Privacy notice
Updated October 31, 2026 · Dan Gang · Thailand
Who handles your data
Dan Gang, Thailand, operates Halo Client. Send privacy questions, access/correction/deletion requests or complaints through Halo support, or contact IlayHamood on Discord if you cannot use the ticket system. We may need proportionate proof that you own the account before acting on a request.
Halo account and support
Halo processes your email address, account ID, authentication state, access plan, tester status, accepted report points, discounts and account/support restrictions. Tickets include the operating system you select, subject, details, status and review outcome. Do not include game passwords, login tokens or unnecessary personal information in a ticket.
Device binding and security
The launcher creates a device key and derives a hash from machine identifiers for activation. The backend stores the public key, machine-identifier hash, account link and binding/rebinding audit data. Raw machine identifiers and the private key stay on your computer in the current implementation. IP addresses are processed to receive requests and limit abuse; shared quota storage uses keyed hashes rather than raw IPs. Hosting and authentication providers may also keep their own security logs. When extended ban controls are enabled, recorded email and device identifiers and IPs used in the last 30 days can also be blocked using keyed hashes. Shared networks can affect other accounts, so support appeals remain available. These identifiers can be changed or spoofed; the controls are not hardware attestation.
Local game data and offline passwords
Settings, keybinds, cached game data and saved offline server passwords are stored locally, separately from the mod JAR. Offline passwords are encrypted using a device-protected key and scoped to the Halo account and offline player name. The password vault is not uploaded to the Halo website by this feature. Updating the JAR does not intentionally reset it. A new computer needs a supported secure transfer/re-entry process; copying the encrypted file alone may not unlock it. Uninstalling or deleting Halo’s data or device key can lose that data.
Game and Microsoft sign-in
Microsoft/Minecraft authentication exchanges credentials or authorization tokens with the relevant Microsoft, Xbox and Minecraft services. Game profile and session information needed to launch Minecraft is processed by the launcher and stored using its credential storage. Game servers receive the connection and gameplay data necessary to play. Halo server passwords are not Microsoft or email passwords.
Why data is used
Data is used to provide account access, deliver downloads, bind/rebind devices, process support, manage tester access, prevent abuse and, once connected, manage subscription billing. Depending on applicable law, the basis is providing the requested service, legitimate security/administration needs, required legal records or consent where required. We do not sell personal information. No advertising or analytics integration is included in this website implementation.
Providers and billing
Supabase provides account authentication and backend data storage. Microsoft provides game authentication services. When checkout is enabled, Stripe handles payment details; Halo stores billing references, subscription/access status and information needed to manage access, rather than full card details. Google Fonts is used by the website stylesheet, which can send your IP address and browser request data to Google when a font is fetched. Discord receives information you choose to send there. Hosting, authentication, fonts and payment services may process data outside Thailand under their own terms and safeguards.
Cookies and storage
The website uses a session cookie for sign-in and a separate short-lived admin cookie for authorized administration. These are HttpOnly and same-site; production HTTPS uses Secure cookies. The current website does not set advertising or analytics cookies. The launcher separately stores local account/session data and the device key needed for activation.
Retention and your choices
Expiry, a ban or cancellation does not automatically erase your account, reports or saved local files, so access can be restored without resetting your data. Server records are retained while needed to provide the account, review support, protect the service and meet applicable legal/billing obligations; deletion and retention exceptions are handled on request. Local files remain until you remove them. You can request access, correction, deletion and other applicable rights, including objection/restriction or withdrawal of consent where relevant. Some security or legal records may need to be retained; we will explain an applicable exception rather than promise immediate deletion of everything.
Security and updates to this notice
Access restrictions, device proofs, encryption of the offline vault and abuse limits reduce risks but cannot make software or accounts impossible to compromise. Keep your account credentials private and report suspected unauthorized access. Material changes to data use will be reflected in this notice before they take effect, with further notice or consent when required. You retain the right to complain to the competent privacy authority under applicable law.