Privacy Policy (Privacy Notice)

Software product: 16Launcher
Effective date: 14 August 2026
Document version: 1.0

This Privacy Policy (the Policy) describes how personal data of users of the 16Launcher software product, the official website https://16-launcher.ru, the application programming interface https://api.16-launcher.ru, and related services (together, the Service) is processed.

By using the Service, the User confirms that they have read this Policy and consent to the processing of personal data on the terms set out below. If the User does not agree with the Policy, they must refrain from using the Service.

1. Information about the Operator

Personal data operator (the Operator): the administration of the 16Launcher project.

Official website: https://16-launcher.ru

Email for personal data requests: 16launcher@gmail.com

Source code repository: https://github.com/launcherdev11/rust-launcher

Personal data is processed in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, other applicable laws of the Russian Federation, and, with respect to data subjects located in the European Union and the European Economic Area, taking into account the principles of Regulation (EU) 2016/679 (GDPR) to the extent applicable to the Operator’s activities.

2. Terms and definitions

Personal data — any information relating directly or indirectly to an identified or identifiable natural person (the data subject).

User (data subject) — a natural person who uses the Service.

Processing of personal data — any operation or set of operations with personal data, including collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer, anonymisation, blocking, deletion, and destruction.

Platform account — the User’s account in the 16Launcher Service (nickname, email address, and related information) required to access the Service’s online features.

Game account — an account with a third-party authentication provider (Microsoft / Xbox / Minecraft or Ely.by) used to launch Minecraft.

Automated processing — processing of personal data by means of computing equipment.

3. Scope

This Policy applies to:

1. the 16Launcher desktop application (including versions for Windows, Linux, and macOS);
2. the official website of the Service, including the theme store, materials published by the Operator, and related website pages;
3. the Operator’s server infrastructure, including the api.16-launcher.ru programming interface and real-time messaging channels;
4. Service features: registration and authentication, friends list, online presence, co-op rooms, notifications, achievements, launch statistics, launcher sessions, and signalling for peer-to-peer connections.

This Policy does not govern processing carried out by independent third parties (including Microsoft, Mojang, Ely.by, Modrinth, CurseForge, Discord, GitHub, and Google) under their own documents. The Operator recommends that the User review those parties’ privacy policies independently.

4. Legal bases for processing

The Operator processes personal data on the following legal bases:

1. consent of the data subject (item 1 of part 1 of Article 6 of Federal Law No. 152-FZ) — given by registering with the Service, signing in to a Platform account, using the relevant features, or another clearly expressed action;
2. performance of a contract to which the data subject is a party, or steps taken at the data subject’s request prior to entering into such a contract (item 5 of part 1 of Article 6 of Federal Law No. 152-FZ) — providing launcher features and online services;
3. ensuring the security of the Service, preventing abuse, investigating incidents, and complying with legal duties.

The User may withdraw consent as provided in section 13 of this Policy. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. If consent is withdrawn, the Operator may be unable to provide certain Service features.

5. Categories of personal data processed

The Operator does not process special categories of personal data (information about racial or ethnic origin, political opinions, religious beliefs, health, or intimate life) and does not process biometric personal data within the meaning of Federal Law No. 152-FZ.

5.1. Platform account data

When a Platform account is registered and used, the Operator may process:

• nickname (display name);
• email address;
• password (stored in hashed form; the Operator does not store the password in plaintext);
• email verification code and confirmation status;
• unique account identifier;
• project support status (if any);
• access and refresh tokens issued by the Service.

5.2. Linked game identifiers

At the User’s initiative, the following may be linked to a Platform account:

• Ely.by identifier and username;
• Minecraft (Microsoft) identifier (UUID) and profile name;
• technical tokens required solely to complete the linking.

5.3. Data related to the Service’s online features

When online features are used, the Operator may process:

• friends list, incoming and outgoing friend requests;
• online presence information (online / offline status, last activity time);
• co-op room information: room identifier, owner, participants, role, status, invitations;
• notifications (friend requests, room invitations, system messages, achievements);
• the User’s achievements and the date they were obtained;
• usage statistics: number of game launches, total session time, first and last launch dates;
• launcher session information: session identifier, client name, platform information (operating system type reported by the runtime), launcher version, creation time, last activity confirmation time, and session end time.

5.4. Data processed to establish a peer-to-peer connection

To connect Users for co-op play, the Service uses signalling and, where necessary, relay servers (STUN/TURN). In that case, the following may be processed:

• signalling messages (SDP, ICE candidates);
• network addresses (including IP address) and ports needed to establish the connection;
• short-lived credentials for access to the relay server.

This information is used solely to organise the game connection and is not used by the Operator for advertising.

5.5. Technical and log information

When the Operator’s server infrastructure is accessed, the following may be processed automatically:

• IP address;
• date and time of the request;
• requested resource and response code;
• user-agent identifier (User-Agent);
• other technical parameters needed for availability, abuse protection, and fault diagnosis.

