Privacy Policy

1. Who we are

This policy explains how the team behind Wind Client ("we", "us") handles personal data when you use the Wind Client launcher, its in-game menus mod, its online features and the website windclient.com. We are the data controller for the data described here. You can reach us about anything privacy related at windsupport@windclient.com.

2. What stays on your computer

Wind Client stores the following locally rather than in our launcher database. Sign-in credentials are sent to Microsoft, Xbox and Minecraft services as needed to authenticate and play; local storage does not mean that those services never receive them:

• your Microsoft, Xbox and Minecraft sign-in tokens, stored encrypted by Windows
• Minecraft game files, Java, worlds, screenshots, mods, resource packs and shaders
• game logs and the game console output
• look-and-feel choices such as theme, interface size and motion settings
• your private device key, stored encrypted by Windows

3. What we store online

So the launcher can keep your setup, it saves the following on our server, which runs on Cloudflare:

These records include identifiers, internet/network activity and launcher or gameplay activity. Sources are you, your installation, Minecraft profile information returned during sign-in, players visible in your server's tab list, and technical information from network requests. We use them to provide the features described above and to protect the service, not to build advertising profiles.

The launcher does not ask for your real name, email address, payment details, precise location, contacts, health information or biometric identifiers, and it does not send your Microsoft password or chat messages to our database. If you email us, we receive your email address, the contents and attachments you choose to send, and any name you provide, to answer you and handle your request. Please do not send passwords, sign-in tokens, private device keys or unnecessary sensitive information. We do not use analytics, automatic crash reporting or advertising tools.

When the launcher checks for news or updates, it downloads them from the same server. Our hosting provider, Cloudflare, processes the technical details of those requests, such as IP address and time, to deliver them and keep the service secure.

Who receives data: Cloudflare provides our website, API, database, security and download infrastructure and processes the identifiers, settings, activity and request information needed for those services. Our email service processes support correspondence. Authorised team members may access data to provide support, maintain the service and handle privacy or security requests. The presence lookup discloses recent Wind Client use associated with the queried UUIDs to the people making the queries. We may also disclose information when legally required, to protect legal rights or security, or as part of a lawful transfer of the service subject to applicable privacy protections. Direct connections to other services are described below.

4. Other services the launcher talks to

To do its job, Wind Client connects from your computer directly to these services. They receive your IP address and the details of the request, and handle that data under their own privacy policies:

• Microsoft and Xbox, to sign you in and check you own Minecraft (privacy statement)
• Mojang, to download Minecraft versions, game files and Java, and to start the game
• Modrinth, when you browse or install mods, modpacks, shaders and resource packs (privacy policy)
• Fabric and Forge, to download mod loaders
• Minotar, to show skin heads for your account name
• mcsrvstat.us and the Minecraft servers themselves, to show live player counts and server icons
• Discord, only through the Discord app already running on your computer, to show what you're playing on your profile. You can turn this off in Settings, Launcher
• any server you choose to join, which sees your Minecraft name and IP address like with any launcher

Their handling of direct requests is separate from our launcher database. In particular, a mod, server or service you choose may collect additional information under its own rules. We do not authorise advertising trackers or session-replay tools to collect activity across other websites through our website.

5. This website

• The site uses no cookies, no analytics and no trackers. The font is served from our own site
• If you pick a theme, your choice is saved in your browser's local storage on your device only. We never receive it
• To show live player counts, your browser asks mcsrvstat.us for server status, which means mcsrvstat.us sees your IP address
• Our hosting provider processes server logs (IP address, time, page, browser) to deliver the site and protect it from attacks
• Clicking links to Discord or other sites takes you to services with their own privacy policies

Do Not Track and Global Privacy Control: we do not use browser Do Not Track signals to change the processing needed to deliver and secure the site. We do not sell personal information, share it for cross-context behavioural advertising, or use it for targeted advertising, whether or not a Global Privacy Control (GPC) or other opt-out signal is enabled. DNT is distinct from legally recognised opt-out signals. If our practices change, we must provide any legally required choices and honour applicable opt-out signals before engaging in that processing.

