Rocket Swap Legal

Rocket Swap Privacy Policy

Effective and last updated: September 26, 2026

1. Scope and operator

This Privacy Policy explains how the Rocket Swap Team ("Rocket Swap," "we," "us," or "our") handles information when you use the Rocket Swap desktop application, authentication service, website endpoints, and related community features (together, the "Service"). Rocket Swap is an independent community project and is not affiliated with, endorsed by, sponsored by, or officially connected with Psyonix, Epic Games, or Discord.

2. Information we process

We minimize the information used to operate the Service. Depending on the features you use, we process:

3. Windows device key and what it is not

Rocket Swap now uses an app-specific ECDSA P-256 signing key to prove possession of the linked Windows user profile. Windows creates and keeps the private key in a current-user Key Storage Provider. Rocket Swap first attempts to use the Microsoft Platform Crypto Provider, which is TPM-backed when compatible TPM hardware and Windows support are available. If that provider is unavailable, Rocket Swap uses the Microsoft Software Key Storage Provider. In both cases, the key is created with a non-exportable policy. The private key is not uploaded to Rocket Swap, Cloudflare, Discord, or the D1 database.

The app sends the corresponding public SubjectPublicKeyInfo (SPKI) value and a key identifier derived by applying SHA-256 to that public SPKI. D1 stores that public key, key identifier, algorithm name, and link state. A public key is not secret, but the public key and key identifier are stable pseudonymous identifiers while the key remains in use. They can associate activity with the same Windows profile and can reveal when the same key is used with more than one Rocket Swap account.

This device key is not a hardware ID. The device-linking process does not read or upload motherboard, disk, firmware, TPM endorsement, MAC-address, or other hardware serial numbers. Separately consented error reports can read limited non-serial PC specifications as described in Section 7; they are not used to identify or link a device. TPM-backed storage can make extraction more difficult, but it does not disclose a TPM identifier to Rocket Swap and does not prove that a physical computer is unique. The software-provider fallback is protected for the current Windows user but is not hardware-backed. A non-exportable policy also does not prevent software already running as the same Windows user from asking Windows to use the key, so you should keep your Windows account secure.

The app keeps non-secret device-key metadata locally, including the provider choice, public key, key identifier, and creation time. The Windows provider retains the private key separately. This allows the same Windows profile to keep its device identity across ordinary Rocket Swap updates or reinstalls. Loss of the Windows profile, provider key, TPM state, or access to the key can require the device-replacement process.

4. Possession proofs and replay resistance

For protected requests, Rocket Swap may sign a canonical proof containing the device-key identifier, a short-lived timestamp, a random nonce, the HTTP method and escaped path, a hash of the exact request body, and a hash of the current session token. The Service verifies the signature with the stored public key. The raw private key and raw session token are not part of the proof.

To reject reuse during the proof window, the Service may temporarily retain a server-keyed, one-way hash of the proof nonce together with an expiry time. It does not need to persist the raw nonce, raw signature, raw request body, or raw session token for replay detection. Proof timestamps and nonce hashes are security data, not hardware identifiers.

5. Legacy installation identifiers

Accounts that have not yet upgraded can temporarily continue using the earlier random installation identifier. That value is generated by Rocket Swap rather than read from computer hardware and is protected locally with Windows Data Protection API (DPAPI) where supported. The Service stores only a server-keyed one-way hash of the identifier, not the raw identifier. During a verified upgrade, D1 replaces the active installation hash with the public-key binding and may retain a previous one-way hash as limited reset or migration lineage. Legacy compatibility will be removed only after a safe rollout.

6. Device replacement and session invalidation

Self-service Change PC requires proof of possession of the proposed new key, an explicit confirmation in the app, fresh Discord authorization, and a second explicit confirmation in the browser. The browser displays a short verification code so you can compare it with the app. The Service stores only a server-keyed hash of the one-time reset value. An unfinished confirmation expires after a short period and can be restarted.

When replacement succeeds, D1 replaces the linked public key, clears the one-time reset hash, records the reset time and count, applies a cooldown before another self-service replacement, and increments the account session epoch. Incrementing the epoch invalidates sessions issued before the replacement. Rocket Swap currently applies a 24-hour self-service replacement cooldown to reduce takeover and reset abuse. Administrative recovery may remain available where appropriate.

7. Network and service-provider processing

Cloudflare necessarily receives network information, including your IP address, when delivering the Service. For application rate-limit partitioning, the Worker hashes the connecting IP in memory before using the rate-limit service. Rocket Swap does not persist the raw connecting IP in its D1 application database, and legal-acceptance records do not store IP-address or user-agent hashes. Cloudflare may separately process service logs and network information under its own policies.

Cloudflare provides hosting, D1 database, traffic delivery, and rate-limiting services. Discord provides account authorization, identity, server-membership, and role information. These providers process information under their own terms and privacy policies. We may also disclose limited information when reasonably necessary to comply with law, protect users or the Service, investigate abuse, or establish or defend legal rights.

