Clear rules.
Respect for your data.

01 / TERMS OF SERVICE

Using Wisp responsibly.

Who provides the service

WispClient is operated by Oscar. It is this software project’s public name, not a claim that it is an incorporated company. Contact wispclient@gmail.com for software, privacy and licence support. Stripe Managed Payments identifies the transaction merchant at checkout. You can also contact staff through the WispClient Discord. Never post passwords, licence keys or personal identification publicly.

What is available

The current development client provides a client-side companion, appearance controls and menus for Minecraft Java 1.21.11 with matching Fabric dependencies. The website provides accounts, licence claims, staff-approved installation resets and optional Discord linking. Planned AI conversations, voice and task automation are not included merely because they appear on a roadmap. The client is private and unreleased. No client files are available to the public. Licences are available to preorder; receiving a key does not provide access to the unreleased client.

Your account

Use accurate account details, confirm your email and keep your password and licence credential private. Do not sell, share or impersonate accounts, misuse another person’s key, scrape personal data, evade access controls or interfere with the service. Tell staff privately if you suspect account compromise. Meet the age and account requirements of Minecraft, Discord and any other service you use; you must be legally able to make the purchase and meet your payment provider’s requirements.

Changes, restrictions and outages

Development features can change or be unavailable. We may restrict requests or suspend access to investigate abuse, fraud or security risks. Staff should give a reason and a reasonable way to raise a concern where doing so is safe. No uninterrupted availability or ban-proof behaviour is promised. Material commercial changes require clear notice and review of affected customers’ rights; buying a product must not be treated as consent to any future change.

Your legal rights remain

Nothing here removes rights or liabilities that applicable law does not permit us to exclude. A general disclaimer cannot excuse unlawful conduct, negligent security or misleading product claims. Final governing-law, dispute and liability clauses require operator/legal review; none is invented here.

02 / PRIVACY NOTICE

What the service actually processes.

Contact WispClient at wispclient@gmail.com for privacy questions. This notice describes the implemented data flows and is not a certification of legal compliance. Do not send sensitive documents through public Discord channels. Ask staff for a private route for access, correction, deletion or other privacy requests.

Data and purposes

• Accounts: Supabase Auth handles email, password authentication, confirmation and session credentials. Passwords are not stored in this website’s source or application licence tables. Authentication providers may process IP addresses, browser metadata and security logs.
• Licences: we store a hash of each key, a short hint, its owner, plan, issue/activation/expiry/revocation timestamps and verification metadata. The client sends its full key over HTTPS for verification. Staff-issued keys are hash-only; purchased keys also have an encrypted recoverable copy, available through the verified owner’s dashboard. Purchase records include the payment environment, order/payment identifiers, amount and status.
• Purchase email: a trusted worker sends the verified buyer an order/key email through our signature-protected IONOS mail relay. Delivery status and retry counters are stored; the relay’s duplicate-delivery file stores only its job ID/status outside the public folder, not the address or key. Your email provider processes the delivered message, which contains your private key. An accepted status means acceptance by the sending mail server, not proof of inbox delivery.
• Device binding: this build uses a hashed per-installation identifier, not physical hardware serial numbers. Reset requests include the target identifier, an optional reason, status and decision metadata. Do not include passwords, raw serial numbers or unnecessary personal information in a reason.
• Discord, if linked: we store the authorised Discord account ID, display name, link/status timestamps and role-check results to manage Wisp+. We request identity access, not messages or email. OAuth user access tokens are not stored; revocation is attempted after identity lookup.
• Abuse prevention: the application records fixed-window counters keyed by a one-way digest of the account, licence or global bucket. This limiter does not store IP addresses or raw credentials. Separate hosting/Auth services may keep their own security logs.
• Audit: licence and linking operations record the relevant account, event and time for support and investigation. Staff access is restricted in the database.

Providers and disclosures

IONOS serves the uploaded website. Supabase provides Auth, the application database and backend functions; the selected database region is eu-west-1. Discord handles optional authorisation, community membership and role operations. A region setting is not a promise that all provider processing stays in one country. The operator must review supplier agreements, subprocessors and international-transfer safeguards before finalising this notice. No advertising analytics, data sale or marketing tracker is implemented in this website code.

Basis, retention and deletion

Proposed purposes include account/licence service delivery and legitimate interests in security and abuse prevention. The operator must confirm the appropriate lawful bases and any required assessments rather than treating every action as consent. Discord linking is optional and can be unlinked.

OAuth proofs expire after 10 minutes and the scheduled worker cleans up expired proofs. Rate counters expire after their window plus one hour and are purged by an hourly task. A Discord link is cleared after requested role removal or confirmed absence; link/unlink audit events remain. No automatic customer-account, licence, reset or audit retention period has been configured. The operator must approve a proportionate schedule and deletion process, including backup/provider log retention, before claiming one is in place.

Your choices and rights

You can review your own licence/reset data in the dashboard and unlink Discord there. Requests for access, correction, erasure, restriction, portability or objection should go privately to the operator; availability depends on applicable law and the processing involved. In particular, you can object to processing based on legitimate interests. Necessary identity checks must be proportionate, not a reason to demand unnecessary documents. You may raise data-protection concerns with the UK Information Commissioner’s Office. A final notice must provide a direct contact method and applicable response procedures.

