Privacy

The short version

• A Paradox account is needed to use the launcher. It is free, and creating one asks for a name and a password — or a Google or GitHub sign-in — and nothing else.
• No advertising, no analytics SDK, no tracking pixels, no cookies. Nothing is sold or handed to a data broker, an ad network or an analytics company.
• Passwords are stored as PBKDF2-SHA256 hashes with a random salt per account, never in plain text.
• Your Microsoft and Minecraft credentials never reach our servers. They live on your own machine.
• Guild messages are end-to-end encrypted. The server keeps ciphertext it cannot read.
• Where you are standing in the game is sent to friends you accepted, from memory, and is never written to disk.

Playing does not require us

The client runs on your own machine, wherever the launcher installed it. It talks to our server only when you sign in to a Paradox account inside it, and only for the parts that need a server: friends, guilds and cloud settings. Everything else — the HUD, the waypoints, the modules, the settings on your disk — runs with the network unplugged, and the game never waits on us.

The launcher, if you use it, asks our server three things: the update manifest, the launch plan that says which files the current build is made of, and the two public counters shown in its window. The plan request sends the launcher version, your operating system, the CPU architecture and the release channel. It carries no account, no name and no identifier of your machine.

A Paradox account

An account exists so that guilds and cloud settings can work. It is the only record we keep about a person, and this is what is in it:

name

The name you chose, 3 to 20 characters. It is not your email.

uid

Eight random characters, so friends can add you without anyone guessing short names. It never changes.

salt, hash

A random 16-byte salt and a PBKDF2-SHA256 hash of your password at 600,000 iterations. The password itself is checked and dropped; it is never written anywhere. An account created through Google or GitHub has both fields empty and cannot be entered with a password at all until you set one.

mojang, nick

If the account is tied to a Minecraft account: that account's uuid, and the last in-game name we saw you under. The uuid comes from Mojang's answer to our own request, never from something the client claims about itself.

created

When the account was registered.

friends, invites

Who you are friends with, and pending invitations either way.

privacy

Your own switches: whether friends see your position, dimension, game mode, health, inventory or waypoints, and whether the client badge shows next to your name.

key, identity

Public keys only — an X25519 key for message encryption and an Ed25519 key that signs it. The private halves are generated on your device and stay there.

mail, receipts

Encrypted messages waiting for you because you were offline, and delivery marks waiting to go back to whoever wrote to you.

configs

Your saved client settings as JSON, each with a name, a share code and the name of whoever built it.

role

Whether the account is an ordinary user, a beta tester, an admin or the owner. Almost every account is the first one.

banned

Whether the account was closed, and by that alone — the reason is not kept in the record. See the terms for what closes one.

providers, email

Linked Google or GitHub accounts, and an email address if one arrived with a link or you gave us one. See below for what the address does and does not do.

A session is a random 32-byte token that expires after 72 hours; an account keeps at most five at once, and the oldest falls off when a sixth is issued. Signing out deletes the token on the server, not just in your client.

Signing in with Google or GitHub

You never type a Google or GitHub password into anything of ours — the sign-in happens on their site, and we get back a code. We ask for the smallest scope each provider offers for the one thing we need, which is to know who came back: openid email profile at Google, read:user at GitHub. No repositories, no contacts, no drive, no permission to act as you.

We exchange the code for a token, make exactly one request with it to ask who you are, and then throw the token away. It is never stored and never used again. From the answer we keep four things: which provider it was, the permanent identifier they call you by (sub at Google, the numeric id at GitHub), the login or display name, and the email address they reported.

Microsoft and Minecraft

Signing in to Microsoft happens between you and Microsoft. We are not in the middle of it and we never see your Microsoft password. What the launcher gets back lives on your machine only: the refresh token is written to a file encrypted by your operating system's keychain, and the session token used to start the game is held in memory and disappears when the launcher closes. On a machine with no keychain available, nothing is written at all and you sign in again next time — we would rather ask twice than leave a token in plain text next to the game.

An offline profile stores even less: a name and the uuid every offline-mode server derives from that name. There is no secret in it, and it never leaves your computer.

Whether your Microsoft account owns Minecraft: Java Edition is a question the launcher puts to Mojang, and the answer is yes or no. Ownership is not something we can grant, check on our own or store.

Guilds, messages and voice

Guild chat is end-to-end encrypted. Your client encrypts a message before it is sent and signs it; the server appends the ciphertext to that channel's log and hands it to the other members. What is stored is the ciphertext, the nonce, the signature, which account sent it, and when. There is no key on the server that opens any of it, which means we cannot read your guild — not for moderation, not on request from you, not by mistake.