When configured, authentication and security audit notices are sent through a Discord webhook to private Rocket Swap staff channels. These notices may include your Discord user ID or mention, display identity, relevant role or access information, action status, and a short allow, denial, reset, or security reason. Optional active-user summaries may include Discord user IDs for recently active accounts. Raw session tokens, raw IP addresses, raw installation identifiers, hardware serials, private device keys, public SPKI values, proof signatures, and raw proof or reset nonces are not included in these webhook notices.

Opt-in desktop error reports

Desktop error reporting is off by default. If you separately enable it in Settings after reviewing the in-app notice, Rocket Swap attempts to send a report for logged app errors through Cloudflare to a private Rocket Swap staff Discord channel. Each report includes your Discord user ID (attached by the service), the time, app version, feature/source, user-facing error, and any technical reason recorded by the failing operation. The private Discord message visibly identifies the affected account using the mention form <@DiscordID>. The service permits a mention only for the Discord ID authenticated by that report; the desktop client cannot choose another account. Whether Discord produces a notification depends on the user's access to the private staff channel and Discord notification settings. That reason may include an exception type or stack trace. If the operation did not capture a cause, the report says so rather than claiming certainty.

Reports also include detailed PC specifications: system manufacturer, model and type; Windows product, release, build and architecture; motherboard and BIOS manufacturer, model and version; CPU model, vendor, socket count, physical-core and thread counts, clock speeds and NUMA-node count; total and available RAM plus each memory module's manufacturer, part number, capacity, speed and SMBIOS type; every graphics adapter's model, vendor and device IDs, dedicated and shared memory, driver version and date, active resolution, refresh rate and status; monitor count and desktop resolution; and every fixed physical disk and logical volume's model, interface, media type, capacity, free space, file system and status. Reports also state whether three title-proxy helper files are present. Hardware information is read from Windows APIs, DXGI, selected WMI hardware classes, and specific Windows and CPU registry values, not a full registry dump. The app does not attach general log files, game files, documents, screenshots, hardware serial numbers, UUIDs, MAC addresses, usernames, or raw registry data. The allowlisted report is attached to the private Discord message as JSON so staff can inspect all disclosed fields. The app and service attempt to remove local paths, URLs, email addresses, account identifiers, and credential-like text from error details before they reach Discord. Because technical errors can contain unexpected text, this filtering cannot guarantee that a report is free of all personal information.

Cloudflare receives the authenticated request and normal network metadata, including the connecting IP address. The Discord report does not include the raw IP address, bearer token, device private key, or signed device proof. Staff use reports to diagnose failures. Reports remain in the private Discord channel until staff remove them. You can turn reporting off in Settings at any time; no new reports will be queued, although one already in flight may finish. Network delivery can fail or be rate-limited, and an exact root cause is not guaranteed for every error.

We do not sell personal information. We do not run third-party advertising in the Service, and we do not share personal information for cross-context behavioral advertising.

8. Why we use information

We use this information to authenticate users, verify Discord roles, bind and replace devices, prove possession of a linked key, resist replay and session sharing, enforce access rules, synchronize requested settings, record legal acceptance, diagnose failures, secure the Service, and comply with applicable obligations. We do not use it for third-party advertising or behavioral profiling.

9. Retention and deletion

We retain information only as long as reasonably needed for the purposes above. Session credentials expire or may be revoked. Active public-key device links remain while an account is linked. One-way proof-nonce and reset-token hashes are intended to remain only for their short security windows. Device-link records may retain reset counts, cooldown times, and limited one-way lineage to prevent abuse. A device-replacement completion event is assigned a 90-day retention-expiry marker for cleanup. Synchronized settings remain until changed or deleted. Legal acceptance records may be kept longer to demonstrate which policy version was accepted. Limited security records may be retained as needed to investigate misuse, enforce restrictions, or protect the Service.

For opt-in error reports, Discord retains the report until Rocket Swap staff remove it. Turning off the feature stops future reports but does not delete reports already delivered. You may request removal of a report through the contact channel below, subject to verification and applicable obligations.

You may request access, correction, deletion, or a device reset through the Rocket Swap Discord community at https://discord.gg/dGxtZagQgB. We will evaluate requests under applicable law and may need to verify the requesting Discord account. Deleting information required for authentication, security, or access control may require closing or disabling your Rocket Swap access. Some records may be retained where reasonably necessary for legal, fraud-prevention, dispute, or security purposes.

10. Security and data minimization

We use measures such as signed sessions, non-exportable Windows keys, public-key possession proofs, scoped secrets, short-lived confirmations, one-way stored reset and replay references, rate limits, revocation, session epochs, least-necessary database fields, and access controls. No system is perfectly secure, so you should keep your Discord account, Windows account, and Rocket Swap authorization credentials private and report suspected compromise promptly.

11. Children and age requirements

The Service is not intended for anyone below Discord's minimum age for their country or below any higher age required by applicable law. If we learn that ineligible personal information was provided, we may disable the account and delete information where appropriate.

12. Changes to this Policy

If this Policy materially changes, we will publish a new version and require fresh acceptance before protected features can be used. The Service records the version and content hash accepted, so later edits cannot silently replace that evidence.

13. Contact

Privacy questions and requests can be submitted through the Rocket Swap Discord community at https://discord.gg/dGxtZagQgB.