NUTclientPrivacy Policy
1. Controller and contact
The controller responsible for the processing of personal data described here is [Operator name], [Street and number, postal code, city, country], e-mail [contact e-mail address] ("we"). This Privacy Policy explains what data we process when you use the NUTclient launcher, the Client, our websites, our servers and our Discord server, why we do it, on which legal basis, how long we keep it and which rights you have. We try to collect as little data as possible and we do not sell your data.
If you are in the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (GDPR) or comparable law applies. If you live elsewhere, we apply the same principles as far as possible.
2. Overview in plain words
The launcher and the Client work largely on your computer. Your settings, instances, waypoints, clips and screenshots stay on your computer unless you use a feature that sends them somewhere. Online features (friends, chat, cosmetics, shop, sync, gallery, support) need our server. Before the first start the launcher asks for your consent to register the installation and to send basic device information; you can refuse or withdraw consent and keep using the offline parts where possible.
3. Data we process and why
Website visits. When you open our website, our web server processes your IP address, the date and time, the requested file, the status code, the amount of data and the browser's user agent and referrer. We use this to deliver the website, keep it secure and find errors. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Server logs are kept for a short period (typically up to 14 days) unless needed to investigate an incident. The website does not use advertising or analytics cookies; it stores your language and theme choice in your browser's local storage.
Microsoft sign-in. To verify that you own Minecraft, the launcher uses the Microsoft sign-in flow, then Xbox Live, XSTS and the Minecraft services. We receive and store on your device your Minecraft profile name, UUID, and the access and refresh tokens needed to start the game and to renew your session. The tokens are kept in a file in the launcher's data folder, not on our servers. Our servers may receive your UUID and name to create your NUTclient account, to check an allow-list or ban list and to link cosmetics. Legal basis: performance of the contract (Art. 6(1)(b)).
NUTclient account and online features. When you use online features we store: your Minecraft UUID and name; an API key (stored as a hash or in a protected form); your friends, follows and friend requests; chat messages you send to friends (until you or the recipient delete them or the retention period ends); your presence (online status and the server you are on, only while you are online and only if you have not turned this off); your privacy settings; equipped and unlocked cosmetics and emotes; credits and the log of credit changes; NUT+ status; party membership; codes you redeem; social links you choose to publish; your nametag text; posts, reactions and reports in the gallery and feed; and support or ticket data you send us. Legal basis: performance of the contract (Art. 6(1)(b)) and, for optional extras, legitimate interest (Art. 6(1)(f)).
Installation registry and device information. If you consent in the launcher, we register the installation and receive: a random installation identifier created on your device, the launcher and Client version, the operating system and its version, the CPU model, the amount of RAM, the graphics adapter, your IP address as seen by our server, and the time of the last start. We use it to count active installations, fix compatibility problems and reach out about critical bugs. We do not read hardware serial numbers and we do not use the data to track you across other services. Records are deleted after 365 days without activity and immediately when you withdraw consent in the launcher. Legal basis: consent (Art. 6(1)(a)).
Crash reports and support uploads. If you choose to upload a log or a crash report, it is stored under a support ID that you can give to us. Logs can contain file paths on your device, your user name and the names of your mods. Please review them before sending. They are used only to diagnose the problem and are deleted after the case is resolved or after a limited period. Legal basis: consent / your request (Art. 6(1)(a), (b)).
Login and access checks. When the launcher or the Client starts, they ask our server whether your account is allowed to use the Services (for example during a closed beta or maintenance). The request contains your UUID, name and the version. We log the result with a timestamp to protect the Services and to enforce bans. Legal basis: legitimate interest (Art. 6(1)(f)).
Server rules and server lists. The Client looks up rules for the server you join so that blocked modules can be switched off, and can show server icons, banners, flags and tags. This sends the server address to our server. It is not linked to your account unless you are signed in to online features. To show a country flag the Client may ask a geolocation service for the country of the server's IP address; this concerns the server, not you.
