In short. Frost keeps what it needs to run your account, deliver and protect your license, and take payment: your email, your Discord identity, your orders, a one-way hash of your computer's hardware, and short-lived security logs. Frost has no advertising, no analytics trackers and no third-party scripts, and does not sell personal information.
Some data lives outside the website: the license service keeps your license record, and the Frost Discord server keeps its own records. Deleting your website account does not remove those automatically yet. Retention and Account deletion say exactly what stays.
§1 Who is responsible for your data #
Frost ("Frost", "we", "us") runs frostclient.xyz, the Frost client and the services described here. For the data this policy describes, we are the controller: we decide why and how it is processed.
Contact for anything in this policy: open a support ticket in the Frost Discord server, from the Discord account linked to your Frost account where you can. Tickets are kept, so there is a record of your request.
Frost is operated from Lithuania, in the European Union, so the EU General Data Protection Regulation (GDPR) applies to everything in this policy.
§2 What this policy covers #
This policy covers the Frost website at frostclient.xyz, Frost accounts, checkout, the Frost license service the client talks to, the Frost client software, the Frost Discord server and its bot, and the Frost market data service at market.frostclient.xyz.
It does not cover Discord, NOWPayments, Hypixel, Mojang or Microsoft. When you use their services, their own privacy policies apply. See Service providers for the companies that process data for Frost.
§3 What we collect, at a glance #
| Data | Where it comes from | Why |
|---|---|---|
| Email address, password hash, account ID, account status, sign-up and sign-in times, sign-in count, terms version accepted | You, when you register or sign in | Run your account and keep it secure |
| Discord user ID, username, display name, avatar reference; verified Discord email if you sign up with Discord | Discord, when you connect or sign in | Tie your license to you, sign you in, support |
| Orders: order reference, plan, price, currency, payment provider invoice and payment IDs, payment status, timestamps | Checkout and NOWPayments | Take payment, deliver your license, resolve problems, keep financial records |
| License key, tier, issue date, expiry, Discord ID, hardware fingerprint hash, client file hash, first activation time | License issue and the Frost client | Deliver the license and stop sharing, resale and tampered builds |
| IP address | Your browser or the Frost client | Rate limits, abuse prevention, security logs |
| Minecraft name, SkyBlock profile, inventory counts, Bazaar trades, research and coordination events, session times, and public market snapshots while BazaarFlipper runs | The Frost client | Identify your running accounts, show your statistics, coordinate participating macros, and maintain market data |
| Discord server records: rules acceptance, moderation logs, bug reports, monitoring channels | You, inside the Frost Discord server | Run and moderate the community, support |
| Hypixel auction seller and buyer IDs | Hypixel's public API | Market price history (see Market data service) |
We never ask for your Discord password, your Discord messages or contacts, your Minecraft or Microsoft password, or wallet private keys. Anyone claiming to be Frost who asks for those is not us.
§4 Account data #
When you register with email, we store your email address, a random account ID (for example FR-1A2B3-C4D5E), a salted scrypt hash of your password, your account status, when you accepted the terms and which version, when you signed up and last signed in, and how many times you have signed in. We never store your password itself.
If you sign up with Discord, your account email is the verified email on your Discord account, and the account starts without a password. You can set one later.
If you sign in or reset your password with a one-time code sent to your email, we store only a hash of the code for 10 minutes, and send the email through Resend, or SMTP2GO if Resend is unavailable. They receive your email address and the code. When your password changes, we email you a notice through the same providers so you can act if it was not you.
When you sign in, we create a session. We store only a hash of the session token, a security token for forms, and the session's creation, last-use and expiry times. Sessions last up to 30 days and end when you log out, when they expire or when you delete your account.
We do not verify email addresses today. If you register with an address that is not yours, its owner can ask us to remove it.
§5 Discord data #
Frost uses Discord sign-in (OAuth). When you connect Discord or sign in with it, Discord sends us your Discord user ID, username, display name and avatar reference. Discord sign-in also asks for your email address, which we use only to create your account, and only if Discord marks it verified.
We use the access token Discord issues once, to read that profile, and do not store it. We do not request access to your messages, servers you are in, or your contacts.
If Frost turns on automatic server joining, connecting Discord will also ask for permission to add you to the Frost Discord server, and the token is used once for that. This is off today.
Your license is tied to your Discord user ID. Once a license is issued you cannot unlink that Discord account from the Frost account.
