Privacy and data¶

No advertising, no tracking, no analytics. Your Microsoft and Minecraft credentials stay on your computer. The launcher talks to the Xol service to check for updates, profile data and notices, sends a small online heartbeat while it is open (you can switch it off), and sends a crash report only if you have switched that on and pressed Send.

This page explains the mechanics. The binding text is the privacy policy on the product site; if the two ever disagree, the policy wins and this page is wrong.

What the launcher sends to the Xol service¶

As with any internet service, the server sees the IP address a request comes from. Server logs are kept for 14 days for security and abuse prevention and are not used for anything else.

Launcher 0.3.1 has no access key field. A key saved by an older launcher is still sent, only to the Xol service's fixed address, as an authorization header, and the launcher refuses to follow redirects on those calls. The key is a random string that was issued to testers. The launcher does not link it to your Microsoft or Minecraft account. To stop sending it, quit Xol and delete service.json from the data folder.

Never sent to Xol: your Microsoft password (Xol never has it), Microsoft, Xbox Live and Minecraft tokens, your UUID, your worlds, your settings, the OptiFine file you add, and anything about your Downloads folder. Your player name is sent only in the online heartbeat, while that switch is on.

The Downloads folder. While the Add OptiFine dialog is open, and only then, Xol reads the list of file names in your Downloads folder and opens only a finished file named like an OptiFine download for the selected Minecraft version (OptiFine_<version>_HD_U_….jar); it changes nothing in that folder, stops when the dialog closes, and nothing about that folder or the file is sent anywhere. The rules are on OptiFine.

Online status¶

Settings ▸ Service ▸ Online status ▸ Show me as online to the Xol team. On by default. Nothing is sent until you have agreed to the notice the launcher shows on first start. The heartbeat has exactly these seven fields and nothing else:

It is sent when Xol starts, once a minute while it is open, when one of these fields changes, a last closed when you quit, and one closed when you switch it off. After that nothing more is sent. Each send gives up after four seconds and is never retried; a failure is silent and never delays Play.

On the server the heartbeat is kept in memory only, never written to disk. The install ID is stored only as a one-way hash (SHA-256). An entry disappears three minutes after its last heartbeat, or at once when closed arrives. The list the Xol team sees shows the username, launcher version, profile and Minecraft version, operating system, idle or playing, and when the launcher was first and last seen. It shows no IP address, and none is stored with it. Like any request, the heartbeat reaches the server from your IP address, and the normal server log keeps that for 14 days, as described above.

Other connections the launcher makes¶

These are plain requests. Xol sends them nothing beyond what any download involves: your IP address and a user-agent. See What gets downloaded.

The two Apple Silicon rows are contacted the first time a game is started with the native runtime, which is the default there, and again only when a file is missing or no longer matches its checksum. They are never contacted on Windows, Linux or an Intel Mac, and never while Settings ▸ Java ▸ Java runtime for 1.7 / 1.8 is on Intel (Rosetta 2). Two more files for that runtime come from Mojang's library server, which the launcher contacts anyway. Every file is checked against a checksum fixed inside the launcher before it is used. See Apple Silicon.

What the client does inside the game¶

The Xol client reads local game state to draw the HUD and stores its settings on your computer. When you join a server it sends the standard client-brand label with the text Xol, the same message every Minecraft client sends with its own name. See Multiplayer and fair play.

The client talks to the Xol service for two things only: the network level and Bed Wars star of Player info and the Xol badge. Both are described below. Apart from them, the client connects elsewhere only in these cases:

• The themed server list starts the status ping of each saved server that the vanilla list would start, with the game's own pinger. Those pings go to the servers in your list, as in vanilla.
• Ping, with its "Server ping" or "Auto" setting, asks the server you are playing on for its public status, the same request the server list makes.
• Auto Text sends a line you wrote to the server you are on, when you press its key.

Network level and Bed Wars star¶

Hypixel ▸ Player info, off by default. Its Network level row is on by default. To show the network level of players near you, the client sends the Xol service the Minecraft account IDs of players within 64 blocks and the random ID of your game folder. The answer also holds each player's Bed Wars star. In Bed Wars, in its lobbies and its games, the line shows the star, and the client asks even with Network level off, while Bed Wars star and In Bed Wars, the star are on. Both are on by default. A star the server prints itself is used first. The client never sends names, and never asks about nicked players or NPCs. A request holds at most 32 IDs, and the client sends at most one request every 2 seconds.

The service looks the levels and stars up in a public cache of Hypixel player stats. It keeps the answers in memory for up to 12 hours. Nothing is written to disk. Switch Player info off, or switch both Network level and Bed Wars star off, and the client stops asking. There is no Hypixel API key to enter.

