Privacy

Asobu has no analytics and no tracking of any kind. This page says exactly what the launcher stores on your computer, which services it talks to, and what the friends network knows about you if you use it.

What we collect

No analytics, no crash reporting service, no profiling. Nobody is measuring which buttons you press or how long you play. The only personal information stored anywhere outside your computer is the Minecraft username and UUID of people who use friends, described below.

Microsoft sign-in

To play online you sign in with a Microsoft account. Asobu uses Microsoft's device code flow, which means the launcher shows you a short code and sends you to Microsoft's own page to enter it.

• Asobu never sees your password. You type it into Microsoft's sign-in page. The launcher only receives a token afterwards.
• Tokens are kept private on your disk. On Windows your refresh token is sealed with DPAPI under your user account, in a file only that account can read, and copying it to another machine yields nothing. Linux offers no equivalent that works without a desktop keyring running, so there the file is stored readable and writable by your user alone. Anyone who can already run programs as you can read it — which is true of the Windows file too, once you are logged in.
• Tokens go to Microsoft and Mojang, nowhere else. They are exchanged with Xbox Live and Minecraft services to verify you own Minecraft: Java Edition and to get your profile name and UUID, which the game needs to start.
• Signing in does not involve any Asobu server. Not even when you use friends, which is explained below.

Microsoft's consent screen currently says "Minecraft Launcher" rather than Asobu. Mojang only permits approved applications to sign people in to Minecraft, so until Asobu's own registration is approved it uses the official launcher's public application id.

Signing out through Asobu deletes the stored token. You can also revoke access at any time from your Microsoft account privacy settings.

Friends

Friends is the one feature with a server behind it. It runs at api.asobu.cc on a small machine in Frankfurt, Germany.

• It never receives your Microsoft or Minecraft token. Identity is proved with the same handshake Minecraft servers use. Your launcher tells Mojang it is joining, the Asobu server asks Mojang to confirm it, and Mojang replies with your username and UUID. No credential of yours passes through us, and nobody can claim to be you without Mojang saying so.
• What it stores: your Minecraft username and UUID, who your friends are, pending friend requests, when you were last seen, and a hashed copy of your session token. For an offline account, its tag and the doubly-hashed machine digest described below. Share codes are kept here too, described below. Messages are not on this list, and that is not an oversight — see below.
• Your friends can see when you were last online. That is what a friends list is for, but it is worth saying plainly.
• Offline accounts can join, and that part works differently. An offline account has nothing to prove to Mojang, so the server gives it four random digits after the name — Player#4963 — and that pair is what friends type to find it. It only happens when you press the button on the friends page; an offline name is a local thing until you say otherwise.
• Joining as an offline account sends a one-way digest of your computer. Five offline accounts are allowed per computer and per internet connection, and counting them means recognising a repeat. Your launcher does not send a machine identifier: it sends a SHA-256 digest of one, and the server hashes that again with a secret of its own before writing anything down. What ends up stored says some machine has made three accounts and cannot be turned back into which machine, or which address, by us or by anyone who ends up holding the file. Microsoft accounts never send this at all.
• Nothing contacts it until you use it. Open the launcher, play Minecraft, never touch the friends button, and no request ever reaches an Asobu server.
• There is no way to delete your account yet. This is a real gap and it is being worked on. Until then, opening an issue on GitHub gets your row removed by hand.

Messages

Friends can send each other messages. The server passes them on and keeps none of them.

• Nothing is stored on the server. A message sits in its memory from the moment you send it until your friend's launcher collects it, and then it is gone. It is never written to a disk there, never part of a backup, and never in the file the rest of the friends data lives in.
• Your own copy is kept on your computer. So that a conversation is still there when you reopen the launcher. Seven days or 500 MB, whichever comes first, then the oldest go. That copy never leaves your machine, and it is described under what is stored on your computer, below.
• There is no history to ask for. Your conversation exists only in the two launchers holding it, and only while they are open. Close Asobu and it is over — nobody, us included, can produce what was said.
• Uncollected messages expire. Send something to a friend who never opens Asobu again and it is forgotten after ten minutes rather than waiting forever.
• Pictures work the same way, and are re-encoded before they go. Asobu shrinks and re-saves every image you send, which keeps it small enough for a relay that holds things in memory. It has a useful side effect: a fresh file carries none of the original's metadata, so the location tag on a phone photo does not travel with it. The picture is encrypted like any other message, and the server cannot tell that one was sent at all — what kind of thing a message is travels inside the encryption, not beside it.
• Only friends can message you. Not people who have asked to be your friend — accepted friends. Removing someone stops them immediately.
• They are encrypted end to end. Your launcher makes a key pair the first time you use chat. The private half stays on your machine, in the same protected file as your Microsoft token; the public half goes to the server so friends can seal messages to you. A message is encrypted before it leaves your computer and opened on your friend's, so the server relays something it has no key for.
• The honest caveat: we hand out the public keys. That means a server that lied — giving you its own key instead of your friend's — could sit in the middle and read everything. No system where one party distributes the keys can rule that out by itself. Every conversation therefore shows a row of numbers under the shield icon; read them to each other somewhere else, and if they match, nobody is in the middle. If they don't, someone is.
• What encryption does not hide. The server still has to know who is messaging whom and when, because it has to know where to send things. The contents are closed to it; the fact of the conversation is not.
• No forward secrecy. The key that protects your messages is long-lived rather than fresh per message, so somebody who both stole a private key and had kept a recording of the ciphertext could read it. Keeping the recording is the hard part — nothing is stored, so there is no archive to take.

