Privacy Policy

---

Privacy Policy

Last updated: 29 October 2026

This Privacy Policy explains which personal data is processed when you visit kuroosu.online or play on the Kuroosu osu! private server, why this happens, and which rights you have under the EU General Data Protection Regulation (GDPR) and German data protection law.

---

1. Controller

The controller responsible for data processing is:

Luke Thomas
Raymanshof 39a
46539 Dinslaken
Germany

Email: [email protected]

We are not required to appoint a data protection officer. For any privacy question, contact us at the email address above.

---

2. Overview

Kuroosu is a free, non-commercial osu! private server run by private individuals. We only process the data needed to provide the website and the game server, to keep them secure, and to ensure fair play. We do not sell your data, do not use advertising or tracking cookies, and do not use analytics services.

---

3. Hosting

The website and the game server run on our own server located in Germany. All account and game data is stored on this server. No external hosting provider has access to the stored data.

---

4. Cloudflare (network, security, bot protection)

All connections to kuroosu.online and its subdomains are routed through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; EU representative: Cloudflare Germany GmbH). Cloudflare acts as a reverse proxy and content delivery network: it protects the server against attacks (e.g. DDoS), hides the server's real address and caches static files such as images.

For this, Cloudflare processes technical connection data, in particular your IP address, the requested URL, browser type/user agent, and time of the request. Cloudflare may set technically necessary cookies to detect malicious traffic.

Cloudflare Turnstile: On the login, registration and password recovery pages we use Cloudflare Turnstile to distinguish humans from bots. Turnstile analyses technical information about your browser and device (e.g. IP address, browser characteristics, interactions) without showing a puzzle in most cases.

Cloudflare also hides email addresses on our pages from spam bots ("email obfuscation"); a small script from Cloudflare decodes them in your browser.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in a secure, available and abuse-free service.
Cloudflare is certified under the EU-U.S. Data Privacy Framework; data transfers to the USA are therefore based on the adequacy decision of the European Commission (Art. 45 GDPR). Additionally, Cloudflare's Data Processing Addendum including Standard Contractual Clauses applies.
More information: cloudflare.com/privacypolicy

---

5. Visiting the website – server logs

When you access our website, our server automatically records:

• IP address
• date and time of the request
• requested page and HTTP method
• HTTP status code
• browser type and version (user agent)

This data is used exclusively to operate the website, to find errors and to detect and defend against attacks.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website).
Retention: log files are automatically deleted after at most 7 days.

---

6. Cookies and local storage

We only use technically necessary cookies:

The effects setting (Auto, Full or Fast in the settings menu) and the result of a short frame rate check that switches slow devices to the fast mode are kept in your browser only (localStorage: op-fx, op-fx-slow, op-fx-hits); they are never sent to us.

No cookies are used for advertising, tracking or analytics. Because these cookies are strictly necessary to provide the service you request, no consent is required (§ 25(2) no. 2 TDDDG). Legal basis for the related processing: Art. 6(1)(b) and (f) GDPR.

---

7. User account

When you register (on the website or in the osu! client), we store:

• username
• email address
• password (stored only as a salted bcrypt hash – we cannot read your password)
• country (determined from your IP address at registration, can be changed)
• registration date and last activity
• your former usernames when you change your name (shown publicly on your profile as "formerly" and found by the player search, so other players still recognise you; deleted with your account)

Login sessions: for every website login we store a session with your IP address, the approximate location derived from it (city and country) and the browser used, so you can review and end your active sessions in the settings. Sessions end on logout or when they expire (1 or 7 days).

Location lookup (ip-api.com): to determine your country at registration and the approximate location of a login session, your IP address is sent to the geolocation service ip-api.com. Only the IP address is transmitted; the service returns country and city. For in-game logins, the country is normally taken from the location information supplied by Cloudflare; ip-api.com is only used as a fallback.

Optional data you can add: avatar, profile banner, profile page ("userpage"), profile customisations (e.g. layout, pinned scores, supporter colours and background), clan membership, comments and friends list. We also store the notifications shown to you, badges and medals you earned, your rank history and, if you signed up with an invite link, who invited you.

The email address is used for account recovery and, if necessary, to contact you about your account. We do not send newsletters.

Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for).
Retention: until you delete your account (see section 13).

