XUKIUMThis Privacy Policy explains what personal data Xukium processes when you use the Windows desktop application and the xukium.com website, what we use it for and what rights you have. It is written to reflect how the Service actually works; if something changes, we will update it.
1. Data controller
The controller is Xukium, established in Honduras.
Contact for privacy and data requests: support form (topic “Privacy”) or privacy@xukium.com.
2. What data we process
Account and authentication data. We use Firebase Authentication (Google) for registration and sign-in. We process your email address, a user identifier, your username, the sign-in method (email/password or Google) and whether you have verified your email. Your password is handled by Firebase Authentication: Xukium does not store it in plain text or have access to it.
Profile, plan and license. In Cloud Firestore we store your profile (username, email, language, creation date), your plan (Free or Plus) and the status of your subscription and license. Our license API (hosted on Cloudflare Workers) validates your access to paid features; for that, a temporary identity token generated by Firebase is sent to it.
Payment and transaction data. Plus payments are processed by Paddle. Xukium does not receive or keep your full card number. We receive from Paddle information such as the customer identifier, status, plan, subscription dates and transaction data needed to activate and manage your plan. Paddle also processes your payment and billing data under its own privacy policy.
Support messages. If you write to us through the form (or send a data request from your account page), the name, email, topic, message, language and, for requests sent from your account, your user identifier are delivered to our support mailbox through Web3Forms, which processes them only to forward the message. We do not store these messages in our database.
Technical and security data. Infrastructure providers (Firebase Hosting, Cloudflare, GitHub when downloading releases) may process your IP address and technical browser or system data to deliver the service, protect it and detect misuse.
Analytics and advertising. We currently do not use advertising cookies or third-party analytics tools on the Site. If we enable analytics on the Site or in the Application in the future, we will update this policy and, where the law requires, ask for your consent.
Your servers and files. The files of your Minecraft servers, worlds and backups are stored on your computer. Xukium does not collect them or send them to its servers.
Integrations you turn on. If you use Modrinth (for mods and plugins) or playit.gg (tunnels), the Application communicates with those services and they may receive your IP address and the technical data needed to operate, under their own policies.
We do not process special categories of data and we do not profile users for advertising.
3. What we use your data for and on what legal basis
| Purpose | Legal basis |
|---|---|
| Create and maintain your account, authenticate you and give you access to the Application | Performance of a contract |
| Manage your plan, subscription and license, and enable Plus features | Performance of a contract |
| Process payments, invoicing and taxes (through Paddle) | Performance of a contract and legal obligation |
| Handle your support, privacy or billing inquiries | Performance of a contract / legitimate interest |
| Protect the Service, prevent fraud, license tampering and abuse | Legitimate interest |
| Send you essential service notices (verification, security, material changes) | Performance of a contract / legitimate interest |
| Usage analytics, if enabled | Consent (where the law requires it) |
4. Who we share your data with
We do not sell your personal data. We share it only with providers that need it to deliver the Service:
- Google (Firebase Authentication, Cloud Firestore, Firebase Hosting): authentication, database and Site hosting.
- Web3Forms: delivery of support-form messages to our mailbox.
- Cloudflare (Workers): license API and access checks.
- Paddle: payment processing and management of subscription transactions.
- GitHub: distribution of Application releases and updates.
- Modrinth and playit.gg: only when you use those integrations.
We may also disclose data to authorities when required by law or a valid order.
5. International transfers
Some providers may process data outside your country or the European Economic Area, for example in the United States. Where necessary, we rely on the safeguards provided by applicable law, such as standard contractual clauses or recognized adequacy frameworks.
6. How long we keep your data
We keep your data while you have an account or while we need it to provide the Service. When you ask for your account to be deleted, we delete or anonymize your personal data, except what we must keep for legal obligations (for example, billing and tax records kept by Paddle) or to defend claims, for the legally required time. Support messages are kept for as long as needed to handle your inquiry and follow up.
7. Security
We apply reasonable technical and organizational measures: encrypted connections (HTTPS), database security rules that prevent one user from reading or changing another's data, server-side validation of plans and payments using the payment provider's events, no secret keys in the website or the Application, and security headers on the Site. No system is completely infallible: if we detect a breach affecting your data, we will act and inform you as required by law.
If you find a vulnerability, report it through support so we can fix it; see also the security.txt file.
8. Your rights
Depending on the law that applies to you (for example, the GDPR in the European Economic Area, or equivalent laws elsewhere), you may:
- access your data and obtain a copy;
- correct inaccurate data;
- request deletion of your data;
- restrict or object to certain processing;
- request portability of your data;
- withdraw your consent where processing is based on it;
- lodge a complaint with your data protection authority.
To exercise them, write to us through the support form (topic “Privacy”) or at privacy@xukium.com, or use the “Request account deletion” button in My account. We may ask you to verify your identity. We will respond within the legal deadlines.
9. Minors
The Service is not directed at children under 13 and we do not knowingly collect their data. If you are below the age required by your country's law to give digital consent, you must have the permission of your parents or guardians. If you believe a minor has given us data without permission, write to us and we will delete it.
10. Cookies and local storage
We only use essential storage (sign-in session and language preference). More details in Cookies and storage.
11. Changes to this policy
We may update this policy. We will publish the current version with its date and, if the change is material, tell you before it takes effect.
12. Contact
For any privacy matter, use the support page or write to privacy@xukium.com.