Privacy policy

Last updated: 2026-10-12

Who we are

Tulipans Launcher is a desktop Minecraft launcher, together with the web services mc.tulipans.uy and logs.tulipans.uy, operated from Uruguay. Contact: [email protected].

Microsoft sign-in

The launcher signs in to your Microsoft account using Microsoft's official device-code OAuth flow: you open Microsoft's page, enter the code, and Microsoft hands the tokens to the launcher. We never see or store your Microsoft password.

Microsoft, Xbox Live and Minecraft tokens are stored only on your PC and used only to start the game. They are never sent to Tulipans servers.

The only exception, and only when you ask for it: when you link your Minecraft account to your Tulipans account, the launcher sends a short-lived Minecraft access token once so the server can read your public profile (UUID and name) from api.minecraftservices.com. That token is not stored.

What the server stores

  • Tulipans account: username, email, language and your password hash (argon2id; never the password itself). If you use Discord: your Discord ID, username and avatar. If you link Minecraft: UUID and public name.
  • Profiles and modpacks you choose to share: name, description, the mod list (references to Modrinth/CurseForge), the configuration files you upload and the icon.
  • Logs you choose to upload: the launcher first removes tokens, your user paths and emails, and the server filters tokens again. They expire automatically in at most 90 days (30 by default).
  • Play-with-friends invites: the world address and version; they expire in at most 12 hours.
  • Friends and presence: your friends list, requests and blocks; while the launcher is open, your status (online, playing, away), the profile and version you're playing and your custom status. You can appear offline or hide what you play in the Friends privacy settings.
  • Chat and groups: the messages you send to friends or groups (deleted after 12 months), the groups you belong to and each group's linked profile.
  • Activity: what you publish or share (and, only if you turn it on, what you install and play) is shown to your friends for 30 days. It can be turned off.
  • Personal cloud: if you use cloud backups or profile sync, we store those files (worlds, configuration) within a per-user storage limit. You delete them from the launcher.
  • Screenshots you share by link and, if you turn on screenshot backup, private copies of all your screenshots (only you can see them): the image (metadata removed), the profile and where it was taken, until you delete it. Servers you list in the directory and your public profile (bio and, if you turn it on, hours played), which you can make private.
  • Launcher error reports, only if you agree to send them: version, operating system and technical details of the error, without your username, personal paths or tokens, and without storing your IP. Deleted after 90 days.
  • Modpack install counts: when checking a shared modpack for updates, the launcher sends a random install identifier; we keep only a summary (hash) with no IP or user, so the creator can see how many active installs it has. Deleted after 90 days.
  • IP addresses: used in memory for abuse protection (rate limiting) and not stored in the database. They appear in the web server's access logs, which are deleted after 14 days. If you report content, we keep the reporter's IP for moderation.

Third-party services

  • Discord: optional, only if you choose "Continue with Discord" (identify and email scopes).
  • Modrinth and CurseForge: the launcher downloads mods and modpacks from them. CurseForge searches go through our server, which adds the API key and sends no personal data.
  • Microsoft / Mojang: sign-in and game downloads, directly from your PC.
  • Google Workspace: transactional email (email confirmation, password reset, security notices).

    • We don't sell your data or show ads.

How to delete your data

You can delete your account from the launcher (Account → Delete account). That also deletes your shared profiles and modpacks, your logs, your invites, your messages, your personal cloud, your shared screenshots and your activity. Each log can also be deleted on its own. For anything else write to [email protected].

Cookies

The website uses a session cookie only if you sign in on the web (HttpOnly, Secure, SameSite=Lax), and the admin panel uses another one for administrators. We use no tracking or analytics cookies.

Notice

NOT AN OFFICIAL MINECRAFT PRODUCT. NOT APPROVED BY OR ASSOCIATED WITH MOJANG OR MICROSOFT.

Minecraft is a trademark of Mojang AB / Microsoft.