Share codes

An instance can be shared as a code, which needs an account to create but not to use. What the server keeps is a list of what the instance contains, never the files themselves.

• What a code holds: the instance name, its Minecraft version and mod loader, and a list of your mods and packs identified by hash. There are no download addresses in it, because whoever imports the code looks each hash up at Modrinth or CurseForge and downloads from there.
• Your worlds and settings are not in it. Only mods, resource packs, shaders and data packs travel. Saves and the config folder stay on your machine, so a code cannot carry a world or a server password you forgot was in there.
• Seven days, then it is deleted. Not archived or hidden, removed. Sharing the same instance again before then gives back the same code with another week on it, and you can withdraw one early.
• Anyone holding the code can read it. That is what it is for. Treat a code like a link: whoever you send it to can pass it on.

Updates

Asobu asks GitHub whether a newer version exists when it starts, and downloads it in the background if so. That request tells GitHub your IP address and which version you are running, the same as any download would. It carries nothing else, and no Asobu server is involved.

Opening a world to friends

This has not shipped. It is described here in advance so there are no surprises when it does, and this section will be rewritten to describe the real thing once it exists. When it arrives, your computer is the server and the world runs on your machine exactly as it does now.

• Worlds never touch our infrastructure. We will not host, store, back up or have any access to your saves.
• Our server only makes the introduction. It passes connection details between the two PCs so they can talk directly, then gets out of the way.
• Relay fallback. Some home networks refuse a direct connection. In that case the game traffic can be relayed through our server so the session still works. Relayed traffic is passed through, not inspected or stored.

Services Asobu contacts

• Microsoft and Xbox Live for signing in.
• Mojang and Minecraft services for verifying you own the game, and for downloading Minecraft, its libraries, assets and the Java runtime.
• Modrinth and CurseForge when you browse or install mods. Mod files download directly from whoever hosts them.
• Mod loader projects such as Fabric, Quilt, Forge and NeoForge, when an instance needs one.
• GitHub for the update check described above.
• api.asobu.cc once you have used friends, or when you make or open a share code.

Each of those sees an ordinary request from your computer, much like the official Minecraft launcher would produce, and each is governed by its own privacy policy.

What is stored on your computer

On Windows an installed Asobu keeps everything in one folder inside its own install directory, so an update replaces the program without touching your data. A source build uses %APPDATA%\.asobu instead. On Linux it is always ~/.asobu, beside the ~/.minecraft you already have, because an AppImage runs from a read-only mount with nowhere beside it to write.

• Instances with your worlds, mods, configuration and screenshots.
• Cache holding Minecraft versions, libraries, assets and Java runtimes, shared between instances.
• Logs from each session, so crashes can be explained. They stay on your disk and are never uploaded.
• Chat history under chat/, one folder per account, so a conversation is still there when you reopen the launcher. It is written in the clear: messages are encrypted so the server cannot read them, and once decrypted on your own machine they are ordinary text and pictures that anything running as you can read — the same as any other chat program's cache. Nothing older than seven days is kept, and the whole archive stays under 500 MB by dropping the oldest first. Deleting the folder loses the history and nothing else.
• accounts.json with the display name and UUID of accounts you have added. No tokens or passwords are in this file.
• tokens.dat holding your Microsoft refresh token — sealed with DPAPI on Windows, and on Linux readable by your user only.
• settings.json with your preferences, such as memory allocation and Java choice.

Mod icons and artwork are cached in your system temp folder so they are not fetched twice. That cache is capped and expires on its own, and losing it costs one re-download.

In portable mode all of this lives in a data folder next to the executable. Deleting the folder removes everything Asobu has stored locally.

Children

Asobu collects nothing from anyone through the launcher itself. If you use friends, the server stores the Minecraft username and UUID that Mojang provides, regardless of the age of the account holder. Microsoft account rules, including family and child-account restrictions, are enforced by Microsoft during sign-in.

Changes

This page is updated when behaviour changes, and it describes what the code does rather than what was intended. The project is open source, so anything here can be checked against the source instead of taken on trust.

Contact

Questions, a privacy problem, or a request to delete your friends data? Open an issue on GitHub.

Last updated: 21 August 2026