Xol badge¶

Settings ▸ Xol Badge, with Next to name tags, In the player list, Side in the player list and Hide my badge.

While you are in a world, the game proves to the Xol service that it runs on your Minecraft account. It uses the same Mojang session check a server uses when you log in. Your sign-in token goes only to Mojang, never to Xol.

Then, once a minute, the game tells the service that your account is on Xol. It also asks which of the players it shows, in nearby name tags and in the player list, are on Xol. For that it sends only their account IDs and the random ID of your game folder.

The service keeps only your account ID, a hashed session key and the time of the last check, in memory. It keeps no names, no addresses and not the server you are on, and it logs nothing per request. A restart of the service forgets all of it. You count as on Xol for 3 minutes after your last check.

Switch on Hide my badge and all of this stops.

Discord¶

Settings ▸ Discord ▸ Show what I'm playing on Discord, on by default. Xol talks only to the Discord app on your computer, over Discord's local connection. Your Discord profile then shows that you are playing Xol, what you are doing, which version you are on and for how long. With Show the server name on, it also names the server; a LAN world, a private server and any address that is not a public name are shown as "a private server". Nothing is shown while Discord is not running. Switch it off and Xol stops telling Discord anything.

Diagnostics¶

Settings ▸ Support ▸ Diagnostics ▸ Allow sending reports to Xol. Off by default. While it is off, Xol sends nothing of this kind. Consent is stored only as an explicit "yes" that you set; a missing or damaged value counts as "no".

When it is on, two things can be sent:

1. A failed update is reported automatically: launcher version, system type, the reason. No game log.
2. A crash report is sent only when you press Send this crash report… after a crash, look at the preview, and press Send.

The preview¶

The report dialog shows the exact payload, already redacted, with its size: "This is everything that would be sent to Xol (…). Tokens, e-mail addresses, IP addresses and your home folder path have already been replaced. Read it; nothing is sent until you press Send."

• Send is disabled while diagnostics are off. You can switch them on in the dialog itself.
• No access key is needed. An access key saved by an older launcher goes along, so the report keeps that key's identity.
• What is sent is the object you were shown and nothing else. It has exactly these fields: consent, kind, launcher version, OS, architecture, profile identifier, Minecraft version, summary, stack hash, log. Any other field is refused by the service.
• The log part is the end of the crash report and the end of the game log, at most 1,500 lines and 120,000 characters each. A report sent without a key is fitted to 64 kB, and the preview is exactly what is sent.
• The stack hash is a short hash of the exception line and the first frames with line numbers and memory addresses removed, so the same crash on two machines groups together. It contains no text from your log.
• After sending: "Thank you. It contains no account data and cannot be used to sign in as you."

What redaction removes¶

Redaction happens on your computer before you see the preview. The server applies the same redaction again on arrival.

The privacy policy also says that chat lines are dropped from crash reports. The launcher's own redaction, listed above, does not remove them, so chat can appear in the preview. The service applies its redaction on arrival and reports how many lines it dropped. If a preview shows chat you do not want to send, do not send it.

Retention¶

Crash reports are deleted after 30 days. Server logs are kept for 14 days. An online status entry lasts at most three minutes after its last heartbeat.

The support log¶

Settings ▸ Support ▸ Export support log… writes one text file to a place you choose. It is never sent anywhere by Xol; you decide whether to attach it to an e-mail. It goes through the same redaction as above.

A game log can contain chat, server addresses by name and player names, because the game prints them. Read the file before you send it to anyone. Details on Support log and crash reports.

What is stored on your computer¶

Paths are on File locations.

Your choices¶

• Remove your account in Xol at any time; revoke Xol's access at account.microsoft.com.
• Leave diagnostics off, or switch them off again in Settings ▸ Support.
• Switch off Show me as online to the Xol team in Settings ▸ Service. Your entry disappears from the list at once.
• Delete service.json from the data folder, with Xol closed, to remove an access key an older launcher saved.
• Switch off Show what I'm playing on Discord in Settings ▸ Discord.
• Switch off Network level and Bed Wars star in Hypixel ▸ Player info, or switch Player info off.
• Switch on Hide my badge in Settings ▸ Xol Badge.
• Ask for a copy or deletion of anything tied to an access key or your e-mail address by writing to contact@xol.dev. The policy promises an answer within 30 days.

This documentation site¶

This site sets no cookies and loads nothing from any other origin: no fonts, scripts, images or trackers from third parties. Search runs in your browser against an index served from this site.