Leaflet Launcher

Privacy notes

Last updated: October 2026 · Applies to Leaflet Launcher 1.1.0

The short version. Leaflet is local-first. It does not operate an account server, collect telemetry, or upload your Microsoft password. Microsoft account refresh tokens are protected with Windows DPAPI, and launch logs mask access tokens.

What is stored on your PC

Leaflet keeps its launcher data in a local folder, by default:

%APPDATA%\LeafletLauncher — settings, logs, cached files, downloaded Java runtimes, and Microsoft account records.
%APPDATA%\LeafletLauncher\settings.json — launcher preferences, offline profiles, and the selected account.
%APPDATA%\LeafletLauncher\microsoft-accounts.dat — Microsoft session records, protected with Windows DPAPI for the current Windows user.
%APPDATA%\LeafletLauncher\logs — local launcher and game launch logs.
%APPDATA%\.minecraft — the default game directory, containing game files, worlds, and resources. A different game directory can be selected in Settings.

Leaflet does not sync these folders to a Leaflet-operated service. If you move the launcher to another Windows user or PC, accounts and settings are not transferred automatically.

Microsoft account sign-in

Microsoft account sign-in uses the OAuth 2.0 device authorization flow. Leaflet opens Microsoft's sign-in page in your browser and displays a one-time code. The authorization happens on Microsoft's site; Leaflet never asks for, receives, or stores your Microsoft password.

After you approve the sign-in, Leaflet receives a Microsoft token and exchanges it through Xbox Live and Minecraft Services to obtain a Minecraft profile and session. The launcher stores:

your Minecraft profile name and UUID;
your Xbox user ID, when provided by Xbox Live;
a Microsoft refresh token and a short-lived Minecraft access token.

These records are stored in microsoft-accounts.dat, which is encrypted with Windows DPAPI under the current Windows user. The file is not stored in settings.json in clear text. The Minecraft access token is passed to the game process as a launch argument; the launcher's own command-line log replaces it with <redacted>.

Leaflet does not operate an account server and does not upload your Microsoft or Minecraft tokens to Leaflet. Token exchange requests go directly to Microsoft, Xbox Live, and Minecraft Services.

Network requests

Leaflet makes network requests only for launcher functionality:

Microsoft identity: login.microsoftonline.com for device-code authorization and token refresh.
Xbox Live: user.auth.xboxlive.com and xsts.auth.xboxlive.com.
Minecraft Services: api.minecraftservices.com for sign-in and the player profile.
Game files and metadata: Mojang's version manifest and resources, or the optional BMCLAPI mirror.
Java: Adoptium / Eclipse Temurin when automatic Java download is enabled.

A proxy can be configured in Settings for launcher downloads and requests. Leaflet does not include analytics, advertising SDKs, tracking pixels, or telemetry endpoints.

Logs

Leaflet writes local logs to help diagnose launcher and game issues. A log may include the selected player name, Minecraft UUID, version, Java path, game directory, error output, and the launch command line with access tokens removed. Logs remain on your PC and are not uploaded by Leaflet. You can delete them from the data folder at any time.

Your choices

Remove an offline or Microsoft account from the Accounts panel.
Delete %APPDATA%\LeafletLauncher to remove launcher settings, logs, cached files, and saved sessions. This does not delete your Minecraft worlds or game installation.
Delete or move the game directory separately if you want to remove downloaded game files or worlds.
Disable automatic Java downloads in Settings if you prefer to manage Java yourself.
Clear local logs from the launcher data folder whenever you wish.

Removing a Microsoft account from Leaflet does not delete your Microsoft account or change your Minecraft profile. It only removes the local session from this launcher.

Contact

For privacy or review correspondence, use the contact details supplied with the Microsoft API review request. Leaflet Launcher is a personal, non-commercial project and does not operate a public account service.

Changes to these notes

These notes may be updated when launcher behaviour changes. The date at the top of this page indicates the latest revision.

← Back to Leaflet Launcher