§6 Payment and order data #
Crypto checkout is run by NOWPayments, operated by FD Transfers LLC, registered in Saint Vincent and the Grenadines. When you start checkout we send NOWPayments the order reference, the plan description, the price and currency, and the addresses NOWPayments should return you to. We do not send your email, password or Discord profile.
NOWPayments collects what it needs to process the crypto payment directly from you, such as the currency you pay with and the transaction details on the blockchain, under its own terms and privacy policy. Blockchain transactions are public and permanent; neither we nor NOWPayments can delete them.
When you start checkout we record the time you agreed to immediate delivery of the license and offer a text confirmation of that agreement and your order for download to your device. You can download it again from your account. From NOWPayments we receive payment status updates, the payment ID and the amounts expected and received, which we use to confirm your order. We store the order record described in the table above. We never receive or store wallet private keys or seed phrases.
§7 Withdrawal requests #
If you use Withdraw from a purchase, we store your name, email address, order reference and the time we received it, and show you a receipt to keep. We keep it with the order record, because it belongs to the contract.
§8 License and activation data #
Your license is stored by the Frost license service, which runs on Cloudflare. The license record holds the license key, its tier and status, its expiry, the linked Discord user ID, and, after first activation, a hardware fingerprint hash, a hash of the client file and the time of first activation.
Hardware fingerprint. To stop one license being shared across computers, the Frost client reads your motherboard serial number, processor ID, the hardware (MAC) addresses of physical network adapters and the serial number of your system disk, and combines them on your computer into a one-way SHA-256 hash. Only the hash leaves your computer; the raw serial numbers and addresses are never sent. If those values cannot be read, the client uses a random identifier stored in its config folder instead.
File hash. The client also sends a SHA-256 hash of its own file, so the license service can confirm it is an official, unmodified Frost build.
When the client checks in. The client contacts the license service when it needs a fresh activation, which is at least every 72 hours while you use it. Each check sends your license key, the hardware hash and the file hash. Your IP address reaches the service as part of the connection.
Security records. If a known key is used from a different computer or with a file that is not an approved build, the license service records the event: time, type, license key, linked Discord ID, the hardware and file hashes presented, and the IP address. These records delete themselves after 90 days. They are reviewed by a person before any action on your license; see Automated decisions.
On your computer. The client stores your license key, its last signed activation token and an encrypted unlock key in its config folder, readable only by your user account where the operating system supports it.
§9 What the Frost client sends, and to whom #
Apart from the license checks above, the client connects to other services only for features you use:
- Update check. At start-up the client asks GitHub's public API for the latest Frost release. GitHub receives your IP address and the request.
- Hypixel API (optional). If you add your own Hypixel API key, the client sends requests with that key directly to Hypixel. Frost does not receive the key or the responses.
- Album artwork (optional). If you use the now-playing display, the client may download artwork from the web address your media player reports. That site receives your IP address.
- Discord webhooks you configure. Features such as RemoteControl send alerts and screenshots of your game window to the Discord webhook address you enter. They go to whatever channel that webhook belongs to. If you use a monitoring channel in the Frost Discord server, Frost staff can see what is posted there; see The Frost Discord server.
- Bazaar reporting. BazaarFlipper sends required reports while it runs. See the next section.
The client contains reporting code for tester ranks and tamper alerts that would post to Frost's Discord. In current release builds it is switched off and sends nothing. If that changes, we will update this policy before the build ships.
§10 Bazaar reporting #
While BazaarFlipper runs, the client sends your Minecraft name, SkyBlock profile name, inventory counts, claimed trade receipts, session times, research and coordination events, and full public Hypixel Bazaar market snapshots to Frost. Reports include item identifiers, amounts, prices, coins, profit, times, and random session and game-account IDs. The client identifies its license with a SHA-256 hash of the key, not the key itself. Minecraft UUIDs are not sent in these reports. Reporting and coordination are required for BazaarFlipper to trade; turning off the macro stops future reports.
After a successful license check, the client receives a short-lived signed proof containing the license's Discord ID and key hash. When you sign in to the website with that Discord account, reports from multiple computers link to the same Frost account automatically. Your private Bazaar page shows your accounts and lets you give each one a nickname. Authorized Frost admins can see names, profiles, live positions and session totals to manage the service and investigate stalled trading. These details are not public or visible to other customers. Older clients can still link a key manually; the website keeps its hash and last four characters.
