XMCL Open-Source Project Privacy Notice
Effective date: August 21, 2026 · Version: OP2-2026-08-21
This notice covers the public XMCL website (xmcl.app) and the free, open-source XMCL launcher. It does not cover paid features, accounts, billing, AI, or multiplayer signaling/TURN services provided by XMCL Together, which are governed separately by the XMCL Together Privacy Policy.
1. Data Controller and Contact
XMCL is an independent open-source project operated by CI010 and the Voxelum contributor community.
- Privacy & Legal Inquiries: cijhn@hotmail.com
- Source Code Repository: github.com/voxelum/x-minecraft-launcher
- Security Vulnerability Reporting: GitHub Security Advisories
2. Information Processed & Minimization
XMCL follows the principle of strict data minimization.
Public Website (xmcl.app)
- Aggregated Analytics: We use Microsoft Azure Application Insights to record anonymous page views, download selections, general network/device attributes, and browser user-agents.
- Technical Cookies: We use a local cookie strictly to remember your interface language preference. We do not use third-party marketing, behavioral, or tracking cookies.
Open-Source Launcher
- Opt-in Telemetry & Diagnostics: Telemetry is disabled by default. Only if you explicitly activate telemetry in the launcher settings (Opt-in), the launcher may process:
- A randomly generated, pseudonymous installation/device identifier;
- Application lifecycle events (game launch, normal/error exit codes, application version);
- Authentication provider type (e.g., Microsoft or offline authentication identifier);
- Basic runtime environment specs (operating system, Java runtime version, CPU architecture);
- Error crash logs and stack traces.
- Sanitization: Crash diagnostics are stripped of sensitive file paths, usernames, and system tokens where feasible. We never process or store your Microsoft account passwords, credentials, or session tokens.
3. Data Retention
We strictly avoid indefinite or vague retention schedules:
- All telemetry logs, diagnostic error records, and performance metrics are retained for a maximum of 90 days, after which they are permanently deleted or fully anonymized.
- Public issue tracker reports on GitHub remain available under GitHub's platform policies and repository governance until resolved or deleted.
4. International Data Transfers
XMCL uses global infrastructure providers including Microsoft Azure, Cloudflare, GitHub, and Vercel.
- Standard Contractual Clauses (SCCs): We use European Commission-approved Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA) / Addendum to ensure an adequate level of protection when technical data is transferred outside the European Economic Area (EEA) and the United Kingdom.
5. Region-Specific Provisions and Legal Rights
🇪🇺 European Union & EEA (GDPR)
- Legal Bases: Consent (Art. 6(1)(a) GDPR) for optional diagnostic telemetry; Legitimate Interests (Art. 6(1)(f) GDPR) for security, bug diagnostics, and infrastructure availability.
- Opt-in Requirement: Diagnostic telemetry requires an affirmative, opt-in action (unchecked by default).
- Age of Consent: Users must be at least 16 years of age (or the relevant age of digital consent in their EU Member State, minimum 13) to consent to data processing independently. Minors below this threshold require parental or guardian consent.
- Your GDPR Rights: Under Articles 15–22 of the GDPR, you have the right to access, rectify, erase ("right to be forgotten"), restrict processing, port your data, object to processing, and withdraw consent at any time without detriment. You also have the right to lodge a complaint with your national EU Data Protection Supervisory Authority.
🇺🇸 United States (COPPA, CCPA / CPRA & State Laws)
- Children’s Online Privacy Protection Act (COPPA): XMCL is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us immediately at cijhn@hotmail.com for prompt deletion.
- California Consumer Privacy Act (CCPA/CPRA) Notice:
- Do Not Sell or Share My Personal Information: XMCL does not sell personal information and does not share personal information with third parties for cross-context behavioral advertising.
- Consumer Rights: California residents (and residents of states with applicable privacy statutes such as VA, CO, CT, UT, TX, OR) have the right to know what personal information is collected, request deletion, request correction of inaccurate data, and exercise these rights free from discrimination.
🇬🇧 United Kingdom (UK GDPR & DPA 2018)
- Regulated under the UK General Data Protection Regulation and the Data Protection Act 2018.
- Age of Consent: 13 years of age for information society services.
- Regulatory Authority: You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.
6. Exercising Your Rights
To exercise your rights of access, rectification, erasure, or consent withdrawal, contact CI010 at cijhn@hotmail.com.
7. Disclaimer Regarding Minecraft & Mojang
XMCL is an independent open-source software project and is not affiliated with, authorized by, sponsored by, or endorsed by Microsoft Corporation or Mojang Studios.