SourClient — Privacy Policy
Effective date: 2026-07-22 Operator / data controller: sourama (an individual, New Zealand) Contact: [email protected] Official site: https://sourclient.com
This policy describes what the SourClient launcher, game-side mod, and backend actually collect and do with it. It is written against the real code paths (audited 2026-07-11); nothing is collected beyond what is listed here.
1. What we collect and why
1.1 SourClient backend (cape sync / accounts) — data sent to sourclient.com
| Data | Where it comes from | Why | Stored? |
|---|---|---|---|
| Minecraft UUID and username | Sent by the launcher/client when you sign in to the cape service (/auth/begin, /auth/complete) | Proving you own the Minecraft account (via Mojang's join-server handshake) and keying your cape to your player | Yes — in short-lived auth challenges, in signed session tokens, and as the filename of your cape (<uuid>.png) |
| IP address | Automatic on any connection | Rate limiting (abuse prevention) and server logs | Transiently in memory for rate limiting; may appear in server logs |
| Cape image you upload | You | Displaying your cape to you and other SourClient users | Yes — until you delete or replace it |
| Session token | Minted by the backend after Mojang verification | Keeping you signed in (expires automatically) | Signed token held by your launcher; secret key on the server |
Authentication works by the standard Minecraft server-join handshake: the backend asks Mojang's session server to confirm your account performed the join. We never see or store your Microsoft/Minecraft password or Microsoft access token on the backend.
Anyone using SourClient can query whether a given UUID has a cape and fetch that cape image (GET /cape/<uuid>.png) — that is how capes are shown to other players. Your cape image and its association with your UUID are therefore public to other users while set.
1.2 Launcher (on your device)
- Your Microsoft sign-in uses Microsoft's device-code flow. Tokens issued by Microsoft (access/refresh tokens, XUID, UUID, username) are stored locally on your device in the launcher's data folder so you stay signed in. They are sent to Microsoft/Xbox/Mojang services to authenticate you — never to our backend.
- Launcher settings, instances, playtime tracking, logs, and diagnostics are stored locally on your device and are not uploaded.
1.3 Optional third-party integrations (off by default, your own API keys)
- Hypixel API stats overlays: if you enable them and supply your own Hypixel API key, the client sends other players' UUIDs/usernames to Hypixel's API and displays the responses. Governed by the Hypixel API Policy (https://developer.hypixel.net/policies/). Responses are cached in memory only. Your API key stays in your local config file.
- Urchin.ws tags: if you opt in and supply your own Urchin API key, the client sends player UUIDs/usernames you encounter to urchin.ws and displays returned tags. Your key stays in your local config; it is never logged or transmitted to us.
- Mojang/Microsoft services: the launcher downloads game files from Mojang servers and authenticates via Microsoft; those services see your IP and account data under their own privacy policies.
1.4 What we do NOT collect
No email addresses, no real names, no passwords, no payment card details (payments, if introduced, will be handled by a third-party payment provider such as Lemon Squeezy under their own policy), no telemetry/analytics, no advertising identifiers, no behavioural profiling.
2. Legal bases and applicable law
sourama operates from New Zealand, so the Privacy Act 2020 and its 13 Information Privacy Principles apply (https://www.privacy.org.nz/privacy-act-2020/privacy-principles/) — including collecting only what is necessary (IPP1), security safeguards (IPP5), access and correction rights (IPP6–7), retention limits (IPP9), and controls on cross-border disclosure (IPP12).
For users in the EU/UK, the GDPR/UK-GDPR may apply to the backend service (https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations_en). Our legal bases are: performance of a contract (operating the cape/account service you request) and legitimate interests (rate limiting, abuse prevention, security logging).
3. Children
SourClient is not directed at children under 13, and the backend does not knowingly collect personal information from children under 13. Minecraft UUIDs, usernames, and IP addresses can be "personal information" under the US COPPA rule (see the FTC's COPPA guidance, https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa — persistent identifiers such as IP addresses count). If we learn that a child under 13 has created backend data, we will delete it. Parents/guardians can contact [email protected] to request deletion. Purchases (if introduced) require parent/guardian involvement as described in the Terms of Use.
4. Sharing
We do not sell or rent personal information. Data is shared only:
- with Mojang (session server) to verify account ownership during sign-in;
- with other SourClient users, limited to: your cape image and the fact that your UUID has one;
- with infrastructure providers hosting the backend (Oracle Cloud Infrastructure, in Australia, and Cloudflare as CDN/proxy) acting as processors — this is also the cross-border disclosure for NZ Privacy Act IPP12 purposes: backend data is stored in Australia, a jurisdiction with comparable privacy safeguards (the Australian Privacy Act 1988);
- if legally required (e.g. a valid legal demand).
5. Retention
- Auth challenges: minutes (single-use, expired entries swept).
- Session tokens: expire automatically (hours; the token TTL is enforced server-side).
- Cape images: until you replace or delete them, or until removed by moderation.
- Rate-limit records: minutes, in memory.
- Server logs (which may include IPs, UUIDs, usernames): rotated and kept no longer than 90 days.
6. Your rights
You can, at any time:
- See your data: your backend data is your cape image + username/UUID association — fetchable directly (
GET /cape/<your-uuid>.png). - Delete your data: delete your cape from the launcher (DELETE endpoint) or email [email protected] from a verifiable channel and we will remove your cape and any associated records.
- Correct your data: usernames come from Mojang; change your name there and it propagates on next sign-in.
- Complain: in NZ, to the Office of the Privacy Commissioner (privacy.org.nz); in the EU/UK, to your local supervisory authority.
7. Security
Backend transport is HTTPS. Session tokens are signed with a server-side secret. Cape uploads are validated (PNG structure and fixed dimensions) and size-limited. Rate limits apply to auth and upload endpoints. No password database exists to breach. If a data breach occurs that risks serious harm, we will notify affected users and the NZ Office of the Privacy Commissioner as required by the Privacy Act 2020.
8. Changes
Changes to this policy will be announced via the launcher and/or sourclient.com. The current version always lives at sourclient.com and in this repository.
9. Contact
sourama — [email protected]