Gacha Focus

Security

Short answers to the most common questions about the redemption extension.

Does the extension take my HoYoverse password or cookies?
No. It uses the session already open in your browser and talks directly to the official HoYoverse servers. None of that is sent to Gacha Focus; our server has no way into your account.
Which addresses does the extension talk to?
Only the HoYoverse ones used by official redemption, and our API:
  • api-account-os.hoyoverse.com: lists your accounts and servers;
  • public-operation-hk4e, -hkrpg and -nap.hoyoverse.com: redeem the code (Genshin, Star Rail and Zenless);
  • genshin, hsr and zenless.hoyoverse.com: the official redemption sites;
  • resgate.gachafocus.com.br: the Gacha Focus API (older versions use resgate.timyhomeserver.com.br).
Does Gacha Focus know my UID?
No. Each account becomes a "fingerprint" computed with a key that exists only in your installation. Our server only knows the region (e.g. America) and whether you turned that server on.
Can it get my account banned?
The extension does what the official site does, at a human pace: at least 30 seconds between codes, up to 30 per hour, and it pauses on its own if HoYoverse asks. The server also limits code delivery. Still, it is a third-party tool and decisions about accounts are always HoYoverse's (see the Terms of Use).
What if someone sends a fake code to the extension?
Every code arrives digitally signed, and the extension rejects anything without the Gacha Focus signature.
Can I use it in two browsers?
One at a time. Signing in on another browser disconnects the previous one, so the same code is never redeemed twice.
How do I stop or erase everything?
Pause a game or server in the popup at any time. "Sign out" ends the session in that browser. "Delete my account" erases your data after 2 days, with the option to change your mind (details). Avoid uninstalling to "reset": that installation's game accounts would be orphaned; sign out instead.