Privacy policy — TpF2 Multiplayer

Last updated 12 September 2026. Every change to this page is in the site's commit history.

Who is responsible

TpF2 Multiplayer is an open-source project run by an individual maintainer (silver2127 on GitHub). The project runs one server, which hosts the public games list, the connection helper, a dedicated relay and the desync report receiver. For questions or requests about your data, open an issue on GitHub.

Playing with others

When you host or join a game, your computer exchanges data with the other players in that session, directly or through the host or a relay:

Your player name, the lobby name, your company choice and your chat messages.
Game commands: what you build, buy and change in the game.
Network addresses. Players' public and local IP addresses and ports are shared with everyone in the session so the games can connect to each other.
The world save. The host sends the save file to every player.
Diagnostic logs. While you are in a session, your lobby and game logs are sent to the host automatically so problems can be investigated, and the host's computer stores them in a log file. IPv4 addresses in the lobby's own log are shortened; the game logs are not filtered.

Game traffic is encrypted with a key taken from the join code (and the lobby password, if one is set). The save file transfer is not encrypted; its integrity is checked with checksums sent over the encrypted channel.

Join codes. A join code without a lobby password contains the host's IP address. Share it only with people you want to play with, or set a lobby password: a password-locked code is encrypted.

Connection services

Service	When	What is sent	What is kept
Public games list project server	While the Multiplayer host/join page is open, the list is fetched every 10 seconds. If you host with PUBLIC ticked (off by default), your game is announced every 10 seconds.	Fetching: a normal web request. Announcing: the lobby name (by default "<your player name>'s game"), the join code, the player count, the version and whether a password is set. A public game without a password therefore publishes the host's IP address inside its code.	Held in memory only; a listing disappears 30 seconds after its last announcement, or at once when you stop hosting.
Connection helper project server	A host checks for notes every second for the whole session, whether or not the game is public. A joining player leaves a note when a direct connection is slow to start.	The joining player's network addresses, encrypted with a key only the players in the session have. The server cannot read the note.	In memory only, for 60 seconds.
STUN servers Google, Cloudflare, Nextcloud, Mozilla	When you host or join.	A standard STUN request that tells the game its public address. These servers see your IP address.	Governed by those providers' own policies.
Your router UPnP	When you host.	A request on your local network to open the game's port.	The port mapping is removed when the lobby closes.

Every web request to the project server is made over HTTPS. Like any web server, it can record the IP address of requests in its access logs.

Dedicated relays

If you join a dedicated relay from the public games list, all of the session's data passes through that relay: player names, chat, game commands, logs and the world save. The relay's operator holds the session key and can read this data. On the project's own relay:

the session's leader uploads the world save again every few minutes during the session, and the most recent one is stored until the leader starts a new world (/new) or a newer save replaces it;
which instance letter and company each player name had is stored, so returning players keep them;
the session log, including the logs forwarded by players, is kept until the relay restarts.

Desync reports

When the game notices that the players' worlds no longer match, it can send a report so the bug can be fixed. By default it asks first, offering Always send, Only this once and Never. Change the choice at any time by typing /desynclogs ask, /desynclogs always or /desynclogs never in the in-game chat. At most one report is sent per session.

What a report contains: the multiplayer logs and runtime files from %LOCALAPPDATA%\tpf2mp\data, the game's log (stdout.txt), the game's settings file (including your list of enabled mods), a few multiplayer configuration files from the game folder, and the multiplayer version, your Windows version and details of the desync.

Removed before sending: your Windows user name, computer name and profile folder name, your Steam account ID, all IP addresses, and join codes.

Not removed: player names, lobby names, chat messages and game content. In versions up to 0.4.18, a company password typed in the in-game Multiplayer window can also be included in plain text, so do not reuse a password there that you use anywhere else.

What the server keeps: the report archive and its details, without your IP address. Your IP address is held in memory for up to an hour for rate limiting. Reports are kept for investigating bugs, and the oldest are deleted automatically once they take up more than 2 GB. To have a report deleted, open an issue on GitHub with the time it was sent.

What stays on your PC

The multiplayer logs, crash-log archives and settings in %LOCALAPPDATA%\tpf2mp, the lobby's logs in the game's netpunch folder, and your saved player and lobby names stay on your computer. Nothing reads them except the features above, and you can delete them at any time.

Your choices

Type /desynclogs never to never send desync reports.
Set a lobby password so your join code does not reveal your IP address.
Leave PUBLIC unticked to keep your game off the public list.
Play with people you trust: players in a session see each other's IP addresses, chat and logs.
Uninstall the software to stop all of the above.