Privacy Policy
Rostructure is an analytics service for Roblox developers, run by Novra Studios, referred to here as "we" or "us". It touches the data of two groups of people: developers, who sign in to the dashboard, and players, who play games where a developer has installed the Rostructure module. This policy covers both. Questions or requests: contact us through rostructure.com.
Developers (dashboard accounts)
We collect what you give us, and what we need to run your account:
- Account details: your name and email address. If you sign in with Roblox, Discord, GitHub or Google instead, we receive the basic profile you approve: an account identifier, your display name, your profile picture address and, where the provider shares it, your email. Roblox does not share email addresses, so for Roblox sign-ins we store a placeholder.
- Sign-in data: a salted hash of your password (never the password itself), and a record of each signed-in session, including the IP address and browser type it was opened from. We use these to keep you signed in, to limit repeated sign-in attempts and to investigate misuse.
- Project data: project names, settings, saved funnels and the people you share a project with. Ingestion keys are stored only as one-way hashes.
- Shared projects: when you invite someone by Roblox username, we look the username up through Roblox's public users API. Members of a project you join can see your name, profile picture and Roblox username.
We use this to provide the dashboard, keep accounts secure and contact you about the service. We do not sell it, and we do not use it for advertising.
Players (data collected by a developer's game)
When a developer installs the Rostructure module, their game servers send us gameplay events. For each event the module can send:
- a pseudonymous player ID, a one-way hash of a secret value, the project and the Roblox user ID. It lets the developer count unique players and follow one session, but it is not a Roblox user ID or username and cannot be reversed without the developer's secret;
- a session ID, the event name (for example a death, a checkpoint or a step in a funnel), the time, and the game server and build identifiers;
- the player's position in the game world when the developer asks for it, a stage identifier, and a device type (touch, keyboard, gamepad);
- gameplay values the developer chooses to send, such as in-game currency earned or spent, progress, and any extra fields attached to a custom event.
Events come from Roblox's game servers, not from players' devices, so we never receive players' IP addresses. The module does not send Roblox usernames, display names or chat messages. Pseudonymous IDs are still personal data in some laws, so we treat them that way.
The developer decides what is collected and why, and is responsible for it as the controller of that data. We process it on the developer's behalf, only to show it to them in their dashboard and to run and fix the service. We do not use it for advertising, profile players across games, or sell it. Developers must tell their players what they collect and follow the Roblox Terms of Use and Community Standards.
Map geometry
If a developer chooses to publish a simplified copy of their map so deaths can be drawn on it, we store that geometry for them, including a coarse height-and-material map of any terrain. Map publishing is off unless the developer turns it on.
Revenue data (optional)
Revenue tracking is off by default. A developer can turn it on for a project, and the game must also opt in through the SDK. When both are on, purchase events include their Robux amount and product. We do not collect revenue for projects that have not opted in: if a game sends it anyway, our servers discard it before it is stored.
Revenue data is private to the project's members. We use it only to debug and fix the service, we do not sell or share it, and we do not use it to benchmark, rank or advertise to anyone. Revenue is encrypted by our API before it is stored, with a separate key for each project, so the database holds only ciphertext and the time of each purchase. Developers can turn tracking off at any time and delete the revenue data already stored for their project from the project settings. The SDK records purchases only by listening to the purchase-finished events Roblox fires; it never takes over a game's receipt processing.
Cookies and third parties in your browser
We use only essential cookies: a sign-in session cookie, a short-lived cookie that protects the sign-in flow, and a cookie that remembers which of your projects is open. The 3D viewer also remembers which map layers you turned on in your browser's local storage. Because these are needed for the service to work, we do not ask for consent to them, and there are no advertising, tracking or third-party analytics cookies.
Every page, font and script on rostructure.com is served from our own servers. Profile pictures from your sign-in provider are fetched by our server and passed on, so your browser does not contact Roblox, Google, GitHub or Discord while you use the dashboard. The only time your browser talks to one of them is when you choose to sign in with it.
Why we may use it (legal bases)
Where data protection laws such as the GDPR or UK GDPR apply, we rely on: performing our contract with you to run your account and projects; our legitimate interests in keeping the service secure, preventing abuse and fixing problems; and legal obligations where the law requires us to keep or disclose something. For player data, the developer's legal basis applies, and we act on their instructions. Developers who need a data processing agreement can ask us for one.
Who else handles data
- Railway hosts the website, the API and the database, in the United States. Like most hosts it may keep short-term request logs, including IP addresses, to run and protect its platform.
- Roblox, Discord, GitHub and Google verify your identity if you choose to sign in with them, under their own privacy policies. Roblox's public users API also answers username lookups for project invites.
We share data with nobody else unless the law requires it, or as part of a sale or reorganisation of the service, in which case this policy would continue to apply to it.
International transfers
Our servers are in the United States. If you are outside the United States, your data is transferred there. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses offered by our providers.
How long we keep it
Sign-in sessions expire after 14 days without use. Developer accounts and project data are kept until you delete them or ask us to. Event data is kept for as long as the project exists; we do not yet delete events automatically on a schedule, so if you want data removed sooner, ask us.
Your rights
Depending on where you live, you can ask us to access, correct, export or delete your data, to restrict or object to how we use it, and you can complain to your local data protection authority. Developers can do most of this from the dashboard or by asking us. Players whose data a game sent to us can ask us, or the developer of that game, to delete data linked to their pseudonymous ID; because we cannot tell which player an ID belongs to, we may need the developer's help to find it. We do not sell or "share" personal information as the California Consumer Privacy Act defines those words. Questions or requests: contact us through rostructure.com.
Security
Passwords and ingestion keys are stored as hashes, connections use HTTPS, and ingestion keys never leave a game's server. Our websites and API send standard browser protections (HSTS, a content security policy and no framing). Our hosting provider stores the database on its own infrastructure; see the security notes in the documentation for exactly what is and is not encrypted. No online service is perfectly secure, and we cannot guarantee absolute security. If a breach affects your data, we will tell you as the law requires.
Children
The dashboard is for developers aged 13 or older; developers under 18 need a parent or guardian's permission. We do not knowingly collect personal information directly from children. Players of Roblox games may be children: from them we receive only the pseudonymous gameplay data described above, sent by the game's servers, and nothing that directly identifies a player. If you believe a child has given us personal information, contact us and we will delete it.
Changes
If we make a material change we will update the date above and, for dashboard users, tell you in the product.