Trades and sessions are deleted automatically after 90 days. Live runtime snapshots and candidate plans expire after 7 days without a report; names and profile labels stay until you delete Bazaar statistics or your account. The website keeps sanitized public Bazaar market snapshots and their source-account links for 7 days. Delete Bazaar stats removes your trades, sessions, live records, account names and source links at once; a public snapshot also supplied by another account remains until its normal expiry. Deleting your account removes its Bazaar links and data under the same rules.
§11 The Frost Discord server #
The Frost Discord server is hosted by Discord and run with a Frost bot. Inside it:
- Accepting the disclaimer records your acceptance against your Discord account with a timestamp.
- Deleted and edited messages are copied, with their author and channel, to a staff-only log.
- The bot keeps a registry linking Discord user IDs to license keys for support lookups, and, for members who set up a monitoring channel, to a hardware hash and Minecraft username. Monitoring channels and their screenshots move to an archive when you leave the server, and the registry keeps the hardware binding so the one-account-per-computer rule still applies.
- Bug reports filed with
/bugare posted, with your Discord username, to a forum channel in the server.
Copies of deleted and edited messages are removed from the staff log after 90 days. Archived monitoring channels are deleted 30 days after you leave. Your registry entry and disclaimer acceptance are kept while you are a member and for 12 months after you leave, so the one-account-per-computer rule cannot be dodged by leaving and rejoining. Discord's own privacy policy covers everything Discord stores.
§12 Security and server logs #
- Web server access logs record your IP address, the time, the page requested (including any query string), the response, the referring page and your browser's user-agent string. They are rotated daily and the last 14 days are kept. The Discord sign-in return address is excluded.
- Application logs record the time, the page path, the result and short event codes. They contain no IP addresses, cookies, form contents or passwords, and are kept until the system log reaches its size limit.
- Rate limits count recent requests per IP address and per hashed email address in memory. Counters expire within an hour and disappear when the service restarts. The license service keeps similar counters for up to 2 days.
- Page counts. We count how many times the home page is viewed per day, with no identifier attached.
§14 Why we use your data, and on what legal basis #
Where the EU or UK GDPR applies, we rely on these legal bases:
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account, sign you in | Account, session, Discord data | Performance of our contract with you (Art. 6(1)(b)) |
| Sell and deliver your license | Orders, license record, Discord ID | Contract (Art. 6(1)(b)) |
| Bind a license to one computer and refuse tampered builds | Hardware hash, file hash, IP address, security records | Contract (Art. 6(1)(b)) and our legitimate interest in preventing license sharing, resale and piracy (Art. 6(1)(f)) |
| Keep the service secure, stop abuse, investigate incidents | Logs, rate-limit counters, IP addresses | Legitimate interest in security (Art. 6(1)(f)) |
| Keep payment and order records | Orders | Legal obligation where tax or accounting law requires it (Art. 6(1)(c)); otherwise legitimate interest in handling disputes (Art. 6(1)(f)) |
| Provide BazaarFlipper coordination and your ledger | Bazaar trades, research and coordination events, sessions, and account links | Performance of the BazaarFlipper service you use (Art. 6(1)(b)) |
| Maintain public Bazaar market history | Public market snapshots and short-lived source-account links | Our legitimate interest in improving market data and preventing duplicate or abusive uploads (Art. 6(1)(f)); you can object using Privacy requests |
| Run and moderate the Discord server, answer support | Discord server records, messages to us | Legitimate interest in running a safe community and helping customers (Art. 6(1)(f)) |
| Market price history | Hypixel auction player IDs | Legitimate interest in market data (Art. 6(1)(f)) |
Where we rely on legitimate interests you can object; see Privacy requests.
§15 Who receives your data #
We do not sell personal information and do not share it for advertising. We share it only with:
- the service providers that host and run Frost for us, listed on Service providers;
- Discord and NOWPayments, as described above, which act under their own policies;
- Frost staff who need it for support, moderation or security, on a need-to-know basis;
- authorities or others when the law requires it, or when it is necessary to establish or defend legal claims or to protect people from fraud or harm.
If Frost is sold or transferred, your data may pass to the new operator, who must keep honouring this policy or tell you before anything changes.
§16 International transfers #
Frost's website and Discord bot run on a server in the United States, and the license service runs on Cloudflare's global network. Discord, GitHub and Cloudflare are based in the United States; NOWPayments' operator is in Saint Vincent and the Grenadines. Your data is therefore processed outside your country, including outside the EU and UK.