6. Our legal bases

Under the EU and UK General Data Protection Regulation (GDPR) we rely on:

• performing our agreement with you (Article 6(1)(b)), to provide the launcher features you use, such as keeping your settings, instances and accounts
• legitimate interests (Article 6(1)(f)), to keep the service secure, prevent abuse and fix problems. You can object to this, see section 9
• legal obligations (Article 6(1)(c)), where the law requires us to keep or share data

7. How long we keep data

• Your online launcher data is kept while you use Wind Client, and deleted when you ask us to delete it
• Request security nonces become invalid after a short validity period and are removed in batches during later authenticated requests; expiry does not mean immediate physical deletion
• Presence lookups use check-ins from approximately the last three minutes. Records more than 24 hours old are eligible for deletion in batches during later check-ins, so cleanup can take longer when there are no later check-ins or a backlog
• IP addresses used for rate limiting are not stored in our database
• Hosting logs are kept by our providers for a short time under their own retention rules
• Logs of rejected or failed API requests are used to detect abuse and are subject to our hosting provider's configured retention; the launcher database does not contain those logs
• Support correspondence is kept for the time needed to answer the request, resolve related disputes and meet applicable legal obligations. A limited record of a privacy request may be retained to document how it was handled

Retention depends on the purpose, whether you continue to use the service, security needs and applicable legal duties. Deletion from the active database does not instantly erase provider backups or logs. Backup copies expire under the provider's configured recovery period. Any legally required retention must be limited to its permitted purpose. Uninstalling alone does not request deletion of your online data, and local files may remain after uninstalling.

8. Where data is processed

Our server and database run on Cloudflare, which may process data in the United States and other countries. When applicable law requires a safeguard for an international transfer, we must use a valid mechanism, such as applicable standard contractual clauses or an adequacy decision, and meet its conditions. You can ask us about the safeguards applicable to your data at the contact address above.

9. Your rights

Depending on where you live, you have the right to:

• get a copy of your data
• have it corrected
• have it deleted
• receive it in a portable format
• object to or restrict how we use it
• complain to your data protection authority

In the launcher, go to Settings, Storage. Download your data saves your launcher settings, account profiles, instance list and saved servers as a JSON file. This self-service file does not include every server-side record, such as device registration records, security nonces, presence records, hosting logs or support emails. Email us to request any additional personal data to which you are entitled.

Delete your online data removes this installation's launcher records and associated account presence entries from the active database. It does not remove your worlds, mods, local sign-in caches, provider backups, logs or correspondence. The launcher restarts and automatically registers the installation again if you continue using it, creating new records. To stop that collection, close the launcher after deletion and stop using it. An active game can continue making presence requests, so close the game too.

For other requests, email windsupport@windclient.com. We may ask for information reasonably necessary to locate the records and verify your authority. A publicly visible Minecraft name alone does not prove ownership. Never send your password, sign-in tokens or private device key. If we cannot verify a request securely, we will explain the difficulty rather than disclose someone else's records.

For EU/UK requests, we respond without undue delay and normally within one month. If the law permits an extension, we will explain the reason and revised deadline within that first month. Exercising your rights is free and will not be held against you. The U.S. process below applies to U.S. residents.

10. U.S. privacy rights and requests

This section applies to residents of all 50 U.S. states. We offer the following request process to U.S. residents even where a comprehensive state privacy statute does not apply to us. Statutory rights, exceptions and enforcement options depend on the applicable law and its coverage requirements; this process does not limit them.

