Privacy Policy

---

Privacy Policy

Last updated: 18 October 2026

This Privacy Policy explains which personal data is processed when you visit kuroosu.online or play on the Kuroosu osu! private server, why this happens, and which rights you have under the EU General Data Protection Regulation (GDPR) and German data protection law.

---

1. Controller

The controller responsible for data processing is:

Luke Thomas
Raymanshof 39a
46539 Dinslaken
Germany

Email: [email protected]

We are not required to appoint a data protection officer. For any privacy question, contact us at the email address above.

---

2. Overview

Kuroosu is a free, non-commercial osu! private server run by private individuals. We only process the data needed to provide the website and the game server, to keep them secure, and to ensure fair play. We do not sell your data, do not use advertising or tracking cookies, and do not use analytics services.

---

3. Hosting

The website and the game server run on our own server located in Germany. All account and game data is stored on this server. No external hosting provider has access to the stored data.

---

4. Cloudflare (network, security, bot protection)

All connections to kuroosu.online and its subdomains are routed through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; EU representative: Cloudflare Germany GmbH). Cloudflare acts as a reverse proxy and content delivery network: it protects the server against attacks (e.g. DDoS), hides the server's real address and caches static files such as images.

For this, Cloudflare processes technical connection data, in particular your IP address, the requested URL, browser type/user agent, and time of the request. Cloudflare may set technically necessary cookies to detect malicious traffic.

Cloudflare Turnstile: On the login, registration and password recovery pages we use Cloudflare Turnstile to distinguish humans from bots. Turnstile analyses technical information about your browser and device (e.g. IP address, browser characteristics, interactions) without showing a puzzle in most cases.

Cloudflare also hides email addresses on our pages from spam bots ("email obfuscation"); a small script from Cloudflare decodes them in your browser.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in a secure, available and abuse-free service.
Cloudflare is certified under the EU-U.S. Data Privacy Framework; data transfers to the USA are therefore based on the adequacy decision of the European Commission (Art. 45 GDPR). Additionally, Cloudflare's Data Processing Addendum including Standard Contractual Clauses applies.
More information: cloudflare.com/privacypolicy

---

5. Visiting the website – server logs

When you access our website, our server automatically records:

• IP address
• date and time of the request
• requested page and HTTP method
• HTTP status code
• browser type and version (user agent)

This data is used exclusively to operate the website, to find errors and to detect and defend against attacks.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website).
Retention: log files are automatically deleted after at most 7 days.

---

6. Cookies and local storage

We only use technically necessary cookies:

The effects setting (Auto, Full or Fast in the settings menu) and the result of a short frame rate check that switches slow devices to the fast mode are kept in your browser only (localStorage: op-fx, op-fx-slow, op-fx-hits); they are never sent to us.

No cookies are used for advertising, tracking or analytics. Because these cookies are strictly necessary to provide the service you request, no consent is required (§ 25(2) no. 2 TDDDG). Legal basis for the related processing: Art. 6(1)(b) and (f) GDPR.

---

7. User account

When you register (on the website or in the osu! client), we store:

• username
• email address
• password (stored only as a salted bcrypt hash – we cannot read your password)
• country (determined from your IP address at registration, can be changed)
• registration date and last activity

Login sessions: for every website login we store a session with your IP address, the approximate location derived from it (city and country) and the browser used, so you can review and end your active sessions in the settings. Sessions end on logout or when they expire (1 or 7 days).

Location lookup (ip-api.com): to determine your country at registration and the approximate location of a login session, your IP address is sent to the geolocation service ip-api.com. Only the IP address is transmitted; the service returns country and city. For in-game logins, the country is normally taken from the location information supplied by Cloudflare; ip-api.com is only used as a fallback.

Optional data you can add: avatar, profile banner, profile page ("userpage"), profile customisations (e.g. layout, pinned scores, supporter colours and background), clan membership, comments and friends list. We also store the notifications shown to you, badges and medals you earned, your rank history and, if you signed up with an invite link, who invited you.

The email address is used for account recovery and, if necessary, to contact you about your account. We do not send newsletters.

Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for).
Retention: until you delete your account (see section 13).

---

8. Playing on the server

When you connect with the osu! client (-devserver kuroosu.online), we process:

• Login data: IP address, osu! client version and release stream, time of login
• Client identifiers: hashed (MD5) values that the osu! client sends automatically – hash of the osu! installation path, hash of network adapter information, an uninstall ID and a disk signature. We never receive the raw hardware data, only these hashes.
• Gameplay data: scores, accuracy, performance points (pp), mods used, play time, replays (.osr), screenshots you upload with the in-game screenshot function, beatmap ratings and favourites
• Chat and messages: public chat messages in channels and private messages to other players and to the bot. Chat messages are logged. Private messages you write in-game and in the website chat (/chat, only with friends, including group chats) are stored together and are not end-to-end encrypted: the owner and staff can read them to protect players (e.g. against harassment, scams or cheating deals). Pictures and voice messages you send in the website chat are stored on our server as files (photos without their location/EXIF data) and can be viewed or listened to by staff in the same way. The microphone is only used while you record a voice message or are in a call. Voice calls between friends are connected directly between the two browsers (WebRTC): the audio is encrypted, does not pass through our server and is not recorded. For a direct connection both players' browsers exchange their IP addresses with each other, and to find the best route your browser contacts a public STUN server (Cloudflare, Google), which sees your IP address. Please don't share passwords or other sensitive data in chats. Clean-up: private messages and group chat messages (with their pictures and voice messages) are deleted automatically 60 days after they were sent; only messages written by players who are supporters at that time are kept. When you edit or delete a message, the earlier text stays stored for our staff (moderation) until the message itself is cleaned up. The chat also stores what you set there: muted chats, pinned messages, votes in polls, your own stickers (supporters; staff checks them before they can be used), the colour and background you chose, and "beat my score" challenges you sent. If a friend follows you, they may get a notification when you set a new top play.
• Suggestions and bug reports: what you send on /feedback (type, area, title, text, an optional screenshot and your browser's user agent so we can reproduce bugs) and the team's answer. Only you and our staff can see it. It is stored until staff deletes it or you delete your account; screenshots are stored as files on our server (without location/EXIF data).
• Profile views and rivals: when you open a profile we count the visit once per hour. If you are logged in we save your player ID and the time, and the owner of the profile can see that you visited (in the list of recent visitors on their profile). Guests are only counted: we save a one-way hash of the IP address, never the IP itself. Your rivals (up to 3 players you picked) are saved so we can tell you when they beat your score. Both are deleted with your account.
• Kuroosu patcher (optional, only if you use it): while osu! runs with the patcher it sends our server about once a minute your osu! player name, the file names of the DLLs loaded inside osu!, the names of the running programs and whether a debugger is attached. We save that you played with the check and when (deleted after 60 days), your IP address is only compared with the one of your last in-game login, matches with known cheats (visible to staff) and a list of DLL names without any player. Program names that match nothing are not stored. The window of the patcher tells you this before osu! starts. Legal basis: your consent by starting the patcher (it is not needed to play here) and our legitimate interest in fair leaderboards; you stop it at any time by playing without the patcher. Details: Patcher. With the option "Show Kuroosu in my Discord status" on (you can turn it off in the osu! options), the patcher asks our public API what you are doing in-game and hands that text, the mode and your live pp to the Discord app on your PC, which shows it in your Discord profile.
• Kuroosu lazer client: while you are logged in, the client checks itself every 30 seconds and sends our server about every 2 minutes your player id and name, the client version, the file names of the DLLs loaded inside the client that are not part of Windows or of the game, and what matched a known cheat (a cheat program running next to it, a cheat DLL inside it, an attached debugger). We store it the same way as for the patcher (session deleted after 60 days, your IP address only compared with your last in-game login, matches visible to staff, DLL names without any player). The full list of your programs and folder paths are never sent. While the client found a cheat, it does not send scores until you restart it.
• Menu music and share pictures: the menu music songs come from our own server (assets.kuroosu.online), your settings for it (on/off, volume, song) stay in your browser (localStorage). Share pictures of profiles and scores are made on our server; for the map picture our server loads the beatmap cover from assets.ppy.sh, your browser does not.
• Reports, warnings and ban appeals: reports you send on /report (who, why, your text, an optional link and score) and the staff's answer; only you and our staff see them and the reported player never sees who reported them. Warnings staff gives you and ban appeals you send on /standing (text, optional link, the staff's answer). Staff also keeps internal notes and a moderation history per player (together with the restrictions from the game server) to apply our rules fairly. Your own reports and appeals are deleted with your account; warnings, notes and reports about you are kept as moderation records, like restrictions.
• Former login with Google: logging in with Google was switched off on 18 October 2026. If you connected a Google account before, we still have the ID of that Google account and its email address; it is deleted with your account, or earlier if you ask us.
• Store: when you order something in the store we save what you ordered, the price, your order code and when it was paid. Paid orders are kept as payment records (see Ko-fi below), open orders are deleted with your account.
• Two-factor login: if you turn it on, we store the secret key for your authenticator app and the time of the last used code (so a code can't be used twice). It is deleted when you turn it off or delete your account. Failed logins are counted for 15 minutes per account and IP address to stop password guessing.
• Online status: current activity (e.g. which beatmap you are playing), shown to other players.
• Replay views: when a replay is watched in-game or downloaded on the website, we count one view per score. To count each viewer only once per hour, the viewer's player ID or IP address is kept for 1 hour and then deleted automatically; only the view count is stored.

Scores, pp, rankings, profile statistics and replays are public and visible to everyone on the website and in-game.

Purposes and legal bases:

• providing the game service, leaderboards and statistics – Art. 6(1)(b) GDPR
• security, preventing multi-accounting, ban evasion and cheating (client identifiers, IP addresses, chat logs) – Art. 6(1)(f) GDPR, our legitimate interest in a fair and safe community

Retention: while your account exists. Login records and client identifiers are deleted together with your account.

