Privacy policy

Halcyo is an open-source launcher for Minecraft: Java Edition. This policy covers the Halcyo launcher and this website. The short version: Halcyo has no servers and collects nothing. Everything described below stays on your computer or goes directly to the official service it belongs to.

What the launcher stores

When you sign in with a Microsoft account, the launcher saves the following in ~/.halcyo/accounts.json in your user folder:

• your Minecraft username and UUID,
• the Microsoft refresh token, so you stay signed in between launches,
• your Xbox user ID (XUID), which the game uses for its session.

The Minecraft access token is kept in memory while the launcher runs and is passed to the game when it starts. Your password is never seen or stored by Halcyo, because you only type it on Microsoft's own sign-in page. Launcher settings such as memory, the Minecraft version and disabled mods are stored in ~/.halcyo/config.json.

Who the launcher talks to

The launcher connects only to these services, directly from your computer:

• Microsoft (login.microsoftonline.com) to sign you in, with the scope XboxLive.signin offline_access.
• Xbox Live (user.auth.xboxlive.com, xsts.auth.xboxlive.com) to confirm your account.
• Mojang and Minecraft services (api.minecraftservices.com, sessionserver.mojang.com, piston-meta.mojang.com, libraries.minecraft.net, resources.download.minecraft.net) to check your license, load your profile and skin, and download the game.
• Fabric (meta.fabricmc.net) and Modrinth (api.modrinth.com) to download Fabric and the mods you have enabled.

These services receive the requests they need to work (for example your IP address) and handle them under their own privacy policies, including the Microsoft Privacy Statement. Halcyo adds nothing to these requests beyond a halcyo-launcher user agent.

What Halcyo does not do

• No analytics, telemetry, crash reporting or advertising.
• No Halcyo accounts and no Halcyo servers. Your data is never sent to the project or its developers.
• No selling or sharing of data, because there is none to sell or share.

This website

This website is a set of static pages hosted on Cloudflare. We set no cookies of our own and run no analytics. To deliver and protect the site, Cloudflare processes technical data such as your IP address, user agent and request time, may keep standard access logs, and may set a strictly necessary security cookie. That processing is covered by the Cloudflare Privacy Policy. The launcher itself never connects to this website.

Removing your data

Choose Sign out in the launcher's account menu to delete an account and its token from your computer. To remove everything, delete the ~/.halcyo folder. You can also revoke the launcher's access at any time on your Microsoft account page under privacy and app permissions.

Changes and contact

Any changes to this policy are published on this page and in the source repository. Questions go to GitHub Issues.