Privacy Policy

1. Information we collect

Account and identity

When you sign in with Roblox OAuth 2.0, we receive from Roblox your Roblox user ID, username, display name, and profile picture (avatar headshot URL). We use this only to identify you and display your account inside RoSignal.

Roblox connection

To operate the service we store OAuth tokens issued by Roblox (including a refresh token) so RoSignal can act on your behalf — for example publishing messages to your experiences through Roblox's MessagingService, or reading and updating the ban list for your experience through Roblox's user restriction API when you grant those permissions. Refresh tokens are stored encrypted and are never exposed to other users. We also store the list of Roblox experiences (universe IDs) you authorize during sign-in. When you grant the universe read permission, we read the name and basic metadata of experiences you manage — including ones Roblox's public API hides, such as private experiences — solely to display their real names in your dashboard. When you grant the analytics permission, we read your experience's first-party Roblox metrics (such as daily active players, sessions, and session length) solely to display them in your dashboard; they may be cached briefly for performance and are never sold or shared.

Moderation data

If you use moderation features, we store the Roblox user IDs you ban, kick, or unban, along with the reason, duration, and the account that performed the action. When you have granted the user restriction permissions, we also read the current restriction state for your experience from Roblox so the console reflects what the platform is actually enforcing.

Game data and telemetry

When you install the RoSignal module in your game, your game servers send us the telemetry you choose to instrument: custom events, funnel steps, analytics events, player identifiers you pass, in-game coordinates for events that include a player (used only to draw the analytics map), and server metadata (such as job IDs and place versions). You can switch positions off per event, or globally in the RoSignalSettings module. If you export your place geometry from the Studio plugin, we store the resulting block outlines — no scripts, assets, or source are uploaded. You control what your game sends through your own code.

Configuration and operational data

We store the live config values, scheduled messages, automations, moderation actions, and team settings you create, along with audit logs that record which account performed each action.

Usage and security data

We keep standard server logs (IP address, timestamps, requested paths) for security, abuse prevention, and debugging. We use a small number of cookies required for sign-in sessions; we do not use third-party advertising or tracking cookies.

2. How we use information

We use the information above only to:

• Authenticate you and maintain your session.
• Connect RoSignal to the Roblox experiences you authorize.
• Deliver the features you configure: messaging, live config, analytics, funnels, automations, and moderation.
• Provide audit trails so team members can see who changed what.
• Prevent abuse, secure the service, and debug issues.
• Communicate with you about the service (for example, via our Discord community or support email).

We do not use your game telemetry to train models, build advertising profiles, or for any purpose unrelated to providing RoSignal to you.

3. Legal bases for processing

We process personal data on these legal bases:

• Performance of a contract: account data, Roblox connection tokens, and the operational data you create, processed to provide the Service you signed up for.
• Legitimate interests: security, abuse prevention, debugging, and product improvement, where these interests are not overridden by your rights.
• Consent: the Roblox OAuth permissions you approve, which you can withdraw at any time from your Roblox account settings.
• Legal obligation: subscription and transaction records kept as required for accounting and tax purposes.

4. Data sharing and disclosure

We do not sell your personal information or your game data. We share data only in these cases:

• With Roblox: to perform the actions you request (for example, publishing a message to your experience) via Roblox's official APIs.
• With your team: people you invite to a game in RoSignal can see that game's data and the audit history of actions taken on it.
• With destinations you configure: if you set up a webhook action, we send the configured payload to the URL you provide.
• Infrastructure providers: we use hosting and database providers to operate the service. They process data only on our instructions.
• Our reseller and Merchant of Record (Paddle): if you buy a paid plan, Paddle.com collects and processes your payment and billing details as the seller of record, and handles invoicing, tax, refunds, and billing support. We never see or store your card details. We receive back only your subscription's status, plan, and billing period so we can unlock your plan. See Paddle's privacy notice.
• Professional advisers: legal and accounting advisers where needed to run the business.
• Legal requirements: if required by law, regulation, or valid legal process.

5. International transfers

RoSignal is operated from the United States and your data is processed there. If you access the Service from the United Kingdom, the European Economic Area, or another region with data-transfer rules, your information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards — such as adequacy decisions or standard contractual clauses with our service providers — for these transfers.

6. Data retention

• Account data (Roblox ID, username, avatar, consent records) is kept while your account is active.
• Roblox OAuth tokens are kept while your account is connected so scheduled and automated actions keep working. They are deleted when your account is deleted.
• Telemetry and events are retained to power your analytics history and may be aggregated or pruned over time.
• Audit logs (message runs, config changes, moderation actions) are retained so owners can review past activity.
• Telemetry and audit history are trimmed to your plan's retention window — see the pricing page for the exact number of days on each plan.
• Subscription records (plan, status, billing period, provider identifiers — never card details) are kept while you have a paid plan and afterwards as long as needed for accounting and tax records.

When personal data is no longer needed for the purposes above, we delete or anonymize it.

7. Your rights and choices

You can:

• Revoke RoSignal's access to your Roblox account at any time from your Roblox account settings. After revocation, we can no longer act on your behalf, and token refreshes will fail.
• Stop sending telemetry by removing or disabling the RoSignal module in your games.
• Request access, correction, or deletion of your data by contacting us (see Contact below). Deleting your account removes your stored OAuth tokens, games, configurations, and associated operational data.

Depending on where you live (including the UK and EEA), you may also have the right to restrict or object to our processing of your data, the right to data portability, the right to withdraw consent where processing is based on consent, and the right to lodge a complaint with your local data protection authority. To exercise any of these rights, contact us — we respond to verified requests within one month.

8. Security

We use industry-standard measures including HTTPS encryption in transit, encrypted storage of Roblox refresh tokens, signed HTTP-only session cookies, and scoped database access with row-level security. No method of transmission or storage is perfectly secure, but we work to protect your information and will notify affected users of any confirmed breach where required.

9. Children's privacy

RoSignal is a tool for Roblox developers and is not directed at children under 13. We do not knowingly collect personal information from children beyond the Roblox account data required to operate the developer features described above. Player identifiers contained in your game telemetry belong to your players; you are responsible for handling that data in compliance with Roblox's rules and applicable law.

10. Cookies

We use only essential cookies required to keep you signed in and keep the Service secure. We do not use analytics or marketing cookies, and no cookie consent banner is needed for essential cookies. You can clear or block cookies in your browser settings, but signing in will not work without the session cookie.

11. Third-party services

RoSignal integrates with Roblox (OAuth 2.0 and Open Cloud APIs). Your use of Roblox is governed by the Roblox Terms of Use and Roblox Privacy Policy. We are not affiliated with or endorsed by Roblox Corporation.

12. Changes to this policy

We may update this policy as the product evolves. We will post the updated policy on this page with a new "last updated" date, and we will notify you of material changes through the app or our community channels. Continued use of RoSignal after changes take effect constitutes acceptance.

13. Contact

For privacy questions, data access, or deletion requests, contact us at support@rosignal.app or reach out in our Discord community.