Last updated 21 October 2026 · version 2026-10-21
This policy explains what personal information Sparrow ("we", "us") collects when you use the Sparrow website at sparrow-client.com, the Sparrow launcher and the Sparrow client (together, "the Service"), why we collect it, and what you can do about it. We are based in New Zealand and follow the Privacy Act 2020 and its information privacy principles.
| Where | What | Why |
|---|---|---|
| Your account | Email address, display name, your role and plan, when you signed in, your theme and update preferences, and the version of these terms you accepted and when. Your password and authenticator codes are handled by our sign-in provider (Amazon Cognito); we never see or store your password. | To give you access, keep your account secure and record your agreement. |
| The launcher | A random install ID it makes on your computer, the build version it installs, and the time of each update check. If you use the older Minecraft-username launcher, your Minecraft username and UUID. | To deliver the right build to the right account and to know which installs belong to which tester. |
| The client: usage stats | For each macro run: which macro, how long it ran and how it ended; and how long the game session lasted. Sent with the install ID and the build version. | To see what works, what fails and what to fix during the beta. |
| The client: crash reports | When Sparrow hits an error: where it happened, the error message and the program stack trace. User folder names are replaced with "<user>" before sending. From a Minecraft crash report we take only the error and its stack trace, never the rest of the report. | To find and fix bugs. |
| The client: kill-switch check | The build version, to ask which macros are switched off for it. No account or install ID is sent with it. | To switch off a macro quickly if a build turns out to be unsafe. |
| Support and Discord | What you write to us through the support form. If you link Discord or verify in our Discord server: your Discord ID, username and avatar, and the access tokens Discord gives us when you approve the link. The tokens let us see your Discord ID and add you to the Sparrow Discord server; they give us no access to your messages, other servers or password. | To answer you, to give you access to our Discord, and to add you back to the server if it ever has to be rebuilt. |
| Security records | Our servers log each request's IP address and technical details. The older Sparrow loader also records a device identifier (stored as a salted hash on your account) and, if it sees tampering, the device identifier and IP address with the event. | To keep the Service and other users secure and to stop abuse and cracked copies. |
The Service runs on Amazon Web Services in the United States (us-east-1). AWS stores and processes the information for us and may not use it for anything else. Sign-in is handled by Amazon Cognito, and emails (such as verification codes) are sent with Amazon SES.
Discord access tokens are kept, encrypted, by the Sparrow Discord bot, and are used only to add you to the Sparrow Discord server.
Security alerts about tampering with the Sparrow loader, which can include an account email, a device identifier and an IP address, are posted to a private channel on Discord (United States) that only the Sparrow team can read.
These overseas providers are bound by their own privacy and security commitments. We do not sell personal information and we do not share it with advertisers. We disclose it only if the law requires us to.
Traffic is encrypted (HTTPS). Stored data is encrypted at rest by AWS, and files and secrets with encryption keys we manage in AWS KMS. Staff accounts need an authenticator app. Access is limited to what each part of the Service needs. No system is perfectly secure; if a breach is likely to cause you serious harm, we will tell you and the Privacy Commissioner as the Privacy Act requires.
The website uses only the cookies it needs: a sign-in session cookie, a short-lived cookie during sign-in, and a cookie that tells the site you are signed in. There are no advertising or tracking cookies.
The Service is only for people aged 18 or over, and we do not knowingly collect information from anyone younger. If you think someone under 18 has given us their information, tell us through the support form and we will delete it.
If we change this policy, we will update the date and version above. If a change affects what we collect or how we use it, the launcher will ask you to read and accept the new version before the next download.
Sparrow, New Zealand. For any privacy question or request, use the support form and choose "Account & access".