What Waxlight stores locally, which optional telemetry may be sent, and which third-party services the launcher contacts.

Canonical source: docs/PRIVACY.md (last updated: August 9, 2026).

1. Local data

Waxlight stores launcher settings, installed game versions, instances, mods, downloads, logs, playtime records, and other launcher state on the user’s device. The default data directory is the operating system configuration directory and can be relocated from Waxlight settings.

Persistent Vintage Story session credentials are stored through the operating system’s native credential store. Passwords and TOTP codes are not persisted by Waxlight. Authentication values temporarily required by Vintage Story may be injected into an instance configuration while the game is running and are cleaned up by the launcher afterwards.

2. Optional telemetry

Telemetry is optional and disabled by default for fresh installations. On Windows, the interactive installer displays this policy with a separate, unchecked opt-in box. The setting can be changed later in Settings → Privacy & telemetry.

When telemetry is enabled, Waxlight may send the following fields to the Waxlight telemetry service:

• a randomly generated installation identifier;
• Waxlight version;
• operating system and CPU architecture;
• number of configured instances;
• number of installed mods;
• predefined launcher lifecycle event names;
• predefined error codes, component names, and operation names.

The production telemetry endpoint is: https://waxlight.telemetry.amadomuerte.ru

The installation identifier is generated by Waxlight and is not derived from a hardware identifier, operating-system username, Vintage Story account, or local file path. As with any HTTPS connection, servers and network infrastructure may process ordinary connection metadata such as an IP address to deliver the request; the IP address is not a field in the telemetry JSON payload.

3. Information not included in telemetry

Telemetry payloads are designed not to include:

• passwords or TOTP codes;
• Vintage Story session keys, signatures, tokens, or other authentication secrets;
• email addresses, account names, or player names;
• instance names or mod names;
• local file or directory paths;
• personal files or game configuration contents;
• raw logs, raw error messages, stack traces, or server response bodies.

Telemetry events and error reports use predefined allowlists rather than arbitrary user-controlled text.

4. Purpose of telemetry

Telemetry is used for launcher operation and development, including broad usage measurement and reliability analysis. The source tree does not define the telemetry service’s retention or downstream processing practices; this policy makes no fixed retention, deletion, encryption, or third-party-processing promise.

5. Disabling telemetry

Telemetry can be disabled at any time in Settings → Privacy & telemetry. When disabled, Waxlight does not send telemetry heartbeats, lifecycle events, or structured telemetry error reports. A locally generated installation identifier or previous telemetry timestamps may remain in the local database — keeping those local values does not itself transmit data.

6. Third-party services

Waxlight contacts the following services. Information sent directly to them is governed by their own privacy policies and is separate from Waxlight’s optional telemetry:

• Vintage Story / Anego Studios — authentication, account validation, game-version discovery/downloads, and ModDB functionality. Vintage Story Privacy Policy.
• GitHub — release information, downloads, and update discovery. Automatic update checking is enabled by default and checks GitHub when the launcher starts; it can be disabled in Settings → Updates. GitHub Privacy Statement.

7. Security and transparency

Waxlight is open source. The telemetry payload models, allowlists, identity generation, settings checks, and HTTP client are available for public review in the repository. Telemetry delivery is best-effort and is not required for launcher functionality.

Security vulnerabilities or suspected exposure of sensitive information should be reported using the private process described in the security policy. Do not post credentials, tokens, installation identifiers, or other sensitive information in a public issue.

8. Privacy requests and contact

For privacy questions or requests, contact the repository owner through the GitHub profile and request a private communication channel. Because telemetry uses a pseudonymous installation identifier rather than a Waxlight user account, the project may be unable to associate a stored telemetry record with a particular person unless the relevant installation identifier is provided.

9. Changes to this policy

This policy may be updated when Waxlight’s data practices, telemetry implementation, infrastructure, or legal obligations change. Material changes will be published in the repository.