What the portal uses
The portal uses the minimum information needed to sign you in, check member eligibility, connect a verified Minecraft account, and return a normalized private profile.
- Clerk processes Discord's
identifyandemailOAuth scopes for sign-in. Bumble's own database stores only the minimized Clerk-to-Discord identity binding needed for account and eligibility checks. - A verified Minecraft UUID link and the SkyBlock profile you select.
- Supported current-state SkyBlock fields, freshness, and explicit hidden or unavailable-data states.
- An opaque browser-session identifier in a secure, HTTP-only cookie.
- If you explicitly publish a portfolio, only its selected normalized fields, freshness, and expiry—not your Discord ID or Minecraft UUID.
When player data is read
Bumble reads a player's current SkyBlock state only after an eligible member explicitly invokes Discord /profile or /coach, or uses the portal's visible Load current state, profile-selection, or Refresh current state action. Bumble does not schedule player reads or build progression or session history.
Opening a page, returning to a tab, or reconnecting does not authorize another Hypixel player read. A visible member action is required.
Where authority lives
The Python application owns identity, eligibility, linking, profile, quota, and privacy decisions. Discord access tokens and raw Hypixel player payloads are not stored in browser localStorage.
Current retention
- Pending sign-in
- Pending Discord OAuth sign-in flows expire after 10 minutes.
- Portal session
- Portal sessions expire after 24 hours without activity and no later than 7 days after sign-in. A browser can keep the same session across safe single-machine development restarts when it returns to the same origin.
- Current SkyBlock state
- A requested raw current-state response is reusable for at most 5 minutes. The same response may be retained and served as a degraded fallback for at most 15 minutes. Bumble does not archive current-state responses as history.
- Account link
- The minimum Discord-to-Minecraft mapping persists until you use the confirmed unlink flow or ask Bumble staff to remove development data.
- Public portfolio
- An explicitly confirmed public portfolio contains only the fields you selected, expires after 7 days, and is replaced or removed immediately when you publish again, revoke it, unlink, or confirm account deletion. Bumble stores only a keyed digest of its opaque URL token.
Your controls during development
Run /privacy export in the Bumble Discord bot for a private, narrow export of your persisted Discord-to-Minecraft link, manual Coach goal, and selected public-portfolio projection, if present. It never exports the portfolio URL secret and does not enumerate sessions, current-state caches, operational logs, or backups; the portal does not host this control.
Run /privacy delete in the Bumble Discord bot and confirm to request deletion of your Discord-to-Minecraft mapping, current manual goal, current public portfolio, current portal sessions tied to your identity, and attributable requested current-state caches. The portal does not host this control.
This deletion does not cover third-party Discord, Hypixel, Minecraft, Mojang, or Microsoft data; logs or backups; browser-rendered content; or pending Discord OAuth flows that are not attributable to your Discord ID.
Complete cross-feature retention and deletion verification remain unfinished. Contact Bumble staff in the Bumble community server if a control fails or you need a privacy request reviewed.
Sharing
Member profiles remain private. In development, you can review a fixed allowlist of normalized fields, then separately confirm one public portfolio. Its opaque URL expires after seven days. Publishing again replaces the previous URL; revoke, unlink, and confirmed account deletion remove it immediately.
Anyone with the URL can view that selected projection until it expires or is removed. Public views perform no Hypixel read and disclose neither your Discord identity nor Minecraft UUID.