Onyx Client Privacy Policy

Version 4 — effective 23 October 2026

1. Who is responsible

Revealed SMP operates Onyx Client and its connected website services, with operations in Germany and the United Kingdom. For privacy, data-access, objection, deletion and dispute requests, email disputes@revealedsmp.com. This policy describes the Onyx build and services; independent game servers, Microsoft, Mojang, Discord and content providers also apply their own policies to their processing.

We distinguish data kept on your device, data processed by Revealed SMP, and data sent to other providers. We do not treat acceptance of the terms or this notice as consent to every possible use of personal information.

The required sign-in notice described here is implemented in the official Onyx Client 2.8.5 release and later builds retaining this feature. Older or independently modified builds may behave differently. Re-acknowledging these policies while an eligible account is already signed in can also trigger the notice.

2. Information stored on your device

Onyx stores settings, account profiles, Minecraft UUIDs and usernames, authentication access and refresh tokens, policy-version acknowledgements and their time, caches, download state, diagnostics and game-related files in its local data directory. On Windows the default directory is %APPDATA%\RevealedSMP\OnyxClient; a custom data directory may be selected. Game folders and backups may also be stored elsewhere according to your settings.

Tokens enable the launcher to authenticate and refresh access. They are sensitive. They are stored locally using the launcher's account storage and operating-system file access controls; this policy does not claim that every local file is encrypted. Protect your Windows account and backups. Removing an account from Onyx removes its saved launcher account state; it does not delete the Microsoft account or copies in your backups.

Local files are retained until you remove them or the relevant cache maintenance acts on them. Uninstalling application files intentionally leaves your separate data folder in place. Review that folder and your backups if you want to remove local data, and back up worlds first.

3. Authentication and necessary network requests

Microsoft/Mojang receive the authentication and entitlement requests needed for a Microsoft-backed Minecraft account. Password entry and account approval take place with Microsoft; Onyx is not intended to send your Microsoft password to Revealed SMP. Authentication produces tokens used with the relevant Microsoft/Mojang services and held in local account storage.

Game, Java, loader, image and content providers receive requests needed for the versions and content you select. The website receives update, catalog and policy requests. These providers ordinarily see connection information such as a requesting IP address, user agent and request time as part of delivering their services. That does not mean those details are placed in our Discord account notices.

The launcher may rely on Microsoft/Mojang, Modrinth, CurseForge, Java and game-file hosts, GitHub-hosted resources and the documented Polyfrost metadata-format service. Onyx does not activate the upstream Poly+ social-account service. Upstream code attribution does not make its authors the operator of Onyx.

4. Required Minecraft sign-in notices

After you acknowledge the current terms and privacy notice and complete a connected Microsoft/Minecraft sign-in, Onyx automatically attempts to submit a required account-activity notice through revealedsmp.com to a private Revealed SMP staff Discord channel. This is enabled as a required part of this connected sign-in flow; there is no ordinary in-app opt-out switch for it.

The information in the Discord notice is your Minecraft UUID, its associated public skin-head image, accepted terms and privacy versions, client-reported acceptance time, launcher version and the server's notice time. The website briefly processes your Minecraft username to verify the UUID against Mojang; the username is not an additional Discord field in this implementation. MCHeads receives the UUID when Discord obtains the head image. Discord processes the message, image request and delivery metadata under its own terms and privacy policy.

The notice does not include your email, IP address, Microsoft password, access token, refresh token, device verification code, session cookie, chat history, worlds or other local files. No Minecraft session-join request is made for this notice. Authentication tokens remain in the normal authentication/game flow; they are not sent to the Revealed SMP relay, MCHeads or Discord.

The stated purposes are accountable connected-account activity, abuse investigation and service/security operations. Revealed SMP relies on its legitimate interests for this limited account-activity processing where that basis is available, subject to necessity, proportionality, a documented balancing assessment and users' rights. We do not describe a compulsory feature as freely given optional consent. Accepting the policies acknowledges the disclosure; it does not waive your right to object.

The relay uses a short-lived challenge and checks the public Minecraft UUID/name match before forwarding a notice. This does not prove control of the account: a modified client or forged request can report public profile data. It also does not prove age, that a document was read, that every consent requirement was met, or that a contract is enforceable. A notice may fail because of service outages or account restrictions. Login does not become a promise that Discord delivery always succeeds.

5. Retention of sign-in notices and relay data

The plugin queues Discord notices for deletion after 30 days. It keeps the message identifier, expiry and a destination fingerprint so cleanup can run. Actual deletion depends on WordPress cron running, the webhook remaining usable and Discord responding; failed deletion is retried. Hosting or Discord backups may follow their separate deletion cycles. The operator must monitor cleanup and respond to earlier valid deletion requests.

