Privacy
Updated 8 October 2026
SkyBlock Atlas helps players explore SkyBlock profiles, market data and calculators. This page explains how the website handles information.
Browsing and player lookups
You can use public tools without signing in. Player searches request publicly available Minecraft and Hypixel data. Profile data can be cached briefly to reduce repeated requests. Searching a player does not verify that you own that Minecraft account.
A profile you are viewing has its own address, of the form /player/ followed by the in-game name, so you can link it or send it to someone. That name is public information the game already publishes. To describe the page before it loads, the site keeps the looked-up name, the player's SkyBlock level and the profile name for up to a day, and deletes them after thirty days without a visit. It is a cache of public game information and is not connected to any account. It does appear in your browser history and in the address bar, and anyone you send the link to sees the same public profile you did. Player pages are not offered to search engines. Your own account, your email address and the identifier of any profile you have saved never appear in an address.
Website sign-in and saved accounts
When Google sign-in is available and you choose it, we receive your Google account identifier, email address and display name to create and recognise your website account. We do not request access to your Gmail messages, Drive files or contacts. Account details and saved player selections are associated with your account and are not published as a public user directory.
If you choose Microsoft sign-in, we request only the basic sign-in permission and use your Microsoft account identifier to recognise your website account. We do not request your Microsoft email, display name, messages, files or contacts, and do not retain provider tokens. Different sign-in methods start as separate website accounts. You can link them from your signed-in account by proving access to the other method and confirming the account review. We do not combine accounts based on matching email addresses. After linking, either method returns to the same website account. Microsoft website sign-in alone does not verify Minecraft ownership.
When email sign-in is available, Google Firebase Authentication handles your email address, password, verification and password-reset messages. Passwords go directly to Firebase and are not sent to or stored by the SkyBlock Atlas server. We require a verified email address and store the Firebase account identifier and email privately to recognise your website account.
Combining existing accounts shows a review before anything is moved. You can choose which saved player selection to keep when both accounts have one. Eligible premium access and verified Minecraft links are preserved; conflicting links and protected administrator accounts may require resolution first. Previous sessions end after confirmation. Private merge records retain the original saved information so the change can be investigated if needed.
A secure session cookie keeps you signed in for up to seven days. Temporary sign-in cookies expire after ten minutes. Signing out ends the current session. Preferences and calculator settings may also be stored in your browser; you can clear them using your browser settings. When you are signed in, the things you save on the site (pinned pages, sidebar layout, calculator settings and saved layouts, checklists, timers and your watchlist) are also stored with your account so they are available on your other devices.
Minecraft account verification
In-game verification uses a short-lived code that you temporarily put in your Hypixel Discord social-link field. We read that public field from Hypixel to confirm control of the Minecraft profile. We do not sign in to Discord, store your Discord name or save the returned social profile. The challenge code and current session are stored as hashes, bound to the requesting account, and expire after ten minutes. Expired challenges are cleared when new verification requests are created. This method proves control of the in-game profile; it does not check a paid Java license.
When the separate Microsoft verification method is available and you choose it, Microsoft handles your sign-in. We use temporary Microsoft, Xbox and Minecraft access tokens to check the authenticated Java profile and its current play entitlement. We do not ask for your Microsoft password, email, contacts or messages, and we do not retain provider access or refresh tokens.
A successful check saves the Minecraft UUID, player name, verification method and verification time to your existing website account. This confirms the account checked at that time; it is not a permanent game-license guarantee. Only one website account can hold a verified Minecraft link. Temporary verification requests expire after ten minutes and are bound to the browser session that started them.
You can remove your verified Minecraft link from the account menu. This removes the verified association and cancels pending verification attempts without deleting your saved player selection, website account or premium access. Returning to an interrupted verification requires a fresh check. Linking a Minecraft profile does not grant administrator or premium permissions.
Optional desktop notifications
If you enable desktop notifications, we keep a browser push subscription, your chosen reminders and any timer reminders with your account. Your browser provider delivers encrypted notification messages, which may appear on your computer even with the Atlas tab closed. Notification text can include your chosen timer name or watched item. Turn notifications off in Calendar & mayors or Watchlist, or in your browser settings. Signing out turns off notifications for that browser. Expired subscriptions are removed when delivery fails; delivery records are kept for eight days and finished timer reminders for one day.
Visitor statistics
The website records daily totals for visits and page views, grouped by named public tools. A visit starts in a browser tab or after thirty minutes without a recorded page view. A temporary session-storage timestamp distinguishes continued browsing from a new visit.
To estimate unique visitors, the server processes the connecting IP address and browser user-agent string into a site-specific keyed hash. Only the hash and day are retained, never the raw IP address or browser string. These records are not linked to accounts or player searches and use no tracking cookie. Shared networks may combine visitors; different networks, devices or browsers may count someone more than once. The result estimates visitors, not verified individual people.
We do not include account identifiers, searches, referrers or full URLs in visitor records. Do Not Track and Global Privacy Control are respected, and known bots are excluded. Daily aggregate and hashed visitor records are retained for up to ninety days and are visible only to the site owner. Unique estimates start when their collection begins; earlier traffic cannot be reconstructed. Blocking and unrecognized automation can affect counts.
Premium payments
Premium is an optional subscription. Stripe handles the payment. When you start a subscription you are sent to a page hosted by Stripe, and your card details go directly to Stripe. The SkyBlock Atlas server never receives, sees or stores your card number, and it never handles the payment itself.
To create your customer record, Stripe receives the email address on your website account. From Stripe we keep only what the site needs to know whether your access is active: a Stripe customer identifier, a subscription identifier, the subscription status and the date the current period ends. We do not store card numbers, expiry dates, billing addresses or invoices. Invoices and payment history live in Stripe, and the billing page you reach from your account is hosted by Stripe.
Stripe processes this information as its own controller under its privacy policy, including for fraud prevention. Cancelling a subscription ends future payments; the subscription record is kept so past access can be explained if a question comes up later.
Discord links and feedback
If you link Discord, we store your Discord account identifier and when it was linked so we can manage server roles and private support tickets. When you send a bug report, your feedback text is shared in the community Bug reports channel in the Atlas Discord server. Suggestions are shared in the community Suggestions channel under your Discord name. Your website email, sign-in tokens and saved profile data are not attached. Feedback posts are visible to members who can access their Discord channel. Support requests create private tickets visible to you and staff. Closing a ticket saves a transcript for staff before the channel is removed. Discord processes the messages and attachments under its own privacy policy.
Hosting and service providers
Cloudflare hosts the site and its database and processes technical request information needed to deliver, protect and troubleshoot the service. Google and Microsoft handle their respective website sign-in options; Google Firebase handles email sign-in when it is available. Microsoft and Xbox also handle the separate optional Minecraft verification flow. Minecraft and Hypixel services provide player and game information. These providers handle requests under their own privacy policies.
SkyBlock Atlas does not use advertising trackers or sell your account data. Market history contains game prices and auction information.
Keeping and removing information
Saved account information is kept while it is needed to provide your account. You can remove a saved player connection in the account tools. To request access to or deletion of your website account data, contact the site support address below; we may need to verify that the account belongs to you. Public game information is controlled by its original provider, and searching it again may retrieve it again.
Contact
Privacy and account requests: skyblockatlas@gmail.com.