5.6. Data stored primarily on the User’s device

The following may be stored on the User’s device (in the application data directory and in local storage):

• launcher settings (game directory, allocated memory, interface language, notification settings, theme, and other preferences);
• information about game profiles, installed versions, mods, and related files;
• Microsoft / Minecraft and Ely.by game account tokens;
• Platform account tokens;
• image cache (including skins and avatars);
• game logs and crash reports generated by the Minecraft client.

The Operator does not automatically access save files, screenshots, Minecraft crash logs, or the contents of the game directory, except where the relevant feature is explicitly initiated by the User (for example, profile export or viewing screenshots in the launcher interface).

5.7. Data processed on the official website

When the official website is used, the Operator may additionally process:

• Platform account information during registration, sign-in, and profile use on the website;
• materials submitted to the theme store: theme name, theme file archive, stated author name, submitter account identifier, submission date, and moderation status;
• website interface language preferences stored in the browser’s local storage and (where applicable) in page URL parameters;
• website session tokens stored in the browser’s local storage.

5.8. Data the Operator does not collect

The Operator does not:

• sell personal data to third parties;
• secretly collect data for advertising profiling;
• connect third-party advertising pixels or web analytics systems in the desktop application;
• automatically send Minecraft crash reports to the Operator’s servers;
• process bank card payment details in the desktop application.

6. Purposes of processing

Personal data is processed solely for the following purposes:

The Operator does not use personal data to make decisions that produce legal effects concerning the User solely on the basis of automated processing.

7. Processing procedure and conditions

7.1. Processing is carried out in a mixed manner: automated and without automation — to the extent necessary to achieve the purposes in section 6.

7.2. The Operator performs the following operations with personal data: collection, recording, systematisation, accumulation, storage, updating (refreshing, changing), retrieval, use, transfer (provision, access), blocking, deletion, and destruction.

7.3. Transfer of personal data to third parties is permitted:

• with the User’s consent;
• in cases provided by the laws of the Russian Federation;
• if the transfer is necessary to provide a feature requested by the User (including when contacting authentication providers, mod catalogues, update servers, and peer-to-peer connection infrastructure).

7.4. The Operator takes legal, organisational, and technical measures aimed at protecting personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, and other unlawful acts, including:

• limiting the circle of persons with access to personal data;
• using protected data transmission channels (TLS) when contacting the Operator’s server infrastructure;
• storing Platform account passwords in hashed form;
• limiting the validity period of session tokens and STUN/TURN credentials;
• logging significant security events to the extent needed to investigate incidents.

7.5. Despite the measures taken, the Operator cannot guarantee absolute protection of data transmitted over the Internet. The User must independently keep their device, credentials, and locally stored tokens secure.

8. Data processed on the User’s device and cookies

8.1. Desktop application

The desktop application stores data locally in the 16Launcher data directory and in the application interface’s local storage. This information is needed for the launcher to work, to keep the session, and to store user settings. The User may delete local data by deleting the relevant application files or uninstalling the application.

8.2. Website

The official website of the Service may use technical cookies and similar technologies (including browser local storage) to the extent needed for the website to function, to store language preferences, to maintain a Platform account session, and to protect against abuse. Cookies that are not strictly necessary are used only with the relevant consent, if required by applicable law.

The User may restrict or disable cookies using browser settings. Disabling certain cookies may affect the correct operation of the website.

9. Third parties and data recipients

To provide the Service, the Operator and/or the User interact with the following categories of third parties. Transfer or other interaction takes place only to the extent needed for the relevant feature.

9.1. Authentication and game service providers

Microsoft Corporation, Xbox, and Minecraft services (Mojang)
Used when signing in with a Microsoft / Minecraft account. Processing includes exchanging data with login.live.com, user.auth.xboxlive.com, xsts.auth.xboxlive.com, api.minecraftservices.com, and related services. The Operator does not receive the Microsoft account password. Access and refresh tokens are stored on the User’s device for subsequent game launches. Microsoft Privacy Statement: https://privacy.microsoft.com.

Ely.by
Used when signing in via Ely.by (OAuth 2.0 and/or the Yggdrasil protocol). Processing includes exchanging data with account.ely.by and authserver.ely.by. Tokens are stored on the User’s device. The Ely.by privacy policy is published by the relevant rights holder.

9.2. Game content and update providers

When installing and updating the game, the Java runtime, mods, and related components, the client may contact:

• official Mojang / Microsoft resources (including piston-meta.mojang.com and related mirrors);
• mod loader catalogues (including Fabric, Quilt, Forge, and NeoForge metadata);
• Modrinth (api.modrinth.com);
• CurseForge (api.curseforge.com and file delivery networks);
• GitHub and the jsDelivr content delivery network — for certain service components, launcher updates, and informational materials (including the notification list and website news).

When those resources are contacted, the relevant operators independently process technical connection data (including IP address) under their own rules.

9.3. Operator infrastructure and peer-to-peer connection

The Operator’s server infrastructure (api.16-launcher.ru and related nodes) processes Platform account data and the information described in sections 5.3–5.5 and 5.7.

