Last updated 20 September 2026. Every change to this page is in the site's commit history.
Who is responsible
TpF2 Multiplayer is an open-source project run by an individual maintainer (silver2127 on GitHub). The project runs one server, which hosts the public games list, the connection helper and a dedicated game server. For questions or requests about your data, open an issue on GitHub.
Playing with others
When you host or join a game, your computer exchanges data with the other players in that session, directly or through the host or a relay:
- Your player name, the lobby name, your company choice and your chat messages.
- Game commands: what you build, buy and change in the game.
- Network addresses. Players' public and local IP addresses and ports are shared with everyone in the session so the games can connect to each other.
- The world save. The host sends the save file to every player.
- Diagnostic logs. While you are in a session, your lobby and game logs are sent to the host automatically so problems can be investigated, and the host's computer stores them in a log file. IPv4 addresses in the lobby's own log are shortened; the game logs are not filtered.
Game traffic is encrypted with a key taken from the join code (and the lobby password, if one is set). The save file transfer is not encrypted; its integrity is checked with checksums sent over the encrypted channel.
Join codes. A join code without a lobby password contains the host's IP address. Share it only with people you want to play with, or set a lobby password: a password-locked code is encrypted.
Connection services
| Service | When | What is sent | What is kept |
|---|---|---|---|
| Public games list project server |
While the Multiplayer host/join page is open, the list is fetched every 10 seconds. If you host with PUBLIC ticked (off by default), your game is announced every 10 seconds. | Fetching: a normal web request. Announcing: the lobby name (by default "<your player name>'s game"), the join code, the player count, the version and whether a password is set. A public game without a password therefore publishes the host's IP address inside its code. | Held in memory only; a listing disappears 30 seconds after its last announcement, or at once when you stop hosting. |
| Connection helper project server |
A host checks for notes every second for the whole session, whether or not the game is public. A joining player leaves a note when a direct connection is slow to start. | The joining player's network addresses, encrypted with a key only the players in the session have. The server cannot read the note. | In memory only, for 60 seconds. |
| STUN servers Google, Cloudflare, Nextcloud, Mozilla |
When you host or join. | A standard STUN request that tells the game its public address. These servers see your IP address. | Governed by those providers' own policies. |
| Your router UPnP |
When you host. | A request on your local network to open the game's port. | The port mapping is removed when the lobby closes. |
Every web request to the project server is made over HTTPS. Like any web server, it can record the IP address of requests in its access logs.
Dedicated servers
If you join a dedicated server from the public games list, all of the session's data passes through that server: player names, chat, game commands, logs and the world save. The server's operator holds the session key and can read this data. On the project's own server:
- the world save is autosaved there during the session and kept until a newer save replaces it;
- which instance letter and company each player name had is stored, so returning players keep them;
- the session log, including the logs forwarded by players, is kept until the server restarts;
- no statistics about players are kept (versions before 0.6.1.11 counted joins and time played on the relay; that code is gone).
What stays on your PC
The multiplayer logs, crash-log archives and settings in %LOCALAPPDATA%\tpf2mp, the lobby's logs in the
game's netpunch folder, and your saved player and lobby names stay on your computer. Nothing reads them except
the features above, and you can delete them at any time. When the players' worlds stop matching, nothing is sent to the
project: the logs stay in %LOCALAPPDATA%\tpf2mp\logs and you attach them yourself if you report the bug.
(Versions before 0.6.1.11 could upload a scrubbed report to the project's server; that feature and its receiver were
removed.)
Your choices
- Set a lobby password so your join code does not reveal your IP address.
- Leave PUBLIC unticked to keep your game off the public list.
- Play with people you trust: players in a session see each other's IP addresses, chat and logs.
- Uninstall the software to stop all of the above.