Privacy.

Account & sign-in. You can sign in three ways, and we only ever receive what that provider hands us:

— Roblox (OAuth): your Roblox user ID, username, display name, and avatar image. We also check whether you belong to our Roblox group, but this is only a usage signal — it does not gate access.
— Google (OAuth): your Google account ID, your email address (if Google has verified it), your name, and your profile picture.
— Email (passwordless link): just your email address.
We never receive or store a password — sign-in is either a one-time link or delegated to Roblox or Google.

Session data. We set an HTTP-only session cookie to keep you signed in and store a corresponding session record (an opaque session ID and its expiry) in our database. This cookie is strictly necessary for the service to function.

Usage analytics. We keep first-party, in-house analytics to understand how the product is used: events such as page views (the path only — query strings are stripped), referrer, sign-ins, and which tools you use (for example saving or searching a game), associated with your account. This stays on our own infrastructure.

Visit measurement. Whether or not you have an account, we record that a browser carrying the random rt_vid identifier visited on a given day, and which version of the home page it was shown. That is the whole record: an opaque identifier and a date. We use it to count returning visitors and to compare home-page versions. It is never linked to anything you did not give us, and if you later create an account we connect the two so we can tell whether the page you saw was any good.

Session replay and heatmaps. We also use Microsoft Clarity, a third-party analytics service, on the pages of this site. It records how pages are used — clicks, scrolls, mouse movement, and which pages you move between — and replays that back to us as session recordings and heatmaps, so we can see where the interface confuses people. It runs whether or not you are signed in.

Operational logs. Our infrastructure records standard request metadata (timestamps, IP address, user agent) for security, rate-limiting, and debugging. These logs are retained only as long as operationally needed.

Public Roblox & YouTube data. The site itself aggregates publicly available information about Roblox experiences and discovery charts, and publicly available metrics about creators we track. This is data about games and channels, not about you.

Aside from Microsoft Clarity, described above and below, our analytics are first-party and in-house. We run no advertising or marketing trackers of our own, we do not sell or rent personal data, and we do not build advertising profiles. We never receive your passwords. We collect no more than what the service needs to authenticate you, operate, and understand its own usage.

We use your account and session data to sign you in, keep you signed in, attribute the games you save, and operate administrative functions. We use usage analytics to understand which features matter and how to improve the product. We use operational logs to protect the service against abuse and to diagnose problems.

We use a strictly-necessary session cookie, plus short-lived cookies during sign-in to secure the OAuth handshake. We also store a theme preference in your browser's local storage so the site remembers light or dark mode. We set no advertising cookies.

We also set a first-party measurement cookie (rt_vid) containing a random identifier and nothing else — no name, no account, no personal data. It lets us count how many people come back to the site, and keep the version of the home page you see consistent between visits while we test which version works better. It is readable only by our own server, never shared, never sold, and never used for advertising. It lasts up to 400 days, and blocking or deleting it costs you nothing on this site.

Microsoft Clarity sets its own cookies (_clck and _clsk) to recognise a returning browser and group activity into one session. Neither those nor rt_vid are strictly necessary.

We rely on a small number of providers, each subject to its own privacy policy and processing data only to deliver these functions: Roblox and Google for sign-in, Resend to deliver sign-in emails, Cloudflare Turnstile to screen email sign-in requests for abuse, Microsoft Clarity for the session replays and heatmaps described above, and our hosting and infrastructure providers to run the service. Clarity data is held by Microsoft, which may also use it for its own purposes under the Microsoft Privacy Statement. We do not otherwise share your personal data with third parties except where required by law.

Session records are deleted at or shortly after expiry. Sign-in email links are single-use, expire in 15 minutes, and are stored only as a hash until they are swept. Account data is retained while your account is active. When you ask us to remove your account, we delete or anonymize associated personal data within a reasonable period, except where we must retain it to comply with legal obligations.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can sign out at any time, and you can ask us to delete your account and its data. To exercise any of these rights, contact us at the address below.

Sign-in is passwordless or delegated to Roblox or Google; the OAuth flows use PKCE and state checks, and email links are single-use, short-lived, and stored only as hashes. Sessions use HTTP-only, secure cookies, and APIs are rate-limited. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your data.

The service is not directed to children; you must meet the age requirement in our Terms of Service to hold an account. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy from time to time. Material changes will be reflected by a new effective date at the top of this page. Continued use after a change constitutes acceptance of the updated policy.

Questions or requests about this policy or your data: [email protected].