legal

privacy policy

last updated: october 2026

This policy explains what data pluto collects, why we collect it, how long we keep it, who receives it, and your rights. The data controller is the operator of pluto, based in Sweden. Send privacy requests to privacy@pluto.lgbt; we respond by email. You can also contact us through Discord, but a Discord account is not required.

pluto collects only the data needed to operate the machine-bound launcher. We do not collect the servers you join, how long you play, which features you use, your chat, your keystrokes, or your screen. Section 1 lists all the data we collect.

1. what we collect

  • account data: username, email address, your password (stored only as a one-way hash), the date you registered, the date your email was verified, your account's access flags, and your member number (the order accounts first got access, shown beside your name). We never store your plaintext password and cannot recover it.
  • hardware identity: a few stable identifiers of your computer (section 3), so we can bind your license to it. We store them only in hashed form, never the raw values. We also keep a random device identifier for the binding, the public half of a sign-in key the launcher makes on your computer (the other half stays on your computer and is never sent to us; during a key change we may also keep the next key's public half for up to seven days), and a record of changes to it: when it was created, reset or refused, and which identifier changed (never its value). If the same hardware is bound to another account, we note that for review.
  • sign-in and security records: login times, your IP address in hashed form, records of your sign-ins and launches, the date of your most recent hardware reset, and enforcement actions such as suspensions or terminations. Logging in on this website sets one cookie that keeps you logged in. It lasts a week from the last time it was used (30 days at most) and is removed when you log out, reset your password or are banned. Your browser also keeps a plain note that you were logged in, which holds nothing about you and is removed when you log out.
  • where you sign in from: the IP address of each log-in to this website and of each game session, with the city, region and country it points to, looked up in a geolocation database kept on our own servers. The same address on the same day is kept as one entry. You can see yours on the account page of your dashboard, and our staff can see them too.
  • launcher sign-in: the launcher you download from your dashboard carries a sign-in for your account, so it can sign you in without typing once your computer is linked. We keep a record of it: when it was made, when it was last used and how often, and whether it has ended. It lasts 90 days from its last use (a year at most) and ends when you reset your password or your device, or are banned. You can download a new launcher at any time.
  • session records: while pluto runs, a record of your session: the build channel and version, a fingerprint of which Java runtime build your launcher is running, your IP address in hashed form, when it started, was renewed and ended and why, the result of the client's integrity checks at each renewal, whether the launcher and its native component measured as the copies we issued, the outcomes of short server-issued integrity challenges, and short-lived technical values that tie the session to your launch. If a second session tries to start while one is live, we refuse it and record that.
  • delivery records: which build, channel, operating system, and architecture you downloaded, the highest build number your account has acknowledged per channel, artifact sizes, and the release notes shown to you. These exist so downloads can be traced and supported. Each build you download is marked as yours, so a copy shared outside your account can be traced back to it, and we keep a record of each build file we serve you (which release and platform, and the kind of account it went to).
  • detection and enforcement records: automated checks look for unusual use of an account and record an event when one fires (which check, when, and what it counted). Some only record, for a person to review; others can suspend your license pending review. Requests to addresses our server does not have, made from an address an account has signed in from, can also suspend that account pending review. A suspension opens a case with a reference and keeps the evidence behind it, and shows you the reference. You can appeal from your dashboard, and what you write is stored with the case along with an operator's decision and notes.
