Last updated November 1, 2026
Privacy Policy
RoWarden helps Roblox developers manage their experiences, staff, moderation and Discord integration. This policy explains what we collect, why, and the choices you have.
What we collect
- Account details: name, email address and a hashed password (if you use one). When you sign up we also store the time you accepted the Terms and Privacy Policy and which version.
- Linked accounts: when you connect Roblox or Discord, we receive your user ID, username, display name and avatar from that service. We never ask for or receive your Roblox or Discord password.
- Roblox verification in Discord: when you press Verify in a server that has the RoWarden bot (or use /verify), we link your Roblox account to your Discord account on your RoWarden account, and note which servers you verified in (server ID and date). The link is reused, so verifying in another server takes one click; it is never applied to a server for you. Staff of a server that is connected to a game can look up only your primary Roblox account, and only in servers where you verified. Use /unverify to leave a server, or unlink an account in Account settings.
- Roblox experience access: if you use “Connect with Roblox”, we read the list of experiences you choose to share and their basic details (name, owner, start place). We use this only to verify you can manage them and do not store the access token.
- API keys you add: Roblox Open Cloud keys are encrypted at rest and only used on our servers to perform the actions you request (for example bans, in-game commands or analytics).
- Experience data: staff lists and roles, moderation records (including the Roblox user IDs and usernames of moderated players), tickets, appeals and form responses with the messages and files people send, analytics for your experiences, Discord server and role settings, and audit logs of actions taken.
- Technical data: IP address and browser user agent for sign-in sessions, security logs and rate limiting.
- Billing: payments are handled by Stripe. We receive subscription status and invoice records, never your full card details.
- Usage measurements: only if you accept them, page views and loading-speed measurements (page address, referrer, country, browser, device type and operating system) through Vercel Analytics and Vercel Speed Insights.
Why we use it, and the legal basis
- To provide the service you asked for: authentication, permissions, moderation, analytics, Discord commands and role synchronization (Art. 6(1)(b) GDPR, performance of a contract).
- To keep accounts and experiences secure, including audit logs, rate limiting and abuse prevention (Art. 6(1)(f), our legitimate interest in a secure service).
- To process subscriptions, issue invoices and meet tax and accounting duties (Art. 6(1)(b) and (c)).
- To send service emails such as the address confirmation, invitations and password resets (Art. 6(1)(b)).
- To measure how the site is used and how fast it loads (Art. 6(1)(a) and the ePrivacy rules on storing or reading information on your device (Law 41/2004), your consent). This runs only after you accept, and you can change your mind at any time.
- For the staff and player data in an experience: the owner’s legitimate interest in running and protecting their community (Art. 6(1)(f)), unless the owner tells us otherwise.
We do not sell personal data and do not use it for advertising or profiling.
Who we share it with
- Roblox and Discord, through their official APIs, to carry out actions you or your staff request.
- Vercel (hosting in Frankfurt, and the usage measurements above), the managed PostgreSQL database provider (Neon), Resend (email delivery), Stripe (payments) and Google (only if an owner connects Google Docs, to read the documents they choose).
- Services an experience owner switches on with their own account or key: an AI provider for staff insights (we send numbers and aliases such as “M1”, never names), Trello, Discord log channels, and the webhook addresses they enter. The owner is responsible for those connections.
- The owner and authorized staff of an experience can see staff and moderation information for that experience.
- Authorities, if required by law.
Transfers outside the EU/EEA
Our application runs in Frankfurt, but several providers above (for example Vercel, Stripe, Resend, Discord, Roblox and Google) are based in or may process data in the United States or other countries. Where that happens we rely on the EU–US Data Privacy Framework or on the EU standard contractual clauses, as far as the provider offers them.
Retention
| Sign-in sessions | Expire after 7 days without use or 30 days in total; removed when you sign out. |
|---|---|
| IP addresses | Cleared from audit logs, sign-in records and license key redemptions after 90 days. |
| Notifications | Read ones after 30 days, all after 90 days. |
| Ticket attachments | Files posted to Discord are kept there. Other files are stored with the ticket and removed when the ticket is deleted (without object storage they are kept for 48 hours). |
| Copies of Discord log attachments and delivery records | 2 days and 7 days. |
| Outgoing webhook delivery records | 14 days. |
| Staff activity statistics | 730 days by default; the experience owner, or staff they allow, can set 30 to 1825 days. |
| DataStore backups | 90 days by default; the experience owner can set 31 to 365 days. |
| Audit logs | 730 days. When an account is deleted, its email address and IP address are removed from the audit log. |
| Moderation records, tickets and form responses | Kept for the experience owner’s history until the owner deletes the experience or a player asks for erasure. |
| Server verifications | Until you use /unverify in that server, unlink your Discord or last Roblox account, or delete your account. |
| Account | Until you delete it. After you delete it, access ends immediately and the data is purged within about 24 hours (once Discord roles and Roblox group ranks it held have been removed). |
| Billing records | Our copy is deleted with the account. Stripe keeps payment records for as long as the law requires. |
Your rights
- Access and a copy of your data: download it in Account settings (“Download my data”).
- Correction: change your name and email in Account settings.
- Deletion: delete your account in Account settings. Experiences you own must be transferred or deleted first, and an active paid subscription cancelled.
- Restriction, objection and portability, and consent withdrawal: write to us. You can withdraw cookie consent at any time with “Cookie settings”.
- Unlink Roblox or Discord in Account settings, revoke RoWarden’s access in their authorized-apