1. Who is responsible
The data controller is the Lumennox team, which runs LumeClient and lumennox.net, based in Denmark. Contact us about anything in this policy at legal@lumennox.net.
Your Lumennox account, the lumennox.net store and the Lumennox server are also covered by the Lumennox Privacy Policy. This policy covers what's specific to LumeClient.
2. What we use and why
The client and launcher work without an account. Most of what's below only happens once you sign in with a Lumennox account, or when you choose to use a feature.
| Data | What for | Legal basis (GDPR) |
|---|---|---|
| Lumennox account: username, email, password (stored hashed by lumennox.net) | Signing in to LumeClient | Contract, art. 6(1)(b) |
| Sign-in tokens for the launcher, client and website | Keeping you signed in. Our servers store only a scrambled (hashed) copy. | Contract |
| Linked Minecraft account: username and UUID | Showing your cosmetics and badge to other players | Contract |
| Cosmetics you own, wear and save as outfits; purchases and wallet | Your wardrobe; delivering what you bought (payments are handled by the lumennox.net store) | Contract; bookkeeping law, art. 6(1)(c) |
| Synced settings: modules and HUD layout | The same setup on every PC | Contract |
| Friends, friend requests, messages, invites and typing status | Friends and chat in the game and launcher | Contract |
| Online status: online or offline, playing or in the launcher, and the server you're on (only if you choose to share it) | Showing friends that you're online; you can appear offline | Contract |
| The name you play under, as an offline-mode UUID | Showing your cosmetics on offline-mode servers and Go Public worlds | Contract |
| UUIDs of players near you in game | Looking up which cosmetics they wear, so you can see them | Legitimate interest, art. 6(1)(f): showing cosmetics is the feature |
| Screenshots you share | Hosting the image behind the share link (anyone with the link can see it) | Contract |
| Crash reports, only when you press Send: crash log, game and launcher version, Windows version, Minecraft name, your note | Finding and fixing crashes | Legitimate interest: fixing the software you use |
| Community capes: the image, name, description, likes, reports and creator earnings | Running the community store, moderation and paying creators | Contract; legal obligations |
| Go Public: the IP addresses of you and the players who join your world | Relaying the connection, only while your world is public | Contract |
| Technical data: IP address, time, requests | Security, preventing abuse, rate limits | Legitimate interest: keeping the service safe |
We don't sell data, show ads, profile you for marketing or use automated decision-making with legal effect.
3. Stored on your device
lumeclient.net
The website uses no cookies and no analytics or tracking. It keeps a few things in your browser's local storage, all needed for what you ask the site to do:
lume.auth: your sign-in, if you sign in;lume-theme: the theme you picked;- your unsent cape drawing from the cape editor;
- short-lived copies of release and server-status information, so pages load faster;
lume-intro(session only): whether you've seen the opening animation.
Signing out removes your sign-in; clearing your browser data removes the rest. Fonts and media are served from lumeclient.net itself.
The launcher and client
The launcher stores your accounts, settings and game files on your PC. Microsoft and Lumennox sign-in tokens are encrypted with Windows' own data protection. Uninstalling the launcher removes them.
4. Other services you connect to
Some features load data directly from other services, which then see your IP address and the request. They process it under their own privacy policies:
- Microsoft and Mojang: Minecraft sign-in, game downloads and skins (launcher and client).
- GitHub: release information and launcher updates.
- mc-heads.net: Minecraft avatars and skins on this website (sends the Minecraft name shown).
- mcsrvstat.us: the live status of the Lumennox server on this website.
- Discord: if you turn on Discord Status, the client tells the Discord app on your PC what you're playing; Discord handles it from there.
- Minecraft servers you join see what any Minecraft client sends them.
6. Data outside the EU
Some of the services above (Stripe, Microsoft, GitHub, Discord) are based in the United States. Transfers to them rely on the EU–US Data Privacy Framework where the company is certified, or on the European Commission's standard contractual clauses.
7. How long we keep it
- Account data, cosmetics, outfits, settings, friends and messages: while your account exists; deleted when you delete it.
- Online status and the name you play under: replaced as you play; counts as expired after a few minutes.
- Crash reports: deleted automatically after 90 days.
- Shared screenshots: until you ask us to delete them, or your account is deleted.
- Community capes: while they're published or waiting for review; turned-down capes until you delete them.
- Purchases, wallet and creator earnings records: 5 years after the end of the financial year, as Danish bookkeeping law requires.
- Sign-in tokens: until they expire or you sign out.
8. Your rights
Under the GDPR you can ask to see the data we have about you and get a copy, correct it, delete it, limit how we use it, or take it elsewhere. You can object to use based on legitimate interest, and withdraw any consent at any time. Write to legal@lumennox.net, from the email address on your Lumennox account so we can confirm it's you. We answer within one month.
You can also complain to the Danish Data Protection Agency, Datatilsynet (Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk), or the authority in the EU country where you live.
9. Children
Lumennox accounts and LumeClient's online features are for people aged 13 and over; under 16 you need a parent's or guardian's permission. If you believe a child under 13 has given us data, contact us and we'll delete it.
10. Security
Everything travels over encrypted connections (HTTPS). Passwords and sign-in tokens are stored only in hashed form on our servers, and sign-in tokens on your PC are encrypted. If a breach puts your data at risk, we'll tell you and the authorities as the law requires.
11. Changes
If we change how we use data, we'll update this page and the date above, and announce important changes on this site or in the launcher.