---

8. Playing on the server

When you connect with the osu! client (-devserver kuroosu.online), we process:

• Login data: IP address, osu! client version and release stream, time of login
• Client identifiers: hashed (MD5) values that the osu! client sends automatically – hash of the osu! installation path, hash of network adapter information, an uninstall ID and a disk signature. We never receive the raw hardware data, only these hashes.
• Gameplay data: scores, accuracy, performance points (pp), mods used, play time, replays (.osr), screenshots you upload with the in-game screenshot function, beatmap ratings and favourites
• Chat and messages: public chat messages in channels and private messages to other players and to the bot. Chat messages are logged. Private messages you write in-game and in the website chat (/chat, only with friends; group chats were removed on 18 October 2026) are stored together and are not end-to-end encrypted: the owner and staff can read them to protect players (e.g. against harassment, scams or cheating deals). Pictures and voice messages you send in the website chat are stored on our server as files (photos without their location/EXIF data) and can be viewed or listened to by staff in the same way. Voice messages and voice calls were removed on 18 October 2026; voice messages sent before stay until the 60-day clean-up. Please don't share passwords or other sensitive data in chats. Clean-up: private messages and group chat messages (with their pictures and voice messages) are deleted automatically 60 days after they were sent; only messages written by players who are supporters at that time are kept. When you edit or delete a message, the earlier text stays stored for our staff (moderation) until the message itself is cleaned up. The chat also stores what you set there: muted chats, pinned messages, votes in polls, stickers uploaded before 18 October 2026 (stickers were removed; ask us to delete them), the colour and background you chose, and "beat my score" challenges you sent. If a friend follows you, they may get a notification when you set a new top play.
• Suggestions and bug reports: what you send on /feedback (type, area, title, text, an optional screenshot and your browser's user agent so we can reproduce bugs) and the team's answer. Only you and our staff can see it. It is stored until staff deletes it or you delete your account; screenshots are stored as files on our server (without location/EXIF data).
• Profile views and rivals (removed): profile views were removed on 18 October 2026 and rivals on the same day; we no longer count visits. Visits and rivals saved before that are no longer shown or used and are deleted with your account.
• Kuroosu lazer client: while you are logged in, the client checks itself every 30 seconds and sends our server about every 2 minutes your player id and name, the client version, the file names of the DLLs loaded inside the client that are not part of Windows or of the game, and what matched a known cheat (a cheat program running next to it, a cheat DLL inside it, an attached debugger). We store it the same way as for the patcher (session deleted after 60 days, your IP address only compared with your last in-game login, matches visible to staff, DLL names without any player). The full list of your programs and folder paths are never sent. While the client found a cheat, it does not send scores until you restart it.
• Menu music and share pictures: the menu music songs come from our own server (assets.kuroosu.online), your settings for it (on/off, volume, song) stay in your browser (localStorage). Share pictures of profiles and scores are made on our server; for the map picture our server loads the beatmap cover from assets.ppy.sh, your browser does not.
• Reports, warnings and ban appeals: reports you send on /report (who, why, your text, an optional link and score) and the staff's answer; only you and our staff see them and the reported player never sees who reported them. Warnings staff gives you and ban appeals you sent on the website until 18 October 2026 (text, optional link, the staff's answer); appeals now go through a Discord ticket. Staff also keeps internal notes and a moderation history per player (together with the restrictions from the game server) to apply our rules fairly. Your own reports and appeals are deleted with your account; warnings, notes and reports about you are kept as moderation records, like restrictions.
• Former login with Google: logging in with Google was switched off on 18 October 2026. If you connected a Google account before, we still have the ID of that Google account and its email address; it is deleted with your account, or earlier if you ask us.
• Store (closed on 18 October 2026): for orders made in the former store we saved what was ordered, the price, your order code and when it was paid. Paid orders are kept as payment records (see Ko-fi below), open orders are deleted with your account.
• Two-factor login: if you turn it on, we store the secret key for your authenticator app and the time of the last used code (so a code can't be used twice). It is deleted when you turn it off or delete your account. Failed logins are counted for 15 minutes per account and IP address to stop password guessing.
• Online status: current activity (e.g. which beatmap you are playing), shown to other players.
• Overlay usage: when you click the overlay download button, and while the overlay checks for updates, we count one visit per day. We store only a hash that is made from your IP address and the date, so you can be counted once a day but not followed from day to day. The IP address itself is not stored.
• Replay views: when a replay is watched in-game or downloaded on the website, we count one view per score. To count each viewer only once per hour, the viewer's player ID or IP address is kept for 1 hour and then deleted automatically; only the view count is stored.

Scores, pp, rankings, profile statistics and replays are public and visible to everyone on the website and in-game.