---

9. Anti-cheat and automated decisions

To keep leaderboards fair, submitted scores are checked automatically:

• integrity checks (checksums of the score data, osu! client and beatmap),
• flags that the osu! client itself reports (e.g. detected flashlight or spinner manipulation),
• performance point limits per game mode.

If a check fails, the score may be rejected and the account automatically restricted. You can contest this at any time by contacting us; a staff member will then review the case personally (for example by asking for a live recording of your gameplay). Trusted players can be exempted from the pp limits after such a review.

Legal basis: Art. 6(1)(f) GDPR (fair competition for all players). Where the restriction qualifies as an automated decision, it is necessary for the performance of the contract (Art. 22(2)(a) GDPR); you have the right to obtain human intervention, to express your point of view and to contest the decision (Art. 22(3) GDPR).

---

10. Moderation and audit logs

Actions of staff members (e.g. restrictions, privilege changes, name changes) and reports are recorded in an internal audit log to ensure accountability.

Legal basis: Art. 6(1)(f) GDPR. Retention: while the affected account exists.

---

11. External content loaded in your browser

Some content on our pages is loaded directly from third parties. Your browser then connects to these providers and transmits your IP address and browser information:

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functional website and beatmap downloads). For beatmap downloads, the processing is necessary to provide the function you requested (Art. 6(1)(b) GDPR).

Links to external sites (e.g. our Discord server, osu! website) are ordinary links; no data is transmitted to these services until you click them. Discord's own privacy policy applies there.

---

11a. Donations via Ko-fi

You can support Kuroosu voluntarily through Ko-fi (Ko-fi Labs Limited, United Kingdom). Our website only links to our Ko-fi page; no data is transmitted until you click the link. Payments are processed entirely by Ko-fi and its payment providers (e.g. PayPal or Stripe) under their own privacy policies – we never receive your payment details.

For store orders you write your order code into the Ko-fi message so we can match the payment to your account. From Ko-fi we receive the information needed to thank you and to grant the supporter badge or your order: the name you enter, the amount, the date and an optional message, and your email address if you provide it. We use this data only to grant and manage supporter status and to answer questions about your donation.

Legal basis: Art. 6(1)(b) GDPR (granting the supporter perks) and Art. 6(1)(c) GDPR where we must keep records for legal (e.g. tax) reasons. Retention: as long as your supporter status is active and afterwards as required by law.
Ko-fi privacy policy: ko-fi.com/home/privacy

---

11b. Voting on osu-server-list.com

You can vote for Kuroosu on osu-server-list.com (an independent server list). Our website only links there; no data is transmitted until you click the link. On their page you type your Kuroosu name; their server then asks our public API whether this player exists (the same API anyone can use). We save that a vote was made for your account and when, to show your next vote time and streak and to hand out vote rewards (badges, chat stickers, "Top Voter" with Supporter days). We receive no other data from the list – osu-server-list.com's own privacy policy applies on their site.

Legal basis: Art. 6(1)(b) GDPR (vote rewards you take part in by voting). Retention: until you delete your account.

---

12. Recipients of data

We do not sell or rent personal data. Data is only passed on to the service providers listed in sections 4 and 11 as far as technically necessary, or to authorities if we are legally obliged to do so. Staff members (moderators/administrators) of Kuroosu can view account and moderation data as far as required for their tasks.

---

13. Retention and deletion

• Account and game data: until you delete your account.
• Server logs: max. 7 days.
• Chat messages: 60 days after they were sent (messages written by supporters are kept until the account is deleted).
• Backups: we create backups on our own server to protect against data loss. Database backups are kept for 14 days, file backups (avatars, replays, screenshots) for 4 weeks; after that they are deleted automatically. Deleted accounts therefore disappear from all backups after at most 4 weeks.

You can delete your account yourself at any time under Settings → Data on the website. This permanently removes your account together with your scores, replays, statistics, login records, client identifiers, messages, comments and relationships. This cannot be undone.

---

14. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15) – you can download a copy under Settings → Data,
• rectification of incorrect data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• withdraw consent at any time with effect for the future, where processing is based on consent (Art. 7(3)).

To exercise your rights, use the functions under Settings → Data or email us at [email protected] from the email address registered to your account, so we can verify that the request is yours.

Right to lodge a complaint: You may complain to a data protection supervisory authority, in particular in your place of residence or at our location. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
www.ldi.nrw.de

---

15. Children

Kuroosu is intended for users aged 16 and over. If you are younger, please only use the service with the permission of a parent or legal guardian. If we learn that we hold data of a child under 16 without such permission, we will delete it. Parents can contact us at the email address above.

---

16. Security

All connections to our website and game server are encrypted (HTTPS/TLS). Passwords are only stored as bcrypt hashes. Internal services (database, cache) are not reachable from the internet, and access to the server is restricted to the operator.

---

17. Changes to this policy

We may update this Privacy Policy when our service or the legal situation changes. The current version is always available on this page; the date at the top shows the last change.

---