Lyrics and music display. If you switch on the lyrics or music modules, the Client reads the title, artist and playback position from the media session of your operating system on your device. To find lyrics it sends the track title, artist and length to the LRCLIB service. No account data is sent. Nothing is sent when the modules are off.
Synchronisation. If you use device sync, we store the manifests you upload (lists of instances, mods, settings, servers, resource packs and account names). We do not store your game files, your passwords or any tokens, and our server rejects fields that look like secrets. Access is controlled by your API key or a sync key that you can revoke.
Discord. If you join our Discord server, Discord processes your data under its own policy. Our bot stores the member and role data it needs to run the server, tickets, verification, applications and the beta programme, such as your Discord ID, name, roles and the content of tickets you open. Legal basis: legitimate interest and, where you contact us, performance of the contract.
Creator programme. If you enter a creator code, we store which code you used and the time, so that creators can see how many users they brought. We do not record your IP address or device information in the download link for creators. Legal basis: legitimate interest.
Screenshots, clips and files. Screenshots, clips, waypoint files and your settings are stored on your device. If you upload an image to a third-party host (for example Imgur) or post it in the gallery, the file and the metadata go to that host under its own rules. We store only the link in the gallery.
4. Recipients and processors
We use service providers who process data on our behalf, for example a hosting provider for our servers and a certificate authority for HTTPS. We have agreements in place that require them to protect the data. Data is also passed to: Microsoft and Mojang (sign-in and session services, as you request); Modrinth and CurseForge (download of mods you choose); LRCLIB (lyrics requests); GitHub (release files, update information and the public server mapping repository); Discord (community server); and media hosts you choose to use. We disclose data to authorities where the law requires it.
Our servers are located in the European Union. Some of the third parties listed above are located outside the EU or EEA, in particular in the United States. Where this happens we rely on adequacy decisions or standard contractual clauses as far as required.
5. Retention
We keep data only as long as it is needed for the stated purpose. Typical periods: web server logs up to 14 days; installation registry entries until you withdraw consent or after 365 days without activity; chat messages and friend data until deleted by you or until the account is deleted; credit logs and moderation records as long as needed to prevent abuse and to prove what happened, normally up to 24 months; support uploads until the case is closed or at the latest after 90 days; tickets on Discord until we close and delete the thread. Legal retention duties can require longer storage.
6. Your rights
You have the right to: access the personal data we process about you; have inaccurate data corrected; have data deleted; restrict processing; receive your data in a portable format; object to processing that is based on legitimate interests; and withdraw consent at any time with effect for the future. To exercise a right, contact us at the address above. We may ask you to prove that you control the account. You also have the right to lodge a complaint with a data protection authority, in particular in the country where you live, work or where the alleged infringement took place.
In the launcher you can withdraw consent for the installation registry and device information (settings), delete your sync data and remove your online account data on request. If you are not signed in, we usually cannot identify you in our data. In that case we may not be able to fulfil a request.
7. Children
The Services are not directed at children under 13, and in some countries the minimum age is higher (in the EU, between 13 and 16, depending on the country). Minecraft itself has its own age rules. If you are below the age of digital consent in your country, ask a parent or guardian before using online features. If we learn that we hold data of a child without the required consent, we delete it.
8. Security
We use technical and organisational measures such as encrypted connections (HTTPS), access control, hashed credentials where possible, rate limiting and server hardening. No system is perfectly secure. Account tokens that are stored on your device are protected by your operating system account only. If we become aware of a data breach that is likely to put you at risk, we will inform you and the authorities as the law requires.
9. Automated decisions
We do not take decisions that produce legal effects about you based solely on automated processing. Basic automated checks (such as rate limits, ban lists and the allow-list for a closed beta) are applied to protect the Services.
10. Cookies and local storage
Our website does not set cookies for advertising or analytics. It uses your browser's local storage to remember your language and theme. You can clear it in your browser at any time. The launcher stores its state in files in its data folder and in the web view storage of your computer.
11. Changes to this policy
We update this Privacy Policy when the Services or the law change. The current version is published on this website. For material changes we will inform you in the launcher or on our Discord server before they take effect, where the law requires it.