Purposes and legal bases:

• providing the game service, leaderboards and statistics – Art. 6(1)(b) GDPR
• security, preventing multi-accounting, ban evasion and cheating (client identifiers, IP addresses, chat logs) – Art. 6(1)(f) GDPR, our legitimate interest in a fair and safe community

Retention: while your account exists. Login records and client identifiers are deleted together with your account.

Beatmap packs: if you make a pack in the Kuroosu Launcher, it sends the list of the chosen maps (beatmap set numbers and folder names, no other files or data from your PC) to our website, where it is kept for one day until you finish the pack. A finished pack stores its name, description, maps and your account. Public packs show on the packs page with your name; unlisted ones can be opened by anyone who has the link or code. You can delete a pack at any time, and your packs are deleted with your account. Backups made in the launcher stay on your PC, nothing is sent to us.

Your own beatmaps: if you upload a beatmap (.osz), we store the file (difficulties, song, pictures; videos are removed), the note you write for staff, staff's decision and note, and that you uploaded it. The map, its cover and your name as uploader are public; anyone can download and play it. Legal basis: Art. 6(1)(b) GDPR. Retention: until the map is deleted by staff or you delete your account (then the map, its scores and files are deleted).

---

9. Anti-cheat and automated decisions

To keep leaderboards fair, submitted scores are checked automatically:

• integrity checks (checksums of the score data, osu! client and beatmap),
• flags that the osu! client itself reports (e.g. detected flashlight or spinner manipulation),
• performance point limits per game mode.

If a check fails, the score may be rejected and the account automatically restricted. You can contest this at any time by contacting us; a staff member will then review the case personally (for example by asking for a live recording of your gameplay). Trusted players can be exempted from the pp limits after such a review.

Legal basis: Art. 6(1)(f) GDPR (fair competition for all players). Where the restriction qualifies as an automated decision, it is necessary for the performance of the contract (Art. 22(2)(a) GDPR); you have the right to obtain human intervention, to express your point of view and to contest the decision (Art. 22(3) GDPR).

---

10. Moderation and audit logs

Actions of staff members (e.g. restrictions, privilege changes, name changes) and reports are recorded in an internal audit log to ensure accountability.

Legal basis: Art. 6(1)(f) GDPR. Retention: while the affected account exists.

---

11. External content loaded in your browser

Some content on our pages is loaded directly from third parties. Your browser then connects to these providers and transmits your IP address and browser information:

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functional website and beatmap downloads). For beatmap downloads, the processing is necessary to provide the function you requested (Art. 6(1)(b) GDPR).

Links to external sites (e.g. our Discord server, osu! website) are ordinary links; no data is transmitted to these services until you click them. Discord's own privacy policy applies there.

---

11a. Supporter payments (bank transfer, Stripe, PayPal; Ko-fi until 30 October 2026)

Ko-fi (until 30 October 2026): until then you could support Kuroosu through Ko-fi (Ko-fi Labs Limited, United Kingdom). We no longer offer it; the following describes payments made there before. Our website only linked to our Ko-fi page; no data is transmitted until you click the link. Payments are processed entirely by Ko-fi and its payment providers (e.g. PayPal or Stripe) under their own privacy policies – we never receive your payment details.

For Supporter you wrote your username (or the name of the player you gifted it to) into the Ko-fi message so we can match the payment to the account. From Ko-fi we receive the information needed to thank you and to grant the supporter badge or your order: the name you enter, the amount, the date and an optional message, and your email address if you provide it. We use this data only to grant and manage supporter status and to answer questions about your donation. We also count your purchases (every purchase is one heart next to your name, up to three; a gift counts for the payer if the Ko-fi name matches a player) and note whether it was Supporter or Supporter Plus. The latest purchases are shown on the home page with the player name, country flag, the hearts and when it happened (for a gift also the name of the player who gave it).

Legal basis: Art. 6(1)(b) GDPR (granting the supporter perks) and Art. 6(1)(c) GDPR where we must keep records for legal (e.g. tax) reasons. Retention: as long as your supporter status is active and afterwards as required by law.
Ko-fi privacy policy: ko-fi.com/home/privacy

Supporter by bank transfer

You can pay for Supporter by bank transfer (SEPA). When you press "Get my payment code" on the supporter page, we store an order with: your account, the player you gift it to (if any), Supporter or Supporter Plus, the amount, a random code (KU-…), when it was made and when it was paid. The page shows a scan code (GiroCode) with our bank details for your banking app; the scan code is made in your browser by a script from cdnjs.cloudflare.com and contains only our bank details, the amount and the reference.