During co-op play, room participants may receive each other’s network addresses needed to establish a connection. If a direct connection is not possible, traffic may be relayed through a TURN server. The Operator uses this information solely to provide the connection.

9.4. Discord

If the Discord client is installed and running, the launcher may send activity status information to the local Discord client (for example, that the launcher is in use and information about the game session) via Discord Rich Presence. This transfer is made to the User’s device and is then processed by Discord under Discord’s rules. Discord Privacy Policy: https://discord.com/privacy.

9.5. Website fonts

The official website may load fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com). In that case, the relevant operator independently processes technical connection data (including IP address) under its own rules. Google Privacy Policy: https://policies.google.com/privacy.

9.6. Public authorities

The Operator may provide personal data to authorised public authorities in the cases and manner established by the laws of the Russian Federation.

10. Cross-border transfer of personal data

Certain Service features involve contacting information systems whose servers may be located outside the Russian Federation, including Microsoft, Mojang, Ely.by, Modrinth, CurseForge, GitHub, Discord, Google, and content delivery networks.

By taking the relevant actions (signing in via Microsoft or Ely.by, downloading the game and mods, using Discord status, viewing the website, etc.), the User acknowledges the possibility of a cross-border transfer of technical and account data to those parties and consents to such transfer to the extent needed to provide the requested feature.

The Operator takes reasonable measures to ensure that the transfer is made only for the stated purposes and in the minimum necessary volume.

11. Retention periods

Personal data is processed and stored no longer than required for the purposes of processing, unless another period is established by the laws of the Russian Federation.

Indicative periods:

After the retention period, personal data is destroyed or anonymised unless otherwise required by law.

12. Processing of minors’ personal data

The Service is not intended for persons below the age at which, under applicable law, they may independently consent to personal data processing and use of online services.

Registration of a Platform account by persons under 14 is permitted only with the consent of a legal representative. Use of Microsoft / Minecraft game accounts is additionally governed by the rules of the relevant rights holders.

If the Operator discovers that a child’s data is being processed without the required consent, the Operator will take steps to block and/or delete the relevant information. A legal representative may send a request to the address specified in section 1.

13. Data subject rights

The data subject has the right to:

1. obtain information about the processing of their personal data by the Operator;
2. request rectification, blocking, or destruction of personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose;
3. withdraw consent to the processing of personal data;
4. request that processing of personal data be stopped in cases provided by law;
5. appeal the Operator’s acts or omissions to the authorised body for the protection of data subjects’ rights (Roskomnadzor) or in court;
6. exercise other rights provided by the personal data laws of the Russian Federation.

13.1. Exercising rights through the Service

The User may independently:

• change the Platform account nickname in the launcher interface;
• end the session (sign out);
• delete the Platform account with password confirmation — processing of that account’s data on the Operator’s side then stops, except for information that must be retained by law;
• remove game accounts from the launcher and revoke access with the relevant authentication providers (Microsoft, Ely.by) using their standard tools.

If any of these features is unavailable in the interface, the User may send a request under section 13.2.

13.2. Requests to the Operator

To exercise rights that are not available in the Service interface, the User sends a request to 16launcher@gmail.com with the subject “Personal data”.

The request should include:

• the applicant’s last name, first name, and (if any) patronymic;
• the Platform account nickname and email address;
• the substance of the request;
• a contact address for the reply.

The Operator may request additional information needed to identify the applicant. The review period is 30 (thirty) calendar days from receipt, unless another period is established by law. The period may be extended in cases provided by law.

14. User obligations

The User undertakes to:

• provide accurate information when registering and using the Service;
• keep Platform account data up to date;
• not share passwords and access tokens with third parties;
• not use the Service to collect other persons’ personal data without a lawful basis;
• independently protect the device on which the launcher and game clients are installed.

The User is responsible for actions performed using their credentials until the Operator is notified of a compromise of access.

15. Changes to the Policy

The Operator may change this Policy. The new version takes effect when it is published at the publication address, unless the version itself provides otherwise.

Continued use of the Service after a new version takes effect constitutes the User’s agreement to the changes. Material changes are brought to Users’ attention by publishing the updated Policy text on the official website and/or by notification in the Service.

Users are encouraged to review the current version of the Policy periodically.

16. Final provisions

16.1. The law of the Russian Federation applies to this Policy and to relations connected with the processing of personal data.

16.2. If any provision of the Policy is found invalid, this does not invalidate the remaining provisions.

16.3. The Operator’s failure to act in the event of a User’s breach of the Policy does not deprive the Operator of the right to take appropriate action later.

16.4. On matters not covered by this Policy, the Parties are guided by the laws of the Russian Federation and the user agreement (if any).

17. Contact information

For all questions related to the processing of personal data and this Policy, the User may contact the Operator:

• email: 16launcher@gmail.com
• official website: https://16-launcher.ru
• bug reports: https://github.com/launcherdev11/rust-launcher/issues

This document is a public notice of information about personal data processing within the meaning of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and is published for free access.