Privacy Policy

Last updated: 25 October 2026

This page explains what personal data Vexium Client ("Vexium", "we", "us") collects, why, where it is stored and what rights you have. Contact for privacy questions: haraiky@proton.me.

What we collect

• Account details: your email address and username. Your password is stored only in scrambled (hashed) form, so nobody, including us, can read it.
• Your access: which keys you redeemed, when, and how long your access lasts.
• Technical data: IP address, browser type and sign-in times, recorded in server logs by our hosting and account providers for security. When you are signed in, our server also saves a one-way scrambled code (hash) made from your IP address and links it to your account. The website doesn't store the IP address itself, and it can't be read back from the code. The Vexium launcher's sign-in server does keep the last 10 IP addresses your account signed in from, to enforce bans.
• PC identifier (HWID): to link your account to one PC, the launcher reads four hardware values: the motherboard UUID, the motherboard serial number, the serial number of your boot disk and the CPU ID. These values never leave your PC: the launcher turns them into a one-way scrambled code (hash) and only sends that code. We use it to keep your account on one PC and to enforce PC bans.
• Minecraft account: the name and ID of the Minecraft accounts you play with in Vexium, so bans and your profile match the right player.
• Anti-tamper check: while the Vexium client runs, it checks on your PC whether known cracking tools (such as Recaf, JD-GUI, Bytecode Viewer or JByteMod) are running and whether a debugger is attached to the game. The list of your programs is never sent to us. Only when such a tool is found, the client sends us the tool's name and your account, and we keep a record of that warning with its date.

Microsoft sign-in

You sign in to Minecraft on Microsoft's own page, so Vexium never sees your Microsoft password. After you sign in, the launcher saves a Microsoft sign-in token on your PC (in C:\Vexium\config\vexium\accounts.json) so you don't have to sign in every time. This token is never sent to us. It is not encrypted yet, so keep that file private, like a password: anyone who copies it could use your Minecraft account. Removing the account in the launcher deletes its token from the file.

We never see your payment details. Payments happen on FunPay, under FunPay's own privacy policy.

Why we use it

• To create your account, sign you in, apply your keys and let you download the launcher (needed to provide the service you asked for).
• To send emails you ask for, such as email confirmation and password reset codes.
• To protect accounts and stop abuse, like key or account sharing, and to enforce bans: an account that breaks the rules is banned together with the IP addresses and PC it used, and other accounts used from a banned IP or PC are banned too (our legitimate interest in keeping Vexium secure).
• To protect Vexium from being cracked: the anti-tamper check above (our legitimate interest in protecting our software).

We don't sell your data, don't use it for advertising and don't use tracking or advertising cookies.

Automatic bans

Some bans happen automatically, without a person checking first: an account is banned forever after 5 anti-tamper warnings (see the Terms), and an account that signs in from a banned IP address or PC is banned too. If you think an automatic ban is wrong, you can ask for a person to review it (see "Bans and appeals" in the Terms).

Your consent

When you create an account, you give your consent to the processing of your email address and username for the purposes above. You can withdraw it at any time by deleting your account.

Where your data is stored and who processes it

• Supabase stores accounts and access data on servers in the European Union (Ireland).
• Cloudflare hosts this website and may record technical data (like IP addresses) in its logs.
• Google (Gmail) delivers our account emails.
• Cloudflare runs the launcher's sign-in server.

These providers only process data to run their service for us. The website's font and code are hosted on our own site, so your browser does not contact other third parties when you visit.

Storage in your browser

To keep you signed in, this website saves a sign-in token in your browser's local storage. It is needed for the site to work and is removed when you sign out. It also remembers your language choice.

How long we keep it

• Account data, your PC identifier and Minecraft account names: until you delete your account.
• IP hashes on the website: deleted after 90 days.
• IP addresses on the launcher's sign-in server: the last 10 per account, kept until you delete your account.
• Anti-tamper warnings: kept with the account, so the warning count stays correct.
• Bans: IP bans end after 30 days. PC bans and permanent bans for cracking Vexium (see the Terms) stay, so the ban can be enforced.
• Server logs: kept by our providers for a limited time for security.

Your rights

• See what data we have about you (your Profile shows it), and ask us for a copy.
• Correct your data, or delete your account and all data linked to it at any time: open your Profile and use Delete account.
• Withdraw your consent, object to processing, or complain to the data protection authority where you live.

To use these rights, email haraiky@proton.me or ask on Discord. When you delete your account, keys you redeemed stay marked as used so they can't be redeemed again, but they are no longer linked to you.

Children

If you are under 16, ask a parent or guardian before creating an account.

Changes

If this policy changes, we'll update this page and the date at the top.