Privacy Policy

Nui Studios, Finland, is the controller of personal data processed for this service.

For access, correction, deletion, objection, restriction, portability, or other privacy questions, email the address above. We may need to verify that you control the relevant Roblox account before acting.

Roblox identity

• numeric Roblox user ID, username, display name, avatar or avatar URL, profile information available through the requested OAuth profile scope, and last sign-in time;
• application role, such as user, administrator, or owner;
• public Roblox user, group, place, universe, game-pass, creator, and group-owner information needed for licensing.

Sessions and technical data

• hashed session identifier, session creation and expiry, and limited browser User-Agent information;
• IP address, autonomous-system information, place headers, request metadata, timestamps, rate-limit keys, security events, diagnostics, and error logs processed by us or Cloudflare;
• OAuth state and PKCE data kept briefly in an essential cookie.

Purchases and licenses

• product, purchase source, Roblox receipt or game-pass reference, Robux amount when supplied, purchase place, status, and time;
• license code, owner and holder Roblox IDs, loan status and time, suspension or revocation state and reason, expiry, product version, and delivery information;
• license event history, including actors, borrowers, transfers, returns, withdrawals, and administrative changes.

Product usage and administration

• places and universes where an authorised license is seen, place name, creator, effective owner, and first/last seen time;
• administrator actions, target records, internal license notes, hub-key metadata, permitted place IDs, and last use;
• support messages and information you provide when requesting help, a refund, transfer, or privacy action.

A user record can be created before you sign in when a purchase is reported, a license is granted, or another user lends a license to your Roblox account.

• You, when you sign in, use the website, lend or return a license, or contact support.
• Roblox, through OAuth, public APIs, inventory checks, game-server request metadata, and purchase receipts reported by authorised hub servers.
• Other users, when an owner lends a license to your account.
• Administrators, when granting, transferring, reviewing, suspending, revoking, or documenting a license.
• Infrastructure providers, through security, network, availability, and diagnostic information.

• Performing our contract: authenticating you, recording purchases, delivering products, maintaining licenses, enabling loans, verifying use, and providing support.
• Legitimate interests: securing accounts and APIs, preventing fraud and duplicate fulfillment, maintaining audit records, diagnosing failures, improving reliability, enforcing license terms, and defending legal claims.
• Legal obligations: maintaining records and responding to lawful requests where Finnish or European Union law applies.
• Consent: where we specifically ask for it. You may withdraw consent without affecting processing already carried out, but most core processing is necessary for the service rather than consent-based.

We do not use the application data described here for behavioural advertising, and the current website does not include advertising or third-party analytics cookies.

Sign-in requests the Roblox openid and profile scopes. We use the access token to obtain identity information. We do not store Roblox access or refresh tokens. If Roblox supplies a refresh token, we attempt to revoke it after sign-in.

We never request or store your Roblox password. Roblox independently processes authentication under its own privacy policy.

• Roblox Corporation provides authentication, account and experience information, inventory checks, transactions, and platform services.
• Cloudflare hosts the Worker and static assets and may process network identifiers, requests, rate limits, cached data, security information, and observability logs.
• Neon hosts the PostgreSQL database containing account, purchase, license, usage, and audit records.
• Nui Studios personnel and authorised administrators access data where needed for operation, security, support, compliance, and enforcement.
• Authorities or professional advisers may receive data where legally required or reasonably necessary to protect rights, investigate abuse, or handle a dispute.

We do not sell personal data. Administrator-configured links may take you to third-party documentation, downloads, or Roblox pages governed by their own policies.

Cloudflare, Neon, Roblox, and their subprocessors may process data outside Finland or the European Economic Area. Where European data-protection law requires safeguards, we rely on mechanisms made available by the provider, such as adequacy decisions, standard contractual clauses, and supplementary security measures.

Infrastructure region and subprocessor details can change. Contact us if you need information relevant to a particular transfer.

We keep data only for as long as reasonably necessary for the purposes described here, including providing licenses, preserving purchase and ownership history, security, accounting, resolving disputes, enforcing agreements, and meeting legal obligations.

• The OAuth state cookie expires after approximately 10 minutes and is cleared after callback processing.
• Server-side sessions expire after 30 days and may be renewed while active. Signing out or an administrator action can end them sooner. Expired database rows may remain until routine cleanup but no longer authorise access.
• Short-lived license decisions may remain in memory or Cloudflare cache for up to six hours as an outage fallback. Avatar lookup cache entries may remain longer for performance.
• Purchase, license, license-history, audit, and transaction records may be retained for the life of the license and afterwards where necessary for accounting, fraud prevention, dispute resolution, or legal claims.
• Support records are retained while the matter is active and afterwards as reasonably needed for follow-up or legal protection.

When data is no longer required, we delete or anonymise it where reasonably practicable. Some information may remain in protected backups until overwritten, or be retained where law or the rights of others require it.

Depending on applicable law, including the EU General Data Protection Regulation, you may have rights to:

• obtain confirmation and a copy of personal data;
• correct inaccurate or incomplete data;
• request deletion;
• restrict or object to certain processing;
• receive eligible data in a portable format;
• withdraw consent where processing depends on consent; and
• complain to a supervisory authority.

Some requests may be limited where data is necessary to perform a contract, preserve another person’s license ownership, comply with law, prevent fraud, or establish, exercise, or defend legal claims. Deleting account data may require termination of access or anonymisation of historical records.

You may contact the Office of the Data Protection Ombudsman in Finland or the supervisory authority in your country of residence.

Measures include OAuth with PKCE, HTTP-only secure production cookies, hashed session tokens and hub keys, role checks, least-access admin controls, HTTPS, signed license responses, rate limits, input validation, security headers, conditional database writes, and audit history.

No online system is completely secure. You should protect your Roblox account and immediately report suspected unauthorised access or exposed credentials.

The service is connected to Roblox and may be used by younger users. A child who cannot legally consent to or enter the relevant agreement must use the service only with authorisation from a parent or guardian. We do not knowingly request sensitive information from children.

A parent or guardian may contact us about a child’s data. We may require verification of identity, authority, and the relevant Roblox account.

The licensing service automatically determines whether an experience owner currently holds an active, unexpired license. The decision uses product, place ownership, group ownership, holder, status, expiry, and recent withdrawal information. It controls whether the product is authorised to run.

If you believe a decision is wrong, contact support for human review. We do not use this decision for credit, employment, insurance, or similarly significant purposes.

We may update this Policy when the service, providers, or legal requirements change. We will publish the new effective date and provide reasonable notice of material changes where appropriate.