Privacy policy

Short version: this website collects nothing, and the Moss software keeps your data on your own machine.

This website

• No accounts, no cookies, no analytics, no advertising and no trackers.
• The only thing stored in your browser is your light or dark theme choice, in local storage, and it never leaves your device.
• The site is static and hosted on GitHub Pages. GitHub may keep standard server logs; see GitHub's privacy statement.

The Moss software

Moss runs on a machine you control. Server files, worlds, console logs and backups stay there.

• Sign-in. Moss uses a Supabase project that you create. Moss stores each user's account ID, email address and role in its local database, and verifies sign-in tokens locally. Passwords are handled by Supabase and are never seen by Moss.
• Activity log. Moss records who did what (starting a server, editing a file) so the owner can review it. It stays in your instance.
• Downloads. When you ask for a server jar, Java runtime or plugin, Moss contacts Mojang, PaperMC, Purpur, Fabric, Modrinth or Adoptium. Moss sends no telemetry to its authors.
• OAuth sign-in. If you enable GitHub or Google sign-in, Moss only requests basic profile and email scopes to identify the account. It never requests access to repositories, mail, files or contacts.

Your choices

Remove a user in Moss to revoke their access, and delete their Supabase account to remove the sign-in itself. Delete the Moss data directory to remove everything Moss stored.

Contact

Questions or concerns: open an issue on GitHub. Security reports go through private vulnerability reporting.

Last updated October 2026.