Direct messages work the same way, and are stored only when they cannot be delivered: if your friend is offline, the encrypted message waits in their mailbox and is deleted the moment their client confirms it arrived. A mailbox holds at most 512 of them, and the oldest is dropped to make room.

Voice and screen share are encrypted between the devices and relayed live. Nothing about a call is written down — no recording, no participants, no duration.

Friends and presence

While you are in the game with the client signed in, friends who you accepted can see what your own privacy switches allow: position, dimension, game mode, health, inventory and waypoints. New accounts start with position, dimension and game mode on, and the rest off.

None of it is stored. Presence lives in memory on the server for as long as your connection does, and no position packet ever touches the disk. Close the game and there is nothing left to look at — not for us, and not for anyone who takes the server.

What the site and the server see

This site is static files. It sets no cookies, loads nothing from any host but ours, and has no analytics of any kind. When you sign in on the site, the session token is kept in your browser's local storage — it is yours to clear, and signing out removes it here and revokes it on the server.

The two numbers on the front page — players online and accounts registered — are counts and nothing else. They contain no names, and who is online is visible only to your friends inside the client.

Like any web server, ours receives the IP address that every HTTP request carries, and its ordinary access and error logs record it. They exist to keep the service running and to see what broke. They are not joined to accounts, not used to build a profile of anyone, and not shared.

How long things are kept

• Account data: until the account is deleted.
• Sessions: 72 hours, or until you sign out.
• Undelivered messages: until delivered, then removed.
• The one-time codes used during a Google or GitHub sign-in: two minutes, and they are spent on first use.
• Presence: only while you are connected.
• Server logs: rotated by the server, and read only when something breaks.

Deleting your account

Ask, and it is deleted. There is no form for it yet — write in Discord or Telegram from the account, and an admin removes it. Deletion is immediate and permanent; any live connection is cut at the same moment.

What is removed:

• The account record entirely — name, uid, the password salt and hash, the Minecraft uuid and name, your public keys, your privacy settings, your mailbox and delivery marks, every saved config, your email address and every linked Google or GitHub account.
• Every friendship and pending invitation, on both sides: you disappear from other people's friend lists too.
• All live sessions, everywhere.
• Guilds you own: dissolved, with their invite code, their membership and their message history.
• Your membership in guilds owned by other people.

What deletion honestly does not reach:

• Messages you sent into a guild you do not own stay in that guild's history, still encrypted, with the sending account's name on them. Only that guild's members can read them and we still cannot — but they are somebody else's log, and erasing one person's lines from other people's conversations is not ours to do.
• Anything already on someone else's machine: messages that were delivered, a config someone imported with your share code, a screenshot of your name.
• One backup snapshot of the database, taken before the most recent deploy of the server. It is replaced by the next deploy and is not restored except after a failure.

Who else gets any of this

No analytics vendor, no ad network and no buyer. The services that appear at all are the ones you choose to use: Mojang and Microsoft when signing in with a Microsoft account, Google or GitHub when you sign in with theirs, and Stripe if you pay for Plus. Each of them sees the request that goes to it and nothing more.

We would hand over data if a court with jurisdiction over the operator required it. It is worth knowing exactly how little that would be: hashes and public keys are not passwords and not messages, and ciphertext without a key is noise to everyone, us included.

Paying for Plus

Card details never reach this site or our servers. Paying opens Stripe's own hosted page, and everything about the card happens there — we could not show you your own card number if we wanted to, because we have never had it.

What we do keep, on the account, is the little that is needed to know what you bought: the day the subscription started, the day it runs out, an identifier Stripe gave the subscription and one for the customer record behind it, and the id of each payment event we have already credited — that last one exists so a payment cannot be counted twice.

Stripe is a payment processor and holds what a payment processor holds: the card, the charge, and whatever their own rules make them keep. Their privacy notice governs that part, not this one. We pass them the amount, the plan and your account name, so the renewal can be credited to the right person.

Because Plus renews, Stripe keeps the card on file until the subscription is cancelled. Cancelling is a button on the Plus page; it stops the charges and leaves the days already paid for alone.

Deleting your account removes the subscription record with everything else. It does not, by itself, reach into Stripe's books — a receipt for a payment that really happened is theirs to keep, and a shop that could erase its own payment history would be a worse shop to buy from.

Children

The client is not aimed at children under 13 and accounts are not knowingly kept for them. If you are a parent and an account for your child exists, ask and it will be deleted like any other.

Changes, and how to ask

If this page changes, the date at the top changes with it, and anything that actually affects what is collected is announced in Telegram rather than slipped in quietly. Questions about any of the above — including a request to see or delete what is stored about you — go to Discord, which is where the people who build this actually are.