Privacy

What we collect: very little. You need no account, the site sets no cookies unless you open the account pages (below), and there is no advertising. Usage statistics are collected by Umami⁠ (opens in a new tab), which we run on our own servers: a small script on each page sends the page's address, the site you came from, your browser's language and screen size, and a daily-changing hash that cannot be turned back into your address; it sets no cookie, your IP address is not stored, query strings are left out, and the account pages run no statistics script at all. When you use a page's controls (tick a task, set a Garden chip's rarity or a slayer's bosses an hour, pick a filter, sort a table, open a row, use the shards helper or save a backup), the script also notes which one and what you picked, such as which task, but never what you type into a search box, and the player and profile the page shows; from a browser that sends Do Not Track only the page view is counted, never what you use on it. The script and its requests go to this site's own address and nowhere else, and we use these statistics only ourselves, to see how the site is used and performs and to improve it.

• When you look up a username, the server asks Mojang for the account's UUID and Hypixel for that account's public SkyBlock profiles (and, only if you open the achievements page, the account's achievement list). Those results are kept for a short time so that pages load quickly and show the same thing each time you open them: in the server's memory, and in the site's database for up to an hour (a username's UUID for up to a week), after which they are deleted there; while a copy is older than a few minutes a page shows it at once and fetches a fresh one behind it. Only the looked-up player's own data is kept, never the other members of a co-op; it is never in a backup, and nothing ties it to who looked.
• Server logs record which pages were requested, with status codes and timings, and which player name or UUID a lookup was for, so we can see what the site is used for. The app does not log your IP address, and nothing links a lookup to the person who made it.
• Aggregate counters (for example the number of lookups per hour) are kept for capacity planning. They cannot identify anyone.
• The site is served through Cloudflare, which handles your connection like any network provider and shows us how many requests and visitors the site gets in total. No script on the pages reports anything.
• Fonts and every other asset are served from this site. Pages make no requests to third parties.
• Any progress you tick off manually is stored only in your browser's local storage; clearing this site's data in your browser removes it. "Download backup" on those pages saves a copy as a file on your device; the file is not sent anywhere.
• The shards helper keeps the levels you type in your browser's local storage too. It sends them to this site to work out the plan; the server does not store or log them.
• The Garden's Upgrades page keeps the rarity you pick for a chip, and the Slayers page the bosses an hour you type for a boss, in your browser's local storage too.

Accounts (optional)

Everything on the site works without an account. An account is for keeping the tasks you tick, the numbers you type into helpers and the choices you set by hand on more than one device: while you are signed in, the Quests, SkyBlock Guide, Shards and Garden pages send them to your account and bring back what it holds. Accounts are for players 13 and older (terms).

The short version:

• We keep your email address, your password in a form that cannot be read back, the one Minecraft username you link, and the ticks, helper numbers and hand-set choices you make for that player. Nothing else.
• We keep what Hypixel says about a player for up to an hour, and a username's UUID for up to a week, so pages load quickly and show the same thing each time. It is never in a backup and nothing ties it to who looked. We never keep your IP address or what you looked up. We send no marketing email.
• You can download everything or delete the account at any time, and it is gone at once.

The full version:

• What an account stores: your email address, your password in a scrambled form that cannot be turned back into the password (never the password itself), the month you answered the age question (not your birth date, not your age), when the account was created and when the address was confirmed, the one Minecraft username you choose to link (we check that it exists; nothing checks that it is yours, and nothing says it is), the tasks you ticked and the helper numbers you typed for that player, and the choices you set by hand for that player (today: each Garden chip's rarity and each slayer boss's bosses an hour), each with the time it last changed, and when you last chose to delete your tracked progress. An address typed into the sign-up form is held, unconfirmed, for up to eight days and then removed.
• What it never stores: anything the Hypixel API says about a player, your IP address, a history of what you looked up, or any free text. What Hypixel says about a player you look up is fetched when a page is opened and held by the site for up to about 15 minutes, then deleted, exactly as without an account: that player's own data only, never the other members of a co-op, not in any backup, and tied neither to an account nor to who looked. To keep you signed in it holds one entry per signed-in browser, with when that sign-in happened and when it runs out (a date that moves on while you keep using the site). A link we email you is held in the same scrambled form, with when it was made and used, for about a day. To slow down password guessing and floods of email, a failed sign-in or a request for an email leaves a scrambled mark of the email address or account it was for and of the network it came from, for up to a day; a mark cannot be turned back into either, and it is in no backup. When an account is deleted, a random number that stood for it and the day are kept for 60 days, so that if the database is ever restored from a backup the account is deleted again.
• How the address is kept: encrypted, with the key kept outside the database and its backups, so a copy of the database alone does not give the addresses away; a scrambled copy beside it lets us check that an address is used only once. It is shown to you, in full, on your account page.
• Email: we send email only to confirm your address, to reset your password, to tell you an account with your address already exists, to delete the account, and once to say the account was deleted. No marketing email. Messages are sent through Resend, which sees the recipient address and the message; Resend keeps message content and logs for 30 days, in the United States. Every link in those messages works once and for an hour. We never ask for your Minecraft or Microsoft login, and we never ask for your password by email.
• Cookies: only the account pages set any, and there are three. One protects the sign-in, sign-up and reset forms against being posted from another site, for an hour (__Host-sbp_csrf). One is set only when the answer to the sign-up form's age question did not allow an account: a fixed value, kept for 30 days (__Host-sbp_age). One keeps you signed in, for 90 days of not using it or a year, whichever comes first (__Host-sbp_session). None of them is used for anything else, and no other page sets a cookie. Your ticks and helper numbers are kept in the browser's own storage, with or without an account; a browser you signed in on also keeps which player the account syncs, until a page finds you signed out.
• Deleting: "Delete my tracked progress" removes every tick, number and choice the account holds, keeps the account, and also removes them from each browser signed in to the account, the next time that browser opens a page that syncs. "Delete my account" removes the account, the address and everything it holds, at once; if you can't sign in, a link emailed to the account's address does the same. "Download my data" on the account page, and on that link's page, gives you one file with everything the account holds. Database backups keep a copy for up to about 30 days; a deletion is applied again after any restore. Deleting the account leaves the ticks in your browsers, until you clear them there.
• Under 13: accounts are for players 13 and older. If you believe an account belongs to someone younger, write to [email protected] and we delete it.
• Operator access: the site's operator can look an account up by its address and read the address, for support, and for billing if the site ever charges for something; each use is recorded (what was run and when). Nobody else is given addresses.

Questions, or a request about your data? Write to [email protected].