Privacy and network
BakaLoader starts a server process, edits files in your Valheim folders and talks to a few services. Here is exactly what it touches, so you can decide for yourself.
The source is in the repository and every release is built from it. If you would rather read the code than this page, that is a reasonable thing to do.
valheim.thunderstore.io for the mod index, and thunderstore.io to download mod files you asked for. One request fetches the whole Valheim community package list, which is cached in memory for 15 minutes. It sends nothing about you or your server.
hexium.gg, and only if you turned on Also check Hexium in the Upkeep card. New in 1.1.0 and off until you move that switch. See Hexium for the whole of it; the network half is below.
api.github.com/repos/RyanDMcAfee/ValheimBakaLoader to see whether a newer BakaLoader release exists, and GitHub's own download addresses to fetch one when you let it.
https://api.ipify.org?format=json to find your public address. That is what fills the Public line on the Network card. It returns your IP and nothing else. Your LAN address is found locally, by looking at your own network adapters, and contacts nothing.
https://steamcdn-a.akamaihd.net/client/installer/steamcmd.zip, once, if you ever use Update and start on a standalone install. That is Valve's own address for steamcmd.
Steam itself, for a Steam library install, through the steam://validate/896660 link. That hands the update to the Steam client you already have.
Your own Discord webhook, only if you set one up on the Discord screen, and only the post it says it will send.
DNS, when the custom domain wizard checks whether the name you typed resolves to this server.
https://heartbeat-production-766c.up.railway.app/heartbeat, an anonymous heartbeat, covered below.
That is the complete list.
Also check Hexium is the one switch on this page that adds a host, so it gets its own section. It is off on a fresh install and off after an upgrade, and while it is off BakaLoader makes no request to any hexium.gg host on any path. Not a lookup, not a download, not even opening a page there in your browser.
With it on, two kinds of request exist and no others.
The index. One fetch of the whole Valheim package list from https://valheim.hexium.gg/api/v1/package/, held for 15 minutes and shared, so your machine reaches the site about four times an hour while BakaLoader is open, however many mods you have installed. The matching is done here, on your machine, against the list that came back, so the request itself says nothing about which mods you run. A failed fetch keeps whatever was already held and backs off rather than hammering the site.
A download you asked for. Only after you press I accept the risk, install, only from the address the index gave, and only while that address is https on a hexium.gg host, checked before the first request, again at every redirect and again on the final address.
What goes out with a request is a user agent naming what this is, and nothing else about you:
BakaLoader/1.1.0 (+https://github.com/RyanDMcAfee/ValheimBakaLoader)
What the site does with that is the site's business, and it is worth knowing before you turn the switch on: whoever runs Hexium is not named on it, its accounts are Discord sign-ins, so a name there is not proof of the same person on Thunderstore, and the site says it keeps request logs for up to ninety days. That is the whole of the disclosure, and it is printed beside the switch itself rather than buried here.
Turning the switch back off stops it immediately. See Hexium.
Every five minutes while the app is open, starting twenty seconds after launch, BakaLoader sends three fields:
{ "deviceHash": "...", "appVersion": "1.1.0", "serverRunning": true }
deviceHash is a one way hash of your MAC address and machine name. It cannot be turned back into either. appVersion is the version of the app. serverRunning is a true or false.
No addresses, no server name, no world name, no passwords, no player names, no world data. Nothing else is in the request.
It exists so there is some idea of how many people are running which version, which is the thing that decides whether a version has to keep being supported.
Turn it off with Share anonymous usage stats in the Upkeep card on the Dashboard. The switch is read fresh on every beat, so turning it off stops it immediately.
If the send fails, nothing happens. It is logged at debug level and never shown to you.
The Statistics journal, analytics.json, is never uploaded. Playtime, deaths, sessions, crash counts, mod history, all of it is a local file that only the app reads.
New in 1.1.0, a mod installed or updated from Hexium writes src: "hexium" on its own line in that journal, so the two sources can be told apart afterwards. The key is simply absent for a Thunderstore install. It goes in the same local file as everything else there, and that file still goes nowhere.
The Map is rendered locally from your world file. It is not served over the network, there is no web server, and nothing about your world is sent anywhere.
Your player list, your worlds, your configs and your logs are all local files.
Its own settings and logs under %USERPROFILE%\AppData\LocalLow\BakaLoader\ValheimBakaLoader\: userprefs.json, analytics.json, players.json and a logs folder.
Your server's BepInEx folders when you install, update or remove mods, and when it puts its own small plugins in place at each server start.
.bakaloader-source.json, one small file inside a mod folder, and only inside a mod folder BakaLoader installed from Hexium. It records that those files did not come from Thunderstore, which is how the app knows to leave that mod out of its own updates. It names the schema, the writer, the source, the owner, name and version, the address it came from, the size and the time. Nothing about you is in it, and it is never sent anywhere.
Your Valheim save folder for backups and restores, always as copies beside the world, never editing a world in place. And, during a restore, writing the world back.
%LocalAppData%\ValheimBakaLoader\ for its own copy of steamcmd and for the rendered map cache.
The Windows Run key, only if you turn on Start BakaLoader with Windows.
Your server password and your RCON password are stored in plain text in userprefs.json. There is no encryption.
They are masked in the log, where the server's launch command line is written with the password replaced by asterisks. They are not masked on disk.
The Discord post can carry your server password if you turn that switch on, and then everyone who can read that channel can read it. The switch says so.
Valheim uses the game port you set, 2456 by default, and the one above it, over UDP. Both need forwarding for people outside your network.
The Steam query port is the game port plus one.
RCON is TCP on 25575 by default and is bound to 127.0.0.1, so it is only reachable from your own machine. Nothing needs forwarding for it, and nothing should.
Crossplay does not need port forwarding. That is the point of a join code.
Windows Firewall usually asks the first time the server starts. Allow it on the network types you use.
For friends outside your network, forward UDP 2456 and 2457 to the machine running the server, in your router's port forwarding page.
If you would rather not open ports at all, turn on crossplay and give people the join code instead.
Windows may warn on first run, because the release is not code signed. Code signing certificates cost money per year and this is a free tool.
Check the download against the release page, read the source if you want to, and decide. There is no way for a free unsigned build to avoid that dialog.
Does it phone home with my server details? No. The heartbeat is three fields and none of them are about your server beyond whether one is running.
Can I run it fully offline? Mostly. Mod scanning and updates need Thunderstore, the update check needs GitHub, and the public address line needs ipify. Everything else works with no network at all.
Is RCON exposed to the internet? Not by default. It binds to 127.0.0.1. If you change that, understand what you are doing.
Why does it need my public IP? To show it on the Network card and in the join info, so you can paste it to friends. It is looked up, not stored anywhere but in memory.
What does it send to Thunderstore? A plain request for the package index and, when you ask for one, a download request for a package. Nothing about you.
What does it send to Hexium? Nothing at all unless you turned the switch on. With it on, the same two kinds of request: the package index, about four times an hour, and a download you asked for and accepted. The only thing identifying the request is the user agent, which names BakaLoader, its version and the repository.
Can I run it with Hexium off forever? Yes, and that is how it ships. Nothing in the app mentions the site while the switch is off except the switch itself.