I don’t believe mapping the entire keyboard and capturing mouse inputs in real-time is necessary for implementing a cam system.
What you’re describing aligns closely with the definition of
a keylogger:
"A keylogger, sometimes called a keystroke logger, is a type of surveillance technology used to monitor and record each keystroke on a device. It can be software-based and used to capture sensitive information." - Source
The fact that these inputs are not stored locally but are transmitted directly to a server—potentially overseas and passing through multiple proxies—raises serious privacy concerns. From what I can see, the only reference to this in your agreement is:
"
I consent that Miracle is saving play sessions for the sole purpose of improving the gaming experience or enforcing the Miracle Rules. Saved play sessions will contain the entire user experience, including, but not limited to, chats and player interaction." - durign sign-up process.
However, this wording does not explicitly inform users that
everything they type or every mouse movement they make is being captured and sent to a remote server.
There’s no mention of how this data is handled, who is responsible for its security, who has the access to users keyboard and mouse recordings, or how long it’s stored.
This lack of transparency is particularly concerning given that you have players from regions like the EU and the Americas, where privacy laws (e.g., GDPR, CCPA) require clear and explicit user consent for such data collection. Under GDPR, for instance, capturing and transmitting personal input data (including keystrokes) without clear consent or a legitimate purpose could be a serious violation.
It’s difficult to justify why such invasive data capture is necessary, especially when less intrusive solutions exist. This could very well fall under the scope of illegal surveillance, particularly in jurisdictions with strict data privacy laws.
--
And what about process scanning? It’s clear from functions like
getBlackListProcessError,
hasRunningBlacklistProcess, and
getBlackListProgram that the client actively scans for running processes on users' systems. Yet,
there’s no mention of this in your agreements or privacy policy.
This raises serious concerns because you are not only capturing and transmitting keyboard and mouse inputs while the client is running (hopefully only during that time) but also monitoring the user’s operating system.
What exactly are you scanning, and what other data is being sent to your servers?
Transparency is key here. Players have a right to know what’s being collected and why. This level of monitoring goes far beyond what most users would reasonably expect when playing a game.
Not “A.”
