Privacy policy
1. Controller
The controller responsible for the processing of personal data on this website and in the Asto account is:
Wilko Eggen
Horumer Str. 41
26607 Aurich
Germany
Email: kontakt@astocraft.de
2. What data we process
- Account data: username, email address and password. Passwords are not stored in plain text.
- Minecraft name: only if you provide one, together with the matching Minecraft UUID.
- Sign-in with Discord or Microsoft: the identifier of your account with the provider, its display name and email address. From Microsoft we request only name and email address (scopes “openid, profile, email”), from Discord name and email address.
- Friends data: friendships, requests and blocks.
- Online status: what the launcher is currently showing (e.g. menu, server, world). You decide whether friends can see it.
- Device information: device name, launcher version and times of last use. The device’s sign-in token is stored only as a hash.
- IP addresses: only as a hash, for a short time, to prevent abuse (e.g. limiting sign-in attempts).
- Cosmetics: the style you chose for your colored name.
- Logs: entries in the administration log (without passwords and tokens) and dispatch logs of emails, without their content.
- Feedback reports: the type of report, the text, optionally your contact (email address or Discord name), the source (website, launcher or client) and the version, if given. They are used to find bugs and to classify requests.
3. Purposes and legal bases
- Providing the account, launcher sign-in, friends, status and cosmetics, and the related emails (confirmation, password reset, invitation): Article 6(1)(b) GDPR (Regulation (EU) 2016/679), use of the service.
- Security, prevention of abuse and operation of the website: Article 6(1)(f) GDPR (legitimate interest).
- Voluntary reports that you send yourself (feedback reports, error reports, sharing images, clips and profile codes): Article 6(1)(a) GDPR (consent). You can withdraw consent at any time with effect for the future.
4. Storage periods
- Account: until the account is deleted.
- Confirmation and invitation links are valid for 24 hours, links for resetting the password for one hour. Expired links are deleted automatically.
- Device sign-ins expire 60 days after last use.
- Shares (images and clips) are deleted automatically after 14 days, profile codes are valid for 30 days, error reports are deleted after 90 days.
- The online status is deleted after one day at the latest without a new update. IP hashes used to prevent abuse (sign-in attempts) are deleted automatically after a short time; entries in the administration log remain until they are deleted.
- Backups remain until you delete them (section 11). The display language in your account remains until the account is deleted (section 10). For browser storage, see section 7.
5. Recipients and processors
- Email dispatch: Resend (Resend, Inc., USA). The provider’s privacy terms apply.
- Hosting: Our servers are located in Germany.
- Sign-in with Discord or Microsoft: the respective provider learns that you are signing in to Asto. Its privacy terms apply.
- Minecraft name: if you provide one, our server asks Mojang for the matching UUID.
6. External services
This website loads no fonts, scripts or images from third-party servers. The launcher is downloaded via astocraft.de. Your browser stores the chosen language in its local storage (see sections 7 and 10).
7. Cookies and browser storage
This website sets no cookies. It only stores technical data in your browser’s local storage or session storage:
- Language choice (entry “asto_lang”): so that the site appears in your language on your next visit. Kept until you delete it.
- Sign-in token (entry “asto.web.token”, only if you are signed in): without “Stay signed in” it is kept only in the tab and ends with the tab. With “Stay signed in” it stays in the browser until you sign out; it is then removed.
- Notice flag (entry “asto_notice_v1”): remembers that you confirmed the note on browser storage with “Got it”. Kept until you delete this site’s data in your browser.
These entries are technically necessary or serve to remember your setting (Section 25(2) no. 2 of the German TDDDG, the telecommunications and digital services data protection act). They are not used for tracking or advertising. There are no tracking or advertising cookies and no third-party scripts.
8. The launcher
The launcher connects directly from your PC to Microsoft, Xbox and Mojang (sign-in, game launch, skins and capes) and to other services it needs: Modrinth (searching and downloading mods), mc-heads.net (head images) and, only if you turn it on, OptiFine, LabyMod and MinecraftCapes (capes). These services see your IP address in the process. The sign-in tokens for Minecraft and Xbox stay on your PC only and are encrypted with the Windows credential store; they are not sent to our server. The launcher shows your Discord status only if you turn it on, and only in your own Discord.