• Know and access: ask whether we process your personal data, request access and a portable copy, and ask about the categories of data, sources, purposes and recipients. You may also request the categories or specific third parties to which data was disclosed, including the disclosures available under Delaware, Minnesota and Oregon law
• Correct and delete: request correction of inaccurate personal data or deletion of personal data we hold about you, subject to legally permitted exceptions
• Opt out: request an opt-out of sale, targeted advertising, cross-context behavioural advertising or profiling for decisions with legal or similarly significant effects. We do not engage in those activities. We do not sell personal data for money or other valuable consideration, and have not sold or shared it for cross-context behavioural advertising in the preceding 12 months
• Sensitive data: exercise any applicable right to consent to, withdraw consent for, opt out of, or limit the use or disclosure of sensitive personal data. We do not use sensitive data to infer characteristics about you or for advertising
• Profiling: exercise any applicable right to question, obtain an explanation of, review or correct information underlying a profiling decision, or seek reconsideration. We do not use automated profiling to make decisions with legal or similarly significant effects
• No retaliation: you will not be unlawfully discriminated against for exercising your rights. A deletion request can make features that need the deleted information unavailable

How to request: use the launcher controls described in section 9 or email windsupport@windclient.com with your request and enough information to locate the records. You do not need to create an account or pay a fee. We use additional verification information only for verification, security and handling the request. An authorised agent may contact us on your behalf; we may require evidence of authority and, where permitted, verification directly with you. Parents, guardians and other legally authorised representatives may exercise rights on behalf of the person they represent.

Timing: we acknowledge U.S. requests within 10 business days and respond without undue delay, normally within 45 calendar days after receipt. We comply with any shorter applicable deadline, including for opt-outs. We will notify you within the initial response period of any legally permitted extension and its reason. Requests are free; if an exception applies, we will explain the refusal and your appeal options.

Appeal a refusal: reply to our decision or email windsupport@windclient.com with the subject “Privacy appeal,” the original request and why you disagree. We will review the decision and provide a written outcome and reasons within 30 calendar days. If the appeal is denied, we will explain how to contact your state's attorney general or other appropriate regulator to submit a complaint. You may also contact a regulator directly; an appeal does not waive that right.

California: the collection, source, purpose, disclosure and retention information in sections 2–7 also describes our practices during the preceding 12 months. We do not offer financial incentives in exchange for personal information. California residents can use the process above for access, correction, deletion and applicable limits or opt-outs. California's “Shine the Light” law also permits qualifying inquiries about disclosures for another business's direct marketing; we do not disclose personal information for that purpose. We do not knowingly sell or share the personal information of people under 16.

Nevada: Nevada residents can submit a verified request to opt out of a sale of covered information to the same email address. We do not sell covered information as defined by Nevada law. Our 45-day response target applies to these requests too.

11. Children and teenagers

Wind Client is intended for people aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe we have collected such data, contact us so we can investigate, stop any collection that is not legally permitted and delete the data as required. A statement in our terms does not replace any parental notice or verifiable parental consent required by COPPA or state law.

Teenagers also have privacy protections. For example, New York restricts processing covered users' data beyond strictly necessary permitted purposes unless valid consent is obtained. Accepting our terms, a parent's agreement to a contract or continued use does not by itself provide separate privacy consent required by law. We must obtain that consent before processing when required, and respect applicable withdrawal and deletion rights.

12. Security and breach notifications

Private launcher-state, registration, deletion and check-in requests are signed with your install's private key, which is stored locally using Windows protection. Local sign-in caches also use Windows protection. Connections to our API use HTTPS. The private state API checks device access, validates submitted fields and limits requests. The public news, download and presence-lookup endpoints do not require device signatures. No system is perfectly secure; keep your computer and Microsoft account secure too.

If a security incident occurs, we will investigate and provide any notices required by the laws applicable to the incident and affected people, including U.S. state breach-notification laws. Required recipients, timing, content and delivery methods vary by jurisdiction. Where GDPR applies and its reporting conditions are met, we notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of awareness, and notify affected people without undue delay when legally required.

13. Changes to this policy

If we change how we handle data, we'll update this page and the date at the top. For significant changes we'll also give notice in the launcher, on our website or on Discord before they take effect.

We will provide any additional notice and obtain any consent required before using existing personal data for a new, incompatible purpose. Continued use of the service does not substitute for consent where the law requires an affirmative choice.

Questions or requests: windsupport@windclient.com