token, make exactly one request with it to ask who you are, and then throw the token away. It is never stored and never used again. From the answer we keep four things: which provider it was, the permanent identifier they call you by (sub at Google, the numeric id at GitHub and Discord), the login or display name, and the email address if the provider reported one.

Microsoft and Minecraft

Signing in to Microsoft happens between you and Microsoft. We are not in the middle of it and we never see your Microsoft password. What the launcher gets back lives on your machine only: the refresh token is written to a file encrypted by your operating system's keychain, and the session token used to start the game is held in memory and disappears when the launcher closes. On a machine with no keychain available, nothing is written at all and you sign in again next time - we would rather ask twice than leave a token in plain text next to the game.

An offline profile stores even less: a name and the uuid every offline-mode server derives from that name. There is no secret in it, and it never leaves your computer.

Whether your Microsoft account owns Minecraft: Java Edition is a question the launcher puts to Mojang, and the answer is yes or no. Ownership is not something we can grant, check on our own or store.

Messages and voice

Direct messages are end-to-end encrypted, and are stored only when they cannot be delivered: if your friend is offline, the encrypted message waits in their mailbox and is deleted the moment their client confirms it arrived. A mailbox holds at most 512 of them, and the oldest is dropped to make room. There is no key on the server that opens any of it, which means we cannot read your messages - not for moderation, not on request from you, not by mistake.

Voice and screen share are encrypted between the devices and relayed live. Nothing about a call is written down - no recording, no participants, no duration.

Friends and presence

While you are in the game with the client signed in, friends who you accepted can see what your own privacy switches allow: position, dimension, game mode, health, inventory and waypoints. New accounts start with position, dimension and game mode on, and the rest off.

None of it is stored. Presence lives in memory on the server for as long as your connection does, and no position packet ever touches the disk. Close the game and there is nothing left to look at - not for us, and not for anyone who takes the server.

What the site and the server see

This site is static files. It sets no cookies, loads nothing from any host but ours, and has no analytics of any kind. When you sign in on the site, the session token is kept in your browser's local storage - it is yours to clear, and signing out removes it here and revokes it on the server.

The two numbers on the front page - players online and accounts registered - are counts and nothing else. They contain no names, and who is online is visible only to your friends inside the client.

Like any web server, ours receives the IP address that every HTTP request carries, and its ordinary access and error logs record it. They exist to keep the service running and to see what broke. They are not joined to accounts, not used to build a profile of anyone, and not shared.

How long things are kept

• Account data: until the account is deleted.
• Sessions: 72 hours, or until you sign out.
• Undelivered messages: until delivered, then removed.
• The one-time codes used during a Google or GitHub sign-in: two minutes, and they are spent on first use.
• Presence: only while you are connected.
• Server logs: rotated by the server, and read only when something breaks.

Deleting your account

Ask, and it is deleted. Write to support@paradoxclient.com, or message us in Discord or Telegram from the account, and an admin removes it. Deletion is immediate and permanent; any live connection is cut at the same moment.

What is removed:

• The account record entirely - name, uid, the password salt and hash, the Minecraft uuid and name, your avatar, your public keys, your privacy settings, your mailbox and delivery marks, every saved config, your Plus status and cosmetics, your email address and every linked Google, GitHub or Discord account.
• Every friendship and pending invitation, on both sides: you disappear from other people's friend lists too.
• All live sessions, everywhere.

What deletion honestly does not reach:

• Anything already on someone else's machine: messages that were delivered, a config someone imported with your share code, a screenshot of your name.
• Encrypted backup snapshots of the database: one taken before the most recent deploy, plus daily ones kept for a week and Monday ones for a month. They age out on their own - the oldest a deleted account can linger in any of them is about five weeks - and they are not restored except after a failure.

Who else gets any of this

No analytics vendor, no ad network and no buyer. The services that appear at all are the ones you choose to use: Mojang and Microsoft when signing in with a Microsoft account, Google, GitHub or Discord when you sign in or link with theirs, and Robokassa if you buy Plus. Each of them sees the request that goes to it and nothing more.

We would hand over data if a court with jurisdiction over the operator required it. It is worth knowing exactly how little that would be: hashes and public keys are not passwords and not messages, and ciphertext without a key is noise to everyone, us included.

Paying for Plus

Card details and bank credentials never reach this site or our servers. Paying in rubles opens Robokassa's own hosted page - we could not show you your card number if we wanted to, because we have never had it.

What we do keep is the little that is needed to know what you bought, prevent a webhook from crediting the same payment twice, renew the same plan, and help you if you ask for support or a refund: the day the pass started, the day it runs out, and a purchase record with the provider's invoice id, your account name, the plan, the amount, the payment method and the timestamp.

Robokassa is a payment processor and holds what a payment processor holds: the payment instrument, the charge, the tax receipt, and whatever its own rules make it keep. Its privacy notice governs that part, not this one. We pass it the amount, the plan and your Paradox account name, so the payment can be credited to the right account.

Paying in rubles through Robokassa renews on its own at the end of the paid period, at the same price, until you turn auto-renewal off on /plus/. The days already paid stay until they run out. We keep the parent invoice id Robokassa assigned, so a later charge can be tied to the same account. That id is not a card and not a bank credential.

Deleting your account removes the active subscription state with everything else. It does not, by itself, reach into a payment processor's books or erase our accounting log of past transactions - a receipt for a payment that really happened has to survive for refunds and tax accounting.

Children

The client is not aimed at children under 13 and accounts are not knowingly kept for them. If you are a parent and an account for your child exists, ask and it will be deleted like any other.

Changes, and how to ask

If this page changes, the date at the top changes with it, and anything that actually affects what is collected is announced in Telegram rather than slipped in quietly. Questions about any of the above - including a request to see or delete what is stored about you - can be sent to support@paradoxclient.com or in Discord, where the people who build this actually are.

Operator of this data and seller of Paradox Plus (payer of professional income tax, NPD): Klimov Artyom Konstantinovich (Климов Артём Константинович), INN 667222284833, email: support@paradoxclient.com.