  • your settings: if you use pluto's module settings, we store them with your account: for each profile (up to ten) and module, the values that differ from the defaults, its last five versions, and the profile names you choose. Every change is recorded (when, and from which session) without the values. Free-text settings are for short labels, so don't put anything secret in them. You can share a snapshot of a profile's settings as a short code: anyone with the code can look inside it and import it into a new profile on their own account. Shared codes are never anonymous: whoever holds one sees your username and, if you have one, your profile picture, along with the code's label, when it was made, how many times others imported it, and which modules it changes and how many settings in each. The values themselves only reach their account if they import it. We store the profile name each code came from, record who exported and who imported it, and count imports by others (with the time of the latest) so you can see them. Codes don't expire: deleting one stops future looks and imports; deleting all of your settings (purge) removes their values, history, codes and extra profiles at once, along with your hud layouts, your preferences and what modules keep for you. With each profile we also keep where you placed each element on your hud. Your preferences, which are the same on every profile, are the menu key, the size and speed of the menu, where it sits on your screen, whether it blurs the game behind it, whether your hud blurs under the player list, and which notifications you see and where.
  • what modules keep: a module can store short text for your account (a list of waypoints, say), up to 256 KB per module, so it is there the next time you play, on any computer. Only that module of your account reads it, and it is stored as plain data.
  • messages between players of a module: a module can send a short message (up to 4096 characters) to the other players on the same game server who run the same module. To find them, your client sends us a hash of the server's address (never the address itself), the module, the name you play as and the message. We pass the message and that name on to those players and keep none of it: who is on which server and what is waiting to be passed on live only in our server's memory, for under a minute.
  • notifications: pluto's team can send a notification to everyone, to everyone on one release channel, or to one account. We record which account was shown each one and when, so that you see it once and so we can tell how many people it reached. If you turn pluto's notifications off, they are still delivered to your client and recorded; only the ones marked important are shown.
  • integrity reports: the client checks on your computer that it hasn't been modified or interfered with. If a check fails, or the launcher can't start pluto for another reason, it stops and, if you are logged in, sends us a short report: a code for what stopped it, your account, your IP address in hashed form, the build channel and version, your operating system with its version and architecture, your Java version and vendor, the game version, the number of processor cores, the memory limit Java was given, and how long the game had been running. It also says whether the machine appears to be a virtual machine (including a processor timing measurement that suggests one), and the names (never the values) of any Java launch options outside the set ordinary launchers use. When the launcher stops a launch, the report adds the launcher and Fabric versions, how far the launch got and how long each step took, the errors behind the stop and where they happened, and the launcher's last 30 log lines. Before sending, the paths of your folders, your computer's account name and anything that looks like a password, key or token are removed. Reports never include your other programs, your files, or your settings. While your session runs, each renewal also sends a short summary of those checks and the server asks your copy to prove it hasn't been changed; if a check fails, the session ends and the failure is recorded.
  • email verification codes: when you register or log in we email you a six-digit code. We store a hash of the code, your email address, its purpose, and when it expires and was used.
  • support records: what you send us by email or in a Discord ticket, including the account identifiers needed to resolve it.
  • payments: processed by third-party processors, including cryptocurrency processors. We receive confirmation, amount, timestamp, currency, and any payer identifier the processor passes back for reconciliation. We never see card numbers, bank credentials, or wallet seeds.
  • bot checks: counts and coarse timings from the captcha on our own pages, described in section 11.
  • signup location check: when you register, we look up the country your IP address belongs to in a geolocation database kept on our own servers, so no third party sees the lookup, and store the country with your account. We use it to meet sanctions law: sign-ups from comprehensively sanctioned regions can be refused, and sign-ups from anonymizing networks such as Tor can be held for a person to review. IP geolocation by DB-IP.
  • profile picture (optional): if you upload one, your browser crops and re-encodes it to a 256 by 256 pixel image before sending it, and we strip any remaining embedded data (such as camera or location details) before storing it with the date it was set. Only you can see it, while logged in, with one exception: if you share a settings code, anyone holding that code sees it next to your username. It is never public or analysed, and you can remove it at any time.
  • username history: when you change your username we record the old name, the new name, and the date. This keeps your old name reserved for you for 45 days and lets us match support and security records across a rename.

