Privacy policy

This policy covers the Xol launcher, the Xol client that runs inside Minecraft, the Xol update service, and this website. Xol is an independent project run by an individual developer (“Xol”, “we”). If anything here is unclear, ask at contact@xol.dev.

Microsoft account sign-in

Sign-in happens on Microsoft's website in your own browser. Xol never receives your password. Xol requests two scopes, XboxLive.signin and offline_access, and uses the resulting tokens only to confirm that your account owns Minecraft: Java Edition, to read your Minecraft username and UUID, and to start the game so you can join servers.

Tokens, your username and your UUID are stored only on your device. On Windows they are encrypted by the operating system (DPAPI). On macOS, current test builds are not signed with an Apple Developer ID. For such builds the Keychain would ask for your login password, and again after every update, so these builds keep the sign-in in a file in the Xol data folder that only your own user account can read or write. That is file-permission protection, not encryption. A build signed with a Developer ID uses the Keychain. Your tokens and UUID are never sent to Xol, never logged, and never included in support files or crash reports. Of these items, only your Minecraft username is ever sent to Xol, in the online heartbeat described below. Removing the account in Xol deletes them. The full flow is described on the sign-in page.

When you sign in, your computer talks directly to Microsoft, Xbox Live and Minecraft Services. Their handling of your data is covered by the Microsoft Privacy Statement.

What the launcher sends to the Xol service

Crash reporting is off by default. When it is on, the report is redacted on your computer first: tokens, session strings, access keys, email addresses, IP addresses and home folder paths are removed, and you can preview exactly what will be sent. The server applies the same redaction again on arrival and drops chat lines before anything is stored. Reports are deleted after 30 days.

The online heartbeat is kept in the server's memory only, never written to disk: an entry disappears 3 minutes after the last heartbeat, or at once when “closed” arrives. The install ID is stored only as a one-way hash, and the list the Xol team sees shows the username, versions, profile, operating system, idle or playing, and when the launcher was first and last seen. It shows no IP address, and none is stored with it. Switching the heartbeat off sends one last “closed” and then nothing more.

As with any internet service, the server sees the IP address a request comes from. Server logs are kept for 14 days for security and abuse prevention and are not used for anything else.

Xol does not need an access key, and current versions have no field for one. Earlier versions let testers save a key. A key saved that way is a random string that the launcher does not link to your Microsoft or Minecraft account, and it can bring releases or notices meant for that key. Crash reports need no key. A report is sent without one, and a saved key only makes the report recognizable as yours.

What the client does inside the game

The Xol client reads local game state to draw the HUD and stores its settings on your computer. When you join a server it sends the standard client-brand label with the text Xol, the same message every Minecraft client sends with its own name.

Two features of the client talk to the Xol service:

• Network level and Bed Wars star (Hypixel ▸ Player info, off by default; its “Network level” row is on by default): to show each player's network level over their head, the client sends the Xol service the Minecraft account IDs of the players within 64 blocks of you, plus the random ID of your game folder. The service answers with each player's network level and Bed Wars star. In Bed Wars the line shows the star, and the client asks even with “Network level” off, while “Bed Wars star” and “In Bed Wars, the star” are on (both are on by default). A star the server prints itself is used first. It never sends names, and never the ID of a nicked player or an NPC. At most 32 IDs go in one request, and at most one request every 2 seconds. The service looks the levels and stars up in a public cache of Hypixel player stats and keeps the answers in its memory for up to 12 hours; nothing is written to disk. Turn Player info off, or turn both “Network level” and “Bed Wars star” off, and nothing more is sent.
• Xol badge (Settings ▸ Xol Badge): while you are in a world, the game proves to the Xol service that it runs on your Minecraft account. It uses the same Mojang session check a server uses at login; your sign-in token goes only to Mojang, never to Xol. After that, the game tells the service once a minute that the account is on Xol, and asks which of the players it shows (name tags nearby and the player list) are on Xol, sending only their account IDs and the random ID of your game folder. The service keeps only the account ID, a hashed session key and the time of the last check, in memory: no names, no addresses, not the server you play on, nothing logged per request, and a restart forgets it all. You count as on Xol for 3 minutes after the last check. “Hide my badge” stops all of it at once.

Apart from that, the client connects elsewhere only in these cases:

• Xol's themed server list asks the servers on your list for their status, with the game's own status ping, as the vanilla list does.
• The Ping module, when set to “Server ping” or “Auto”, asks the server you are playing on for the same public status.
• The Auto Text module sends a line you wrote to the server you are on, when you press its key.

Discord

If Discord is running on the same computer, Xol can show what you are playing on your Discord profile, as many games do. Two switches in Settings ▸ Discord, both on by default: “Show what I'm playing on Discord” and “Show the server name”. Turning the first one off stops it completely and removes what is already shown.

Xol talks only to the Discord app on your own computer, over Discord's local connection. Nothing about this goes to the Xol service. Discord then shows: that you are playing Xol, what you are doing (“In the launcher”, “In the menus”, “Singleplayer”, “Playing on …”), which profile you are on (for example “Xol 1.8.9”), how long you have been playing, and the Xol logo. Your Minecraft username, your account, your file paths and your own IP address are never part of it.

About the server name: only the address you connected to is used, and only when it is a public host name. An IP address is never shown, and neither is a name with no dot in it or one ending in .local, .lan, .home or .internal. A LAN world or a loopback address reads as “a LAN world”, anything else private as “a private server”. With “Show the server name” off it says only “Playing multiplayer”.

Other connections the launcher makes

• Mojang / Microsoft download servers, for the game, its libraries, assets and Java runtime.
• Minecraft Forge and Modrinth, for the pinned, checksum-verified components some profiles need.
• On Apple Silicon Macs only, from Xol 0.2.7: Azul (cdn.azul.com), for the Apple Silicon Java 8 runtime, and GitHub (one fixed release file on github.com), for the Apple Silicon build of the LWJGL 2 game libraries. Both are pinned and checksum-verified.

These are plain file downloads. Xol sends them nothing beyond what any download involves (your IP address and a user-agent).

This website

This site sets no cookies for visitors and loads no third-party scripts, fonts or trackers. The web server keeps standard access logs (IP address, time, page, browser user-agent) for 14 days for security, and page views are counted from those same logs: no script runs in your browser, no visitor profile is built, and nothing outlives the 14 days. The opening animation plays once per visit: to remember that it has played, your browser keeps a single marker in its own session storage, which is never sent to us and is erased when you close the tab. The owner-only administration area uses a sign-in cookie, which visitors never receive. If you email us, we keep the conversation for as long as we need it to help you.

Sharing

We do not sell, rent or share personal data. We would disclose data only if required by law, and the data described above is all there would be.

Your choices

• Remove your account in Xol at any time; revoke Xol's access at account.microsoft.com.
• Leave crash reporting off, or switch it off again in Settings ▸ Support.
• Switch off “Show me as online to the Xol team” in Settings ▸ Service; your entry disappears from the list at once.
• Ask for a copy or deletion of anything tied to your access key or email address by writing to contact@xol.dev. We answer within 30 days.

Children

Xol is not directed at children under 13 and does not knowingly collect their data. Microsoft's own family settings govern whether a child account can sign in to third-party applications.

Changes

If this policy changes in a way that matters, the date above changes and the change is announced in the launcher. Earlier versions are available on request.