For these transfers we rely on the safeguards each provider offers: the EU-U.S. Data Privacy Framework where the provider is certified under it, or the European Commission's standard contractual clauses in the provider's data processing terms. SMTP2GO is based in New Zealand, which the European Commission recognises as providing adequate protection.
§17 How long we keep data #
| Data | Kept for |
|---|---|
| Account and Discord data on the website | Until you delete your account |
| Sessions | Up to 30 days, or until you log out |
| Discord sign-in state values (anti-forgery) | 10 minutes |
| Order and payment records | 10 years, the period Lithuanian law sets for accounting records. After account deletion they stay with your account and Discord links removed |
| License record (key, Discord ID, hardware and file hashes) | While the license is valid (a Lifetime license has no expiry), then 12 months after it expires or is revoked. It is not removed when you delete your website account, because it protects the license against sharing and cracking |
| License security records | 90 days, then deleted automatically |
| Bazaar trades, research events and sessions | 90 days, or until you delete them |
| Live Bazaar runtime snapshots and candidate plans | 7 days without a report, or until you delete Bazaar statistics |
| Minecraft account names, profile names and nicknames | Until you delete Bazaar statistics or your account |
| Public Bazaar market snapshots and source-account links | 7 days; your source link is removed if you delete Bazaar statistics |
| Web server access logs | 14 days |
| Application logs | Until the system log's size limit is reached and older entries are removed |
| Database copies taken before each website update | The 3 most recent copies, and never more than 30 days |
| Discord server records | Message log copies 90 days; archived monitoring channels 30 days after you leave; registry entry and disclaimer acceptance 12 months after you leave |
| Withdrawal requests | 10 years, with the order record |
| Support tickets and messages you send us | 2 years after your request is closed |
| Email sign-in codes | 10 minutes |
§18 Your rights #
Depending on where you live, you may have the right to access your data, correct it, delete it, receive it in a portable format, restrict or object to how we use it, and withdraw consent you have given. Where the EU or UK GDPR applies, you have all of these rights, subject to the limits the law sets.
Some US state privacy laws give similar rights to know, delete and correct, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those laws define it.
Privacy requests explains how to make a request, how we confirm it is you, and how long we take. We will not treat you differently for using these rights.
§19 Deleting your account #
You can delete your account yourself from the account page. Account deletion lists what is removed immediately and what remains.
§20 How we protect data #
We use HTTPS everywhere, store passwords and session tokens only as hashes, protect forms against cross-site request forgery, verify every payment notification cryptographically, and keep the client's hardware data on your computer as a hash. The Security page lists the controls we run and the ones we do not claim. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the authorities where the law requires it.
§21 Automated decisions #
The license service decides automatically whether an activation succeeds. It refuses activation when a license is revoked or expired, when it is already bound to a different computer, or when the client file is not an approved Frost build. A refusal stops the client from running on that computer.
We do not revoke a license automatically. A person reviews the security records before a license is revoked or an account is suspended. If you think an activation was refused wrongly, for example after replacing hardware, contact us and a person will review it and can move your license to the new computer.
We do not use your data for profiling, advertising or credit decisions.
§22 Children #
Frost is not meant for children. You must be at least 18 to create an account or buy a license. If we learn that we hold data from someone below that age, or from a child under 13 without verified parental consent, we will delete it. If you believe a child has given us data, contact us.
§23 Market data service #
market.frostclient.xyz collects Hypixel SkyBlock Auction House and Bazaar data from Hypixel's public API to build price history. Hypixel's auction records include the Minecraft account IDs (UUIDs) of the seller and buyer, and the service stores them with each sale. It does not collect names, and it does not connect these IDs to Frost accounts.
The Frost website also receives public Bazaar snapshots from BazaarFlipper while it runs. Those snapshots do not include auction buyer or seller IDs. The website keeps a short-lived link to the reporting Frost account so you can remove your contribution; see Bazaar reporting.
If you play Hypixel SkyBlock, your auction sales may be in this data even if you have never used Frost. You can ask us to remove records linked to your Minecraft account ID using Privacy requests. Database backups of this service are stored in a Google Drive account controlled by the operator.
§24 Changes to this policy #
When we change this policy we update the date and version at the top. If a change affects how we use data you have already given us, we will announce it on this site and in the Frost Discord server before it takes effect, and ask for consent where the law requires it.
§25 Questions and complaints #
Contact us first in a support ticket in the Frost Discord server and we will try to fix it. If you are in the EU or UK, you can also complain to your local data protection authority, or to the authority where Frost is established, which is the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt). In the UK that is the Information Commissioner's Office.