What we do not collect: the addresses or ports of the servers you connect to, your playtime, feature-usage counters, crash reports, browsing history, chat, typed content, or screen and audio capture. The integrity report described above says only how long the game had been running when it was sent, and when the launcher stops a launch it carries the error details listed there rather than a crash report. There are no advertising trackers and no analytics SDKs on this site, and we do not sell personal data or share it with data brokers.

Apart from the integrity report described above, nothing about the programs on your computer is sent to us, and that report names no programs other than pluto, the game, Fabric, Java, and your operating system.

  • performing the contract (GDPR Art. 6(1)(b)): your account, your license, binding it to one machine, delivering builds, checking entitlement, and support. Reading the machine identifiers and running the integrity checks are necessary for the service you asked for, so we rely on the exemption for strictly necessary device access rather than on consent. Accepting these terms is not treated as consent to this processing.
  • our legitimate interests (Art. 6(1)(f)): keeping the service stable and secure, preventing license and payment abuse, protecting the client against tampering, cracking, and unauthorised redistribution (integrity reports and build identifiers), preventing impersonation (username history), investigating misuse, enforcing one license on one device with one live session at a time, showing you and our staff where your account is used from so a log-in you don't recognise can be spotted, and keeping audit and delivery records. Our interest is operating a paid, machine-bound service that cannot work if licenses are freely shared, and supporting customers whose builds are failing. We have balanced that against your rights by storing hardware identifiers only in hashed form, keeping full network addresses no longer than 90 days, keeping delivery records narrow, and never using this data for advertising or profiling for anyone else. You may object under section 6, and we will stop unless we show compelling grounds that override your interests, or the processing is needed for a legal claim.
  • legal obligation (Art. 6(1)(c)): tax, accounting, and other records we must keep by law, the signup location check we need to meet sanctions law, and disclosures compelled by valid legal process.

Where your jurisdiction does not use GDPR terminology, equivalent concepts apply: we process your data to perform our contract, to protect the service, and to meet legal duties.

3. hardware identifiers

To bind your license to your computer, the launcher reads a few identifiers that your operating system and hardware already provide, such as identifiers of the computer itself, its system board, processor, storage and network hardware. We never read your files, browsing history, or content to do this. If the launcher sees that this information has been hidden or replaced, it says so when you sign in (only that it did, and of what kind).

We store these identifiers only in hashed form, and replacing one part of your computer does not lock you out. Binding happens at first login, and you can reset it yourself once a week. The hashes remain personal data while linked to your account and are not anonymous.

4. how long we keep it

  • account data and hardware binding: for the life of the account, then deleted or anonymized, with up to 30 days for recovery;
  • sign-in records: 7 days, then expired and purged;
  • launch records: 90 days;
  • where you sign in from (addresses and places): 90 days after the address was last used;
  • launcher sign-ins: until they lapse or end, then 90 days;
  • session records: 30 days after the session ends, and the short-lived values in them a few minutes;
  • website log-in cookies: a week after they were last used, and never more than 30 days after you logged in;
  • device-change records and detection events: 12 months;
  • cases, their evidence snapshots and appeals: 12 months after the case is closed, and until it is closed if it is still open;
  • records of the build files issued to your account: 12 months after the file was last fetched;
  • your settings: for the life of the account, with each module keeping its last five versions; deleting a profile deletes its settings, and closing the account deletes them all;
  • your hud layouts, your preferences and what modules keep for you: for the life of the account (a hud layout goes with its profile);
  • messages between players of a module: not stored, only held in memory for under a minute while they are passed on;
  • notifications sent to players, and the record of who was shown each: 90 days after the notification stops being sent;
  • bot-check and device-key challenges: minutes, then deleted automatically;
  • checks that your copy hasn't been changed: a few minutes, then deleted automatically;
  • email codes: 10 minutes, or until used, and removed shortly afterwards;
  • security, delivery, and integrity records (logins, downloads, resets, integrity reports with their diagnostics, and username changes): 12 months, then deleted automatically. If one is needed for a specific legal claim, we keep a copy of that record until the claim is resolved;
  • signup location checks: 12 months;
  • payment and tax records: 7 years, as Swedish accounting law requires, or 10 years for EU VAT records where those apply;
  • profile picture: until you remove it or close your account, then deleted from our database at once;
  • username history: 12 months after each change;
  • support correspondence: 24 months after the matter closes.

If you ask us to close your account, we delete or anonymize the data above without undue delay, except where we are required or permitted to keep it, for example tax records, or the minimal hardware hashes needed to prevent abuse of the same machine. To ask, email privacy@pluto.lgbt.

5. who receives your data

infrastructure providers. The site and the licensing service run on infrastructure in the EEA (Sweden), and email is relayed from infrastructure in the EEA (Germany). They act as processors on our documented instructions, under confidentiality and purpose limits.

payment and cryptocurrency processors. They act as processors for processing payments, and for some fraud-prevention and legal-compliance steps they act as independent controllers. Each publishes its own privacy notice, which also applies to you when you pay.

discord. If you contact us on Discord, Discord receives whatever you post there and acts as an independent controller for its own platform. If you never use Discord, we send nothing to it.

nothing else on this website. Our typefaces are served from our own servers, and we do not load fonts, analytics, advertising, or tracking scripts from anyone else.

Apart from that, we disclose personal data only: to processors as described; where valid, binding legal process or applicable law requires it, after checking its validity and scope and telling you unless we are forbidden to; to establish, exercise, or defend a legal claim; or in connection with a merger, acquisition, or asset sale, with protection continuing under this policy.