The transfer itself goes from your bank to ours. With it, our bank shows us the name of the account holder, the IBAN, the amount and the reference you sent – this is how bank transfers work, and you also see our account holder's name. We look at the transfer only to find the code and hand out Supporter by hand; we do not copy your name or IBAN into our database. The bank keeps its own records under its own privacy policy and the legal retention periods.

Supporter with card, Apple Pay or Google Pay (Stripe)

If you press "Card, Apple Pay, Google Pay" on the supporter page, we store the same order as for a bank transfer (your account, a gift recipient if any, Supporter or Plus, the amount, the code KU-…, the times) and send you to a payment page of Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your card or wallet details only at Stripe – they never reach our server. Stripe tells us only that the order with your code was paid, the amount and the currency; then Supporter is handed out by itself. Stripe processes your payment details, e-mail address (if you enter it there), device and fraud-check data under its own privacy policy (stripe.com/privacy); data can go to Stripe, Inc. in the USA (EU-U.S. Data Privacy Framework and standard contractual clauses). Legal basis: Art. 6(1)(b) GDPR.

Supporter with PayPal

You can also pay with PayPal through a ticket on our Discord. PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) then shows us the name, e-mail address, amount and note of the payment; staff hand out Supporter by hand. We do not copy these details into our database. PayPal's own privacy policy applies.

Legal basis: Art. 6(1)(b) GDPR (handing out what you paid for) and Art. 6(1)(c) GDPR for records we must keep (e.g. tax). Retention: open and cancelled orders are deleted with your account; paid orders are kept as payment records as required by law.

---

11b. Voting on osu-server-list.com

You can vote for Kuroosu on osu-server-list.com (an independent server list). Our website only links there; no data is transmitted until you click the link. On their page you type your Kuroosu name; their server then asks our public API whether this player exists (the same API anyone can use). We save that a vote was made for your account and when, to show your next vote time and streak and to hand out vote rewards (badges, "Top Voter" with Supporter days). We receive no other data from the list – osu-server-list.com's own privacy policy applies on their site.

Legal basis: Art. 6(1)(b) GDPR (vote rewards you take part in by voting). Retention: until you delete your account.

---

11c. Gems and boxes

To run gems we store your gem balance, each payout, staff change, trade offer, slot spin and box opened with its time, the items you own and the items you wear, your quests and streak shields, and the number of each Epic and Legendary item with who found it. What you wear shows on your public profile. The first finder of an item is shown on the gems page. Players you trade with can see your items and name. The top collectors list shows your name and item counts. This data is deleted together with your account, item numbers stay without your name. Your gem profile at /gems/u/your-id is public: it shows your items, gem balance and your box, slot and Plinko totals.

12. Recipients of data

We do not sell or rent personal data. Data is only passed on to the service providers listed in sections 4 and 11 as far as technically necessary, or to authorities if we are legally obliged to do so. Staff members (moderators/administrators) of Kuroosu can view account and moderation data as far as required for their tasks.

---

13. Retention and deletion

• Account and game data: until you delete your account.
• Server logs: max. 7 days.
• Chat messages: 60 days after they were sent (messages written by supporters are kept until the account is deleted).
• Backups: we create backups on our own server to protect against data loss. Database backups are kept for 14 days, file backups (avatars, replays, screenshots) for 4 weeks; after that they are deleted automatically. Deleted accounts therefore disappear from all backups after at most 4 weeks.

You can delete your account yourself at any time under Settings → Data on the website. This permanently removes your account together with your scores, replays, statistics, login records, client identifiers, messages, comments and relationships. This cannot be undone.

---

14. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15) – you can download a copy under Settings → Data,
• rectification of incorrect data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• withdraw consent at any time with effect for the future, where processing is based on consent (Art. 7(3)).

To exercise your rights, use the functions under Settings → Data or email us at [email protected] from the email address registered to your account, so we can verify that the request is yours.

Right to lodge a complaint: You may complain to a data protection supervisory authority, in particular in your place of residence or at our location. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
www.ldi.nrw.de

---

15. Children

Kuroosu is intended for users aged 16 and over. If you are younger, please only use the service with the permission of a parent or legal guardian. If we learn that we hold data of a child under 16 without such permission, we will delete it. Parents can contact us at the email address above.

---

16. Security

All connections to our website and game server are encrypted (HTTPS/TLS). Passwords are only stored as bcrypt hashes. Internal services (database, cache) are not reachable from the internet, and access to the server is restricted to the operator.

---

17. Changes to this policy

We may update this Privacy Policy when our service or the legal situation changes. The current version is always available on this page; the date at the top shows the last change.

---