Privacy & Security Policy

Last Updated: August 2026. PocketMC is designed with an uncompromising local-first architecture. Your privacy, game saves, and computer security are our fundamental priorities. This document discloses how data is handled, stored, and protected.

1. Local Storage & Platform Security Encryption

PocketMC keeps your server configuration files, world archives, console logs, player data, and metadata strictly on your local machine under your chosen application directory. We do not store your game data on proprietary servers.

To safeguard sensitive credentials (including CurseForge API tokens, Playit secret keys, Cloud Backup OAuth tokens, and AI Provider keys), PocketMC encrypts secrets using platform-native security frameworks:

• Windows: Protected via Windows Data Protection API (DPAPI), binding decryption exclusively to your user account session.
• Linux: Stored via the Linux Secret Service API (dbus / GNOME Keyring / KWallet).
• macOS: Protected using the Apple Keychain Security framework.

2. Telemetry and Opt-Out Controls

To measure software reliability, track software engine adoption, and diagnose crashes, PocketMC includes an optional telemetry reporting system:

• Approximate Country Lookup: Once on startup (if telemetry is enabled), the desktop client queries http://ip-api.com to resolve your country code.
• Aggregated Anonymous Statistics: Telemetry reports are transmitted over HTTPS to our proxy server (pocket-mc-proxy.onrender.com). The report includes an anonymous client UUID (generated locally), application version, country code, and counts of active server engine types (e.g. Paper, Fabric, BDS).
• Zero Personal Data: Personal identifiers, usernames, IP addresses, world files, and directory paths are never included in telemetry payloads.
• Complete Opt-Out: Telemetry can be disabled at any time with a single click in App Settings > Telemetry, which terminates all lookup routines.

3. Outbound Network Connections

PocketMC connects to external endpoints only when you explicitly invoke specific application capabilities:

• Adoptium & GitHub: Downloads matching JRE runtimes (Java 8, 11, 17, 21, 25) or PocketMine PHP 8.2 binaries and checks for application updates.
• Modrinth & CurseForge: Sends search queries and downloads mods, plugins, and datapacks.
• Playit.gg: Provisions tunnel agents and maps network ports via official Playit API endpoints.
• Cloud Backup Providers: Synchronizes backup archives directly with Google Drive, Microsoft OneDrive, and Dropbox via user-authenticated OAuth flows.
• AI Providers: Sends sanitized server console logs to user-configured endpoints (Google Gemini, OpenAI, Claude, Mistral, Groq, or local Ollama).

4. Diagnostic Logs & Auto-Redaction

When generating a support diagnostic bundle, PocketMC automatically executes regex sanitization to redact passwords, RCON secrets, and sensitive tokens from configuration files before compiling the local ZIP archive. Diagnostic archives are never transmitted automatically without your explicit consent.