Privacy policy

Last updated 26 October 2026

Who we are

SMP Pass (smp-pass.com) is run by was1max in the United Kingdom, and is the controller of the data below. Contact: [email protected].

What we collect, why, and our legal basis

When you log in with Twitch we store your Twitch ID, name and profile picture, and encrypted Twitch access tokens. The tokens have three read-only permissions (user:read:subscriptions, user:read:moderated_channels, user:read:follows) that we use only to check whether you subscribe to, moderate or follow the streamer whose page you are using. If you log in with Kick we store your Kick ID, channel name and profile picture, but no Kick tokens. A streamer who connects their Kick channel gives us permission to receive its subscription events, and we store the encrypted tokens for that. If you link your Twitch and Kick logins in the Dashboard, we store a random account reference that ties the two together, so either login opens the same Dashboard; you can unlink them at any time. Profile pictures are loaded from Twitch (static-cdn.jtvnw.net) and Kick (files.kick.com), so those services can see that your browser fetched them. We also store the Minecraft username and ID you link, whether you qualify, your whitelist history, and wheelspin attempts. Streamers also give us their page settings and lists. The Minecraft server plugin sends its version and player counts. We briefly use your IP address to limit abuse.

We use this to run the service you asked for (contract) and to keep it secure and fair (legitimate interests). We do not collect your email address, password or payment details, and we do not sell your data or use it for advertising.

Providing this data is needed to use the service. Whether you are whitelisted is decided automatically from your Twitch or Kick subscription status and the streamer's rules; you can ask for a person to review it.

Who receives it

The streamer whose page you use (and their editors) and their linked Minecraft server see your Twitch name, Minecraft account and whitelist status. Our service providers also process data for us: Twitch (login and checks), Kick (login and subscription events, only if a streamer uses Kick), Mojang/Microsoft (confirming Minecraft usernames), and our hosting and network providers (Hetzner and Cloudflare). Some are outside the UK and EEA, including the United States, under recognised safeguards such as standard contractual clauses.

Cookies

Only strictly necessary cookies: smp_session (keeps you logged in, up to 30 days) and smp_oauth_state and smp_kick_oauth (protect the Twitch or Kick login, 10 minutes). No analytics or advertising cookies.

How long we keep it

Until you delete it. Whitelist history is kept for 90 days. Abuse-limiting counters last minutes. A streamer's data is deleted when they delete their page. We keep nightly backups of our database for a limited time, so deleted data can remain in a backup until it is replaced. Server logs are kept only briefly for security and fixing faults. After you delete your data we keep only wheelspin attempt records (linked to your Twitch ID) so cooldowns can't be reset.

Your rights

You can ask us for access to, correction of, deletion of, restriction of or a copy of your data, and object to our use of it. To delete everything yourself, use Delete my data on any streamer page while logged in; you can also withdraw our Twitch access at twitch.tv/settings/connections, or Kick access in your Kick account settings. Contact us for anything else. You can complain to the UK Information Commissioner's Office (ico.org.uk).

Children

You need a Twitch or Kick account, so the service is not for children under 13. We do not knowingly collect their data.