Privacy.

Account & sign-in. You can sign in three ways, and we only ever receive what that provider hands us:

— Roblox (OAuth): your Roblox user ID, username, display name, and avatar image. We also check whether you belong to our Roblox group, but this is only a usage signal — it does not gate access.
— Google (OAuth): your Google account ID, your email address (if Google has verified it), your name, and your profile picture.
— Email (passwordless link): just your email address.
We never receive or store a password — sign-in is either a one-time link or delegated to Roblox or Google.

Session data. We set an HTTP-only session cookie to keep you signed in and store a corresponding session record (an opaque session ID and its expiry) in our database. This cookie is strictly necessary for the service to function.

Usage analytics. We keep first-party, in-house analytics to understand how the product is used: events such as page views (the path only — query strings are stripped), referrer, sign-ins, and which tools you use (for example saving or searching a game), associated with your account. This stays on our own infrastructure and is not shared with any third-party analytics service.

Operational logs. Our infrastructure records standard request metadata (timestamps, IP address, user agent) for security, rate-limiting, and debugging. These logs are retained only as long as operationally needed.

Public Roblox & YouTube data. The data sheet itself aggregates publicly available information about Roblox experiences and discovery charts, and publicly available metrics about creators we track. This is data about games and channels, not about you.

Our analytics are first-party and in-house. We do not run third-party advertising or marketing trackers, we do not sell or rent personal data, and we do not build advertising profiles. We never receive your passwords. We collect no more than what the service needs to authenticate you, operate, and understand its own usage.

We use your account and session data to sign you in, keep you signed in, attribute the games you save, and operate administrative functions. We use usage analytics to understand which features matter and how to improve the product. We use operational logs to protect the service against abuse and to diagnose problems.

We use a strictly-necessary session cookie, plus short-lived cookies during sign-in to secure the OAuth handshake. We also store a theme preference in your browser's local storage so the site remembers light or dark mode. Our usage analytics are keyed to your account on the server, not to tracking cookies, and we use no advertising cookies — so there is no consent banner to dismiss.

We rely on a small number of providers, each subject to its own privacy policy and processing data only to deliver these functions: Roblox and Google for sign-in, Resend to deliver sign-in emails, Cloudflare Turnstile to screen email sign-in requests for abuse, and our hosting and infrastructure providers to run the service. We do not otherwise share your personal data with third parties except where required by law.

Session records are deleted at or shortly after expiry. Sign-in email links are single-use, expire in 15 minutes, and are stored only as a hash until they are swept. Account data is retained while your account is active. When you ask us to remove your account, we delete or anonymize associated personal data within a reasonable period, except where we must retain it to comply with legal obligations.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can sign out at any time, and you can ask us to delete your account and its data. To exercise any of these rights, contact us at the address below.

Sign-in is passwordless or delegated to Roblox or Google; the OAuth flows use PKCE and state checks, and email links are single-use, short-lived, and stored only as hashes. Sessions use HTTP-only, secure cookies, and APIs are rate-limited. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your data.

The service is not directed to children; you must meet the age requirement in our Terms of Service to hold an account. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy from time to time. Material changes will be reflected by a new effective date at the top of this page. Continued use after a change constitutes acceptance of the updated policy.

Questions or requests about this policy or your data: [email protected].