03 / COOKIES & STORAGE

No advertising banner theatre.

The application uses tab-scoped sessionStorage for the signed-in session and a temporary Discord-link verifier. These are functional authentication/security storage, not marketing preferences. Signing out clears the local session; completing linking clears its verifier. The website code does not add analytics, advertising cookies or third-party font scripts. Hosting and linked services have their own behaviour and notices.

There is no non-essential tracking-consent system because no such tracker is implemented. If analytics, advertising or optional tracking is added, its legal basis, consent behaviour and disclosures must be assessed before loading it. A privacy notice is not itself a request for blanket consent.

04 / PURCHASES & REFUNDS

Know what you are buying.

One month costs £7.99 before applicable tax and provides one calendar month from first activation in Minecraft. Lifetime costs £14.99 before applicable tax and lasts while WispClient operates. Both are one-time purchases without automatic renewal. Stripe shows the final tax-inclusive total before payment; local-currency conversion and its pricing may be offered by Stripe.

Sign in, verify your email, select a plan, review these terms, then continue to Stripe to review and pay. Correct your plan before paying or leave checkout without payment. After signed payment confirmation, your key is available under Dashboard → Orders and an email is queued. Returning from checkout alone does not prove payment. The client is unreleased and no downloads are available. Minecraft Java 1.21.11, Java 21, Fabric Loader and matching Fabric API are required; internet access is required for licence verification.

Voluntary refunds and your legal rights

Lifetime preorders are eligible for a voluntary refund if requested within seven days of purchase. One-month preorders do not include a voluntary change-of-mind refund. These commercial limits do not restrict any statutory cancellation, non-delivery, faulty-content or misdescription rights, or Stripe Managed Payments consumer protections. A licence key alone is not a client download and does not automatically waive your cancellation rights. Where a statutory cooling-off period applies, it takes precedence over this voluntary policy. Contact us promptly with your order ID; do not send your full key or password.

For software, cancellation or refund support, email wispclient@gmail.com with your order ID, not your password or full key. For payment support, also use the merchant details and receipt supplied by Stripe Managed Payments. We do not apply a blanket “no refunds” policy or automatically treat access/download as a waiver of statutory cancellation rights. Faulty or misdescribed digital content remains subject to applicable consumer remedies. Full refunds or payment disputes disable the associated licence and its Discord eligibility; another valid licence retains eligibility.

The development prototype contains the companion, appearance controls and menus. Your preorder is for client access after release; there is no current public download. AI conversations, voice and autonomous tasks are planned, not purchased features. No uninterrupted service, future release date or protection from Minecraft-server moderation is promised. See UK online-selling guidance. Your statutory rights are not restricted by these terms.

05 / CLIENT LICENCE & FAIR USE

Your companion, within the rules.

A valid released-client licence is required for activation and recurring online verification. An account alone grants no client access. Keys and installation identities are credentials: do not redistribute them. This development implementation is not unbreakable DRM and does not collect raw hardware serial numbers.

A monthly licence expires one calendar month after first activation. Lifetime means access for as long as WispClient operates. It does not mean the purchaser’s lifetime, perpetual server operation, or a promise of planned features. The licence has no fixed database expiry while the service operates. Device resets require staff approval and a seven-day cooldown after approval. Approval binds the exact requested new installation; the old binding is rejected at its next check. Back up your own worlds before testing development mods.

Optional Wisp+ syncing applies to linked Discord accounts with at least one valid owned licence. Signup or joining alone does not grant it. Revocation/expiry removes eligibility only when no other valid licence remains. Unlinking queues role removal without revoking the Minecraft licence. Checks and third-party outages may delay Discord changes.

Follow Minecraft’s terms and each server’s rules. Use automation or competitive features only where you have permission. A ban-risk warning does not make prohibited use acceptable or override another service’s terms. No protection from moderation or account bans is guaranteed. WispClient is not affiliated with or endorsed by Mojang, Microsoft or Discord.

06 / SECURITY & REPORTING

Layers, not guarantees.

The backend uses live authentication, session existence checks, ownership/staff checks, private deny-by-default tables, bounded JSON requests, explicit origin rules and server-enforced quotas. Discord linking uses expiring one-use proofs and an independent browser-held verifier. Secrets are server-side; the public Supabase key is not an administrative credential.

The upload includes browser content restrictions and an Apache header configuration for HTTPS, clickjacking protection, MIME handling, referrer minimisation and directory-listing protection. These server controls only apply once correctly uploaded and verified on the host. They do not replace patching, account MFA, backups, incident response or independent review. No system is guaranteed secure, and these changes are not a penetration-test certificate.

Report a concern privately

Contact staff privately through the WispClient Discord and ask for a security-report route. Give a brief description and only the minimum evidence needed; redact tokens, keys and other people’s data. Do not test accounts or systems you do not own, run denial-of-service tests, retrieve other users’ data or publish unpatched sensitive details. Report security issues privately to wispclient@gmail.com. No bounty or legal safe-harbour promise is made by this draft.

Sources for this review: ICO privacy information and OWASP security headers.