asobu

Privacy

Asobu has no analytics and no tracking of any kind. This page says exactly what the launcher stores on your computer, which services it talks to, and what the friends network knows about you if you use it.

Short version: everything about playing Minecraft happens on your computer. Two things reach the internet on their own: a check for a new version of Asobu, and, if you have used friends, a note that you are online. The Asobu server is only involved in friends and share codes, and it never sees your worlds, your game files, or your password.

What we collect

No analytics, no crash reporting service, no profiling. Nobody is measuring which buttons you press or how long you play. The only personal information stored anywhere outside your computer is the Minecraft username and UUID of people who use friends, described below.

Microsoft sign-in

To play online you sign in with a Microsoft account. Asobu uses Microsoft's device code flow, which means the launcher shows you a short code and sends you to Microsoft's own page to enter it.

  • Asobu never sees your password. You type it into Microsoft's sign-in page. The launcher only receives a token afterwards.
  • Tokens are encrypted on your disk. Your refresh token is sealed with Windows DPAPI under your user account, in a file only that account can read. Copying it to another machine yields nothing.
  • Tokens go to Microsoft and Mojang, nowhere else. They are exchanged with Xbox Live and Minecraft services to verify you own Minecraft: Java Edition and to get your profile name and UUID, which the game needs to start.
  • Signing in does not involve any Asobu server. Not even when you use friends, which is explained below.

Microsoft's consent screen currently says "Minecraft Launcher" rather than Asobu. Mojang only permits approved applications to sign people in to Minecraft, so until Asobu's own registration is approved it uses the official launcher's public application id.

Signing out through Asobu deletes the stored token. You can also revoke access at any time from your Microsoft account privacy settings.

Friends

Friends is the one feature with a server behind it. It runs at api.asobu.cc on a small machine in Frankfurt, Germany.

  • It never receives your Microsoft or Minecraft token. Identity is proved with the same handshake Minecraft servers use. Your launcher tells Mojang it is joining, the Asobu server asks Mojang to confirm it, and Mojang replies with your username and UUID. No credential of yours passes through us, and nobody can claim to be you without Mojang saying so.
  • What it stores: your Minecraft username and UUID, who your friends are, pending friend requests, when you were last seen, and a hashed copy of your session token. Share codes are kept here too, described below.
  • Your friends can see when you were last online. That is what a friends list is for, but it is worth saying plainly.
  • Nothing contacts it until you use it. Open the launcher, play Minecraft, never touch the friends button, and no request ever reaches an Asobu server.
  • There is no way to delete your account yet. This is a real gap and it is being worked on. Until then, opening an issue on GitHub gets your row removed by hand.

Share codes

An instance can be shared as a code, which needs an account to create but not to use. What the server keeps is a list of what the instance contains, never the files themselves.

  • What a code holds: the instance name, its Minecraft version and mod loader, and a list of your mods and packs identified by hash. There are no download addresses in it, because whoever imports the code looks each hash up at Modrinth or CurseForge and downloads from there.
  • Your worlds and settings are not in it. Only mods, resource packs, shaders and data packs travel. Saves and the config folder stay on your machine, so a code cannot carry a world or a server password you forgot was in there.
  • Seven days, then it is deleted. Not archived or hidden, removed. Sharing the same instance again before then gives back the same code with another week on it, and you can withdraw one early.
  • Anyone holding the code can read it. That is what it is for. Treat a code like a link: whoever you send it to can pass it on.

Updates

Asobu asks GitHub whether a newer version exists when it starts, and downloads it in the background if so. That request tells GitHub your IP address and which version you are running, the same as any download would. It carries nothing else, and no Asobu server is involved.

Opening a world to friends

This has not shipped. It is described here in advance so there are no surprises when it does, and this section will be rewritten to describe the real thing once it exists. When it arrives, your computer is the server and the world runs on your machine exactly as it does now.

  • Worlds never touch our infrastructure. We will not host, store, back up or have any access to your saves.
  • Our server only makes the introduction. It passes connection details between the two PCs so they can talk directly, then gets out of the way.
  • Relay fallback. Some home networks refuse a direct connection. In that case the game traffic can be relayed through our server so the session still works. Relayed traffic is passed through, not inspected or stored.

Services Asobu contacts

  • Microsoft and Xbox Live for signing in.
  • Mojang and Minecraft services for verifying you own the game, and for downloading Minecraft, its libraries, assets and the Java runtime.
  • Modrinth and CurseForge when you browse or install mods. Mod files download directly from whoever hosts them.
  • Mod loader projects such as Fabric, Quilt, Forge and NeoForge, when an instance needs one.
  • GitHub for the update check described above.
  • api.asobu.cc once you have used friends, or when you make or open a share code.

Each of those sees an ordinary request from your computer, much like the official Minecraft launcher would produce, and each is governed by its own privacy policy.

What is stored on your computer

An installed Asobu keeps everything in one folder inside its own install directory, so an update replaces the program without touching your data. Running from a source build instead, it uses %APPDATA%\.asobu.

  • Instances with your worlds, mods, configuration and screenshots.
  • Cache holding Minecraft versions, libraries, assets and Java runtimes, shared between instances.
  • Logs from each session, so crashes can be explained. They stay on your disk and are never uploaded.
  • accounts.json with the display name and UUID of accounts you have added. No tokens or passwords are in this file.
  • tokens.dat holding your encrypted Microsoft refresh token, sealed with DPAPI.
  • settings.json with your preferences, such as memory allocation and Java choice.

Mod icons and artwork are cached in your system temp folder so they are not fetched twice. That cache is capped and expires on its own, and losing it costs one re-download.

In portable mode all of this lives in a data folder next to the executable. Deleting the folder removes everything Asobu has stored locally.

Children

Asobu collects nothing from anyone through the launcher itself. If you use friends, the server stores the Minecraft username and UUID that Mojang provides, regardless of the age of the account holder. Microsoft account rules, including family and child-account restrictions, are enforced by Microsoft during sign-in.

Changes

This page is updated when behaviour changes, and it describes what the code does rather than what was intended. The project is open source, so anything here can be checked against the source instead of taken on trust.

Contact

Questions, a privacy problem, or a request to delete your friends data? Open an issue on GitHub.

Last updated: 21 August 2026