Privacy Statement

Last updated 25 October 2026

This statement explains what ash’s developer collects when you use ash, why, and what we do not collect. It applies to the ash launcher, the ash client and this website.

What we collect

When you sign in

ash signs you in through Microsoft. The first time you sign in, ash creates an ash account for you, and the launcher tells you it has. We use the account to identify you and to show the right cosmetics in game.

To prove which Minecraft player you are, your computer signs a one-time code we issue with the key Mojang gives every player for signed chat. It sends us that signature, the key’s public half, and Mojang’s certificate for it, which names your Minecraft profile UUID. We check Mojang’s certificate and your signature ourselves; we don’t contact Mojang to do it. Your launcher also tells us your current Minecraft username, which we keep for display.

For your ash account we store:

• your Minecraft profile UUID and username;
• when your account was created, and when you last signed in;
• a fingerprint (a one-way hash) of each ash session, which can’t be turned back into the session itself.

We never receive your Microsoft password, or your Microsoft or Minecraft sign-in tokens. Sign-in happens on Microsoft’s own pages, in your browser. Your Minecraft token goes only to Mojang, which uses it to give your computer its key.

Authentication tokens

The tokens that keep you signed in to Microsoft and Minecraft are stored on your own computer, in the operating system credential store. They are not transmitted to us and we cannot read them. Your ash session is stored there too; we keep only its fingerprint. Signing an account out of ash deletes them.

Settings and preferences

While you are signed in to ash, settings sync is on unless you turn it off in the launcher’s Settings. It stores, against your ash account, so they follow you between computers:

• your in-game ash settings, such as your crosshair;
• the launcher’s own settings;
• each instance’s name, game version and loader, but not its worlds, screenshots or mods;
• each instance’s server list (names and addresses), but not the servers’ icons.

Settings specific to one computer — memory allocation, file paths, window size, interface size and your own mods — stay on that computer and are never sent to us. Turning sync off stops sending and receiving; what we already hold stays until you delete your ash account.

Cosmetics you wear

When you choose a cosmetic, such as a cape, in the launcher’s Wardrobe, we publish a small file that says what you wear, named by your Minecraft profile UUID, so that other ash players’ games can show it on you. Anyone can read that file. It holds only what you wear, and it is deleted when you take everything off or delete your ash account.

Your game looks up the players you can see the same way. Those lookups are served as plain files and never reach ash’s own code, and we keep no record of who looked up whom, or of which servers you play on. You can hide other players’ cosmetics in ash’s settings in game.

Cosmetics and entitlements

We record which cosmetics your account is entitled to. At present every ash account is entitled to every cosmetic, free, and nothing is sold. If ash ever sells anything, payments will be handled by a payment provider, and we will not receive or store your card details.

Diagnostics

ash writes log files on your computer to help diagnose problems. They stay on your computer unless you choose to send one to us. Tokens and credentials are removed from logs as they are written, not afterwards.

What we do not collect

• Your Microsoft password.
• Your Minecraft worlds, saves or screenshots.
• Which servers you play on, or what you do on them.
• Your chat messages.
• Anything from your computer outside ash’s own directories.

ash contains no advertising, no third-party analytics and no behavioural tracking. We do not sell personal data, and we do not share it for advertising.

Why we are allowed to process it

We process your profile UUID and username because we need them to provide ash to you — without them there is no account. If ash ever sells anything, we will process purchase records to meet our legal and accounting obligations. We process synced settings to provide the feature you are using, and you can turn it off at any time in the launcher.

Who else is involved

• Microsoft authenticates you. Their handling of your data is governed by the Microsoft Privacy Statement.
• Mojang provides the game files ash downloads, directly to your computer, and the key and certificate your computer uses to sign in to ash, as described above.
• Cloudflare hosts ash’s servers and stores your ash account data for us.
• Modrinth answers the launcher’s Mods page: the searches you make there, and the mods you install, come from Modrinth’s servers, which see your IP address as any website does. Their handling of it is governed by Modrinth’s privacy policy.
• GitHub hosts ash’s downloads and updates. When ash checks for a new version, and when you download one, GitHub sees your IP address. Their handling of it is governed by GitHub’s privacy statement.
• Our hosting and payment providers, Cloudflare included, process data on our instructions only, and may not use it for their own purposes.

We do not otherwise disclose your data, except where we are legally required to.

How long we keep it

We keep your account data for as long as your account exists. You can delete your ash account at any time from the launcher’s settings, and we erase it straight away. If nobody signs in to an account for 12 months, we delete it automatically. Either way, nothing is kept other than records we must keep for legal or accounting reasons. Diagnostic logs you send us are deleted within 90 days.

Security

Data is encrypted in transit. Access is limited to people who need it. Authentication tokens stay on your own machine in the OS credential store, which is the main reason a compromise of our systems cannot be used to sign in as you.

Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Email contact@ashlauncher.com and we will respond within 30 days. If you are unhappy with our response you may complain to your local data protection authority.

Children

ash is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has provided us data, email us and we will delete it.

Changes

If we change this statement we will post the new version here and update the date above. If a change materially affects how we use your data, we will tell you in ash before it takes effect.

Contact

ash’s developer — contact@ashlauncher.com

Not an official Minecraft product. Not approved by or associated with Mojang or Microsoft.