Privacy notice

What stays on your machine

Nearly everything. Settings, accounts and their tokens, instances, worlds, mods, screenshots, play statistics, scan history and the terms you accepted all live in %APPDATA%\DonutLauncher. They are files on your disk. Deleting that folder resets the launcher completely, and because nothing is mirrored to a server, there is no second copy anywhere to delete.

What can be sent

Four things, each with its own switch in Settings → Privacy. Nothing else in the launcher talks to the internet except the downloads themselves.

Your session token or any credential. Your worlds, screenshots, chat logs or server addresses. Your file paths, your mods folder, or the contents of any file. This is enforced in code rather than promised in prose: the payload is checked before it is queued, and anything shaped like a token, a key or a local path is refused and written to the local log instead of being sent.

Turning it off

• Usage data — Settings → Privacy. Off means nothing is queued at all, rather than queued and never sent.
• Account name in the launch report — a separate switch. With it off the report says the account was withheld, which is how the service tells "this player said no" apart from "nobody is signed in".
• The assistant — its own toggle. With it off the launcher's questions never leave your machine, and the pages that would ask one say so instead of failing.
• Crash reports — crashes are analysed locally and shown to you. Sending one anywhere is a separate, deliberate action per crash, never automatic.

The assistant

The assistant runs on the project's own model access, so there is no account of yours and no key to paste. It is not a general-purpose chatbot: it is constrained to DonutLauncher, it is instructed to refuse code, and it is instructed to refuse requests to ignore those instructions. Neither your screen nor your machine is available to it — it is sent the text described in the table above and nothing else.

Offline

With no connection, the launcher works: instances, mods, the scanner, the crash analyser and an already-installed version all function. The parts that need the network — signing in, downloading versions, refreshing a profile and the assistant — are dimmed with a reason rather than left to fail when you press them.

Who else is involved

• Mojang and Microsoft — the game files, the version manifest and account sign-in come from their services, under their own privacy terms. The launcher is a client for them, not a party to them.
• The website — this site keeps a short-lived request counter per IP so the assistant cannot be used as a free API, and it logs the request line for troubleshooting. It sets no advertising or tracking cookies and loads nothing from a third-party domain.
• Discord — if you join the community server, or link your account to it for roles and streaks, that relationship is between you and Discord, and a link can be revoked at any time.
• Model providers — assistant requests are processed by a third-party inference service on our behalf. They are sent without an identifier tying them to you, and are not used to build an advertising profile.

Children

The launcher is not directed at children under 13 and does not knowingly collect personal data from them. If a child uses DonutLauncher, turn the optional reports off; nothing about the launcher requires them.

Keeping and removing data

Reports are kept in aggregate form and are not tied to a name or an account unless the account switch is on. Installation ids older than a year are dropped. Because your launcher data lives on your machine, the fastest way to remove it is Settings → Storage, or deleting %APPDATA%\DonutLauncher. To ask about data that did reach the service, email privacy@donutlauncher.com.

Diagnostics you choose to send

When the launcher writes a diagnostic report it does so to a file you pick: system information, the channel list and the tail of the launcher log. It is a file on your disk. Sending it to anybody is your decision, which is the only way a support request should work.

Changes to this notice

If what the launcher sends changes, this page and the changelog change with it, and the change is stated at launch. The privacy pane inside the launcher always reflects the build you are running, which is the version that matters.