9. Language selection on your first visit
On your first visit, our server determines the suitable language (German or English) from the country of your IP address. The IP address is only evaluated in memory and is not stored in the database.
The country database “IP to Country Lite” comes from DB-IP (https://db-ip.com) and is licensed under CC BY 4.0. IP Geolocation by DB-IP.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in displaying the website in the suitable language). You can switch the language at any time in the footer.
10. Stored display language
The detected or chosen language is stored in your browser (local storage, entry “asto_lang”) so that it applies right away on later visits. This entry serves only to remember your setting (Section 25(2) no. 2 of the German TDDDG, the telecommunications and digital services data protection act). If you are signed in, your choice is also stored in your Asto account as “display language”; the website and the launcher then use it together. We also use it for emails to you (e.g. confirmation or password reset).
Legal basis for the storage in the account: Article 6(1)(b) GDPR (use of the service). The display language is stored until the account is deleted.
11. Backups (profile backups)
When you create a backup of your profile in the launcher (Settings, Backup), either manually or, depending on your setting, automatically after playing, the launcher uploads it to the Asto server as a zip file.
- Purpose: backing up and restoring your profiles, including on another PC.
- Content: only the parts of your game folder that you select: game data (e.g. game options, server list, hotbar), mod data (mods, configurations, data of map mods), graphics data (resource packs, shader packs, screenshots) and world data (worlds). These files may contain personal data, such as server addresses, player names in worlds or screenshots.
- Storage: on the Asto server (hosting as under section 5), assigned to your account and subject to a storage quota per account. You can reach your backups only after signing in to your account.
- Storage period: until you delete a backup. For automatic backups, only the most recent ones (adjustable by you) are kept; older ones are replaced. If your account is deleted, all backups are deleted as well.
- Deletion: at any time, yourself, in the account on the website (“My backups”) or in the launcher.
- Legal basis: Article 6(1)(b) GDPR (use of the service).
12. Recordings (Asto Replay)
The recording feature “Asto Replay” in the launcher and the client keeps the last seconds of your game in your PC’s memory. A file is created on your PC only when you save a clip. Clips are stored locally on your PC only; nothing is uploaded, and we do not receive any recordings. You can turn the feature off in the settings.
The game audio may contain the voices of other players (e.g. from a voice chat). Recording, and especially sharing or publishing, such clips may require the consent of your fellow players; secretly recording the privately spoken word may be a criminal offense under Section 201 of the German Criminal Code (StGB). Please ask your fellow players and follow the rules of the server in question.
13. Shares (images, clips, profile codes)
When you share an image or a clip in the launcher, the file is uploaded to our server and becomes reachable through a link (anyone with the link can see it). We store the file, the title, the time, the number of views and the link to your account. Shares are deleted automatically after 14 days; you can delete them yourself at any time. A profile code contains the profile name, the Minecraft version and the list of mods; it is valid for 30 days. Do not share content that others hold rights to or that shows other people without their consent (see also section 12). You can report violations with the “Report” link on the page or to kontakt@astocraft.de.
14. Error reports (voluntary, anonymous)
The launcher only sends an error report if you allow it in the settings or send a report yourself after a crash. The report contains versions (Asto, Minecraft, Java), the operating system and the cleaned-up error text; user names in paths, email addresses, tokens, IP addresses and identifiers are removed beforehand. It is not linked to any account, stored without an IP address, deleted after 90 days, and used only to find and fix bugs (legitimate interest in stable software, Art. 6(1)(f) GDPR, or your consent).
15. Your rights
You have the right of access, rectification, erasure and restriction of processing of your data, the right to object to processing and the right to data portability. You can withdraw any consent you have given at any time, with effect for the future.
You can download your data and delete your account yourself in your account on the website (“Download my data”, “Delete account”). For all other requests, please use the contact address in section 17.
16. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany, https://lfd.niedersachsen.de.
17. Contact for privacy requests
Last updated: October 18, 2026