- Tokens encrypted at rest
- Microsoft session tokens are encrypted by the operating system and tied to your Windows account. They are never written to disk in the clear.
- Checksums verified
- Every downloaded file is checked against the SHA-1 hash published by the catalogue. A file whose hash does not match is rejected and not installed.
- No telemetry
- No usage statistics are transmitted, and no machine identifier is built. The launcher reaches only what it needs to do its work: the game's and the Microsoft account's servers, the two catalogues, the mod loaders' own, the skin sources, and GitHub, where its own updates come from.
- Confined writes
- Filenames coming from a remote catalogue are validated before writing, and no file can be written outside its own instance folder.
- Files never truncated
- Your settings and instance descriptors are written to a temporary file, pushed all the way to the disk, then renamed. A power cut at the wrong moment leaves the old file intact rather than a half-written one.
- No administrator rights
- Installation happens inside your user folder. Neither the installer nor the updates ask for elevation, and nothing is written elsewhere on the machine.