6. your rights

Under the GDPR and UK GDPR, and to the extent equivalent rights apply under laws including the CCPA/CPRA (California), PIPEDA (Canada), and comparable regimes, you may ask us for access to, correction of, portability of, restriction of, and erasure of your personal data, and you may object to processing based on legitimate interests. Send the request to privacy@pluto.lgbt. Requests can also be made through Discord, but email is sufficient and no Discord account is required. We verify identity in proportion to how sensitive the request is, and we respond within one month, extendable by two months for complex requests with notice.

Some decisions are made automatically, for example when a machine binding does not match and a login is refused, when a second session is refused while one is live, when a build is revoked, when a failed integrity check ends a running session, or when your client reports a definite integrity failure and your license is suspended pending review. A suspension is not a ban: a person reviews the case, and you can appeal from your dashboard or ask for a human review of any of these at legal@pluto.lgbt, quoting the reference you were shown, and we will provide one. You can complain to your supervisory authority at any time, without contacting us first. In Sweden that is the IMY (Integritetsskyddsmyndigheten). Erasing data that an active license depends on ends the license.

7. transfers outside the EEA

Our infrastructure is in the EEA. Recipients outside the EEA include Discord (United States) and payment and cryptocurrency processors operating in several countries. Where personal data reaches a country without an adequacy decision, we rely on standard contractual clauses or another lawful transfer mechanism, and we can describe the mechanism in use on request to privacy@pluto.lgbt, with security-sensitive detail redacted.

8. security and breach notification

We protect your data with encryption in transit, hashing of passwords and identifiers at rest, and access limited to what each task needs. These measures cannot eliminate all security risks.

If we discover a personal-data breach, we notify the competent supervisory authority within 72 hours of becoming aware of it unless it is unlikely to result in a risk to your rights and freedoms, and we notify affected people without undue delay where the risk is high. Suspected security issues can be reported to security@pluto.lgbt at any time.

9. children

pluto is not directed at children, and you must be at least 18 to hold an account or buy anything. If we learn an account is held by someone under 18, we close it and delete its personal data, except where retention is legally required. We do not knowingly collect data from children.

10. data stored on your device

The client keeps nothing on your computer between launches, and the launcher keeps one thing: the sign-in key from section 1, so a later sign-in can show it comes from the computer your account is linked to. The launcher you download carries its own sign-in inside its file (section 1), and each launch's session lives only in memory and is gone when the game closes. While starting, the client briefly writes one of its own files to your temporary folder and deletes it once it is loaded. Server-side copies expire or can be revoked as described above. This website uses one cookie, the log-in cookie described in section 1, one plain note in local storage that you were logged in, and, while you log in, a note in this tab (session storage) of the username you typed and that a code was sent, so a refresh does not lose your place. That note never holds your password and goes when you finish or close the tab. It uses no cross-site tracking.

11. captcha checks

Registration, login under attack, and password resets on this site are guarded by pluto captcha: a puzzle your browser solves, plus simple counts of how you used the page (such as how many times you moved the pointer, typed or clicked). Pointer positions and the keys you press never leave your browser, and the counts are used only to detect automated abuse: we do not build biometric templates and do not try to identify you from them. Logging in to the launcher under attack uses the same puzzle, solved by the launcher, and sends no counts. Challenges expire within minutes and are single-use, and the counts are checked when they arrive and never stored. Each challenge keeps your network address in hashed form until it expires, and we keep email addresses in hashed form with the times we sent them email, for 24 hours, to limit verification emails. The legal basis is performing the contract and our legitimate interest in preventing automated abuse, as described in section 2.

12. changes to this policy

We may change this policy. The current version is always on this page, with the date it was last updated at the top. Continued use after a change means you accept it. Where the law requires fresh consent for a new purpose, we ask for it before we start that processing.

13. how to reach us

Privacy requests, questions, and complaints go to privacy@pluto.lgbt. Support questions go to support@pluto.lgbt, billing questions to billing@pluto.lgbt, vulnerability reports to security@pluto.lgbt, and anything else to contact@pluto.lgbt. We monitor all monday to friday, 09:00 to 18:00 CET, and aim to reply within two business days. If you are unhappy with our answer, you can complain to your supervisory authority.