Challenge records contain the limited profile and policy fields and expire after five minutes; physical removal follows WordPress's normal expired-transient cleanup. Pseudonymous request-rate counters and duplicate-notice keys expire after their short operational windows, up to 24 hours. Raw IP addresses are not added to those counters; keyed hashes are used, although ordinary hosting access logs can still contain connection IP addresses.

Security, support and legal records are retained for as long as reasonably necessary for their stated purpose, a documented incident, a legal duty or the establishment, exercise or defence of legal claims, with periodic review. Hosting logs and backups follow the applicable provider configuration and recovery cycles. Contact us for the retention applicable to a particular request. We do not retain these records merely because they might be useful indefinitely.

6. Optional and separate features

Anonymous online count is a separate, default-off setting. If enabled, the launcher sends a randomly generated installation identifier to the website while open. The presence counter excludes stale entries after its active window; ordinary server logging is separate. This identifier is not a Minecraft UUID, but we do not promise it is impossible to associate it with a device through other records.

Discord Rich Presence is separate from the required staff notification. It is off by default and needs an operator-configured Discord application. When enabled, activity is shared with the user's local Discord client and Discord according to that feature's configuration.

Crash reporting is off by default and needs a configured reporting destination to send reports. If enabled and available, diagnostics can include errors, technical context and file paths that may contain identifiers. Review a report or support log before sharing it. Optional settings must respect any consent requirements that apply in your location.

Automatic update checks can be disabled. Installing an update asks first and checks the release signature and hashes. A check contacts the website; it does not upload your worlds or Microsoft account credentials.

This build does not include the advertising, behavioural-advertising profiles, advertising-ID trading, voice-chat collection or marketing-data sale described by some other launchers. This is not a promise about independent websites or mods you choose to use. New materially different processing needs an updated notice and the applicable lawful basis before it starts.

7. Website accounts, email and moderation

An Onyx website account is separate from Minecraft. Website features can process the username, display name, email, password hash, verification and reset state, login/session records, email preferences, support correspondence and moderation information needed for that account. Passwords must not be included in staff Discord messages or support requests.

Website account notifications are a separately configurable administrator feature. If enabled, the existing website account system can send a website username, display name, email, account ID and time to a private staff Discord channel after relevant verified account events. That is distinct from the Minecraft UUID/head notice. The operator must disclose and configure this separate website feature appropriately before using it.

Transactional verification and reset emails use the site's mail provider. Promotional campaigns use the subscriber preferences and unsubscribe controls that apply to them. WordPress session and anti-forgery cookies support requested account functionality. Onyx Hub 2.1.0 provides Accept all, Only necessary and Cookie settings controls on ordinary website pages. The first-party onyx_cookie_choice cookie records the choice for 90 days; it uses the site path, SameSite=Lax and Secure on HTTPS. If you separately permit appearance storage, onyx_website_theme remembers Dark or Light for 90 days. It is not written before permission and is deleted when you withdraw appearance permission. Without permission, a theme preview lasts only for the current page. Cookie settings remains available to change or withdraw your choice without changing your account or launcher settings.

The Onyx plugin adds no advertising or analytics cookies. Other WordPress plugins or hosting services can use separate technologies; those need their own assessment and controls. Necessary sign-in, security and preference-choice storage is distinct from optional appearance storage. Accepting launcher terms or acknowledging this policy does not provide blanket cookie consent. Blocking necessary cookies can prevent sign-in or saving your choice; optional storage stays off if the choice cannot be saved.

Account data is retained while needed to provide the account and resolve relevant security, moderation, legal and support matters. Deletion requests are assessed under applicable law; a minimal suppression record may be kept where needed to honour an unsubscribe, objection or deletion request and avoid reintroducing the data.

8. Recipients and international processing

Recipients can include authorized Revealed SMP staff, hosting and backup providers, email providers, Microsoft/Mojang, Discord, MCHeads and the content/download providers needed for the features you use. We disclose data only for the relevant purpose and use proportionate access restrictions. A private channel is still disclosure to Discord and its authorized channel members, not local-only storage.

These providers or their personnel may process information outside Germany, the UK, the EEA or your country. Where EU or UK transfer restrictions apply, the operator must use an applicable lawful transfer mechanism and safeguards, and provide information about them on request. We do not claim that an EU/UK team location by itself prevents international transfers. Provider backup, security and legally required records may be subject to the provider's own retention obligations.

We may disclose information where required by law or a valid legal process, or where lawfully necessary to protect people, investigate abuse or establish, exercise or defend legal claims. Requests must be assessed; a request is not automatically a justification for unlimited disclosure.

9. Legal bases and your choices

Depending on the activity and applicable law, processing may rely on providing a requested service or performing a contract, legitimate interests such as proportionate security and service operations, a legal obligation, or valid consent for an optional activity. A basis must actually fit the activity; labelling something “required” does not itself establish legal necessity. The mandatory sign-in notice is not an advertising consent or a waiver of privacy rights.

Where applicable, you may request access, correction, erasure, restriction, portability, information about recipients/transfers, or object to processing based on legitimate interests. On a valid objection we will stop the relevant processing unless we demonstrate compelling legitimate grounds that override the applicable rights and interests, or the processing is needed for legal claims. Direct-marketing objections must be respected as the law requires. Where processing relies on consent, you may withdraw it for the future without changing the lawfulness of earlier processing.

Send requests to disputes@revealedsmp.com with your relevant UUID or website account details and the request. We may use proportionate identity checks; do not send passwords or tokens. We respond within the applicable legal period, normally one month under EU/UK GDPR, with any lawful extension explained. We do not charge merely for making an ordinary request where the law requires it to be free.

You can complain to the data-protection supervisory authority with jurisdiction, including the relevant German authority or the UK Information Commissioner's Office, and can seek judicial remedies. We do not require you to waive those rights or finish a private dispute process before using them. Declining the connected sign-in service does not remove open-source rights in the software.

10. Children, security and changes

Connected services are intended for people aged 13 or older, with a parent or guardian involved where the law requires. We do not claim that a Microsoft profile proves age or parental permission. Local child-protection and digital-consent requirements apply, and children's interests require particular care in any legitimate-interest assessment. Contact us if a child has supplied data contrary to these requirements so we can assess restriction or removal.

We use proportionate safeguards, HTTPS and restricted staff access, but no system or transmission is guaranteed secure. Keep account credentials private, review third-party mods and protect local data and backups. Report suspected exposure to disputes@revealedsmp.com.

Material changes are versioned and presented for renewed acknowledgement in Onyx. The operator must assess any new purpose, recipient or lawful-basis requirement before implementing it. An update to this notice does not retroactively authorize undisclosed processing. Contact disputes@revealedsmp.com with policy questions or privacy requests.

11. Optional Onyx Social

The in-game friends and world-invitation service is separate from the required sign-in notice. It remains inactive until the operator enables it and you choose Connect after reading its separate notice. Its notice is available at https://revealedsmp.com/onyx/social-privacy/. Choosing not to connect does not prevent ordinary Minecraft play.

When you connect, Minecraft proves profile ownership directly to Mojang; the Onyx website never receives Microsoft/Minecraft access or refresh tokens. Revealed SMP stores your UUID, username, notice acknowledgement/version, friend requests, accepted friendships, blocks and explicitly shared world invitations. A separate random social session lasts up to 24 hours; only its hash is stored on the website and the client holds its token in memory. No social chat, presence tracking or activity history is provided.

Friends see your UUID/name; an invited accepted friend receives the server address and Minecraft version you explicitly share. Invitations expire after 30 minutes, pending requests after 30 days and sessions after 24 hours; scheduled cleanup removes expired rows. Your profile and accepted friendships remain until removed or erased. Erase social profile deletes your profile, sessions, requests, friendships and invitations; another player's UUID block may remain to prevent re-registration abuse, subject to applicable rights and individual review. It is not an indefinite exemption from data-protection law. You may sign out, block, remove friends, dismiss invitations and request erasure from the panel or disputes@revealedsmp.com. Existing hosting-log, backup, security, child-protection and rights provisions continue to apply.

If you separately install and use e4mc, game connection traffic passes through its relay under that service's policies. Onyx Social does not automatically install or enable a relay and never joins invitations without your action. Share addresses only with trusted players; the host/relay can process normal connection information.

12. Hosted world resource packs

If you choose Share resource pack in Host World, you provide a public HTTPS ZIP URL. The game downloads that URL to validate a bounded resource-pack archive and calculate its checksum. It sends no Microsoft, Minecraft or Onyx social session token with that request. The URL and checksum are offered to joining players through Minecraft; each guest chooses whether to download the optional pack. The pack host receives ordinary connection information when the host or a guest requests the file. Do not enter a private account URL, password or a link you are not entitled to share.

The URL is kept in the running world's hosting state rather than the Onyx social database. No resource-pack file is uploaded to the Onyx website by this feature. If you independently upload a pack through WordPress Media or another host, that host's storage, access and retention settings apply. Local files need to be hosted separately. Use a pack compatible with the game version and respect its authors' permissions.

13. Local Quickplay history

The in-game main menu keeps the names and addresses of the three most recently joined multiplayer servers in config/onyx-recent-servers.json inside that game instance. This history stays on your computer and is not sent to Revealed SMP, Discord or Onyx Social. Quickplay connects to a saved address only when you click its button; the selected server receives the normal Minecraft connection information. Clear recents removes this local file. Ordinary operating-system backups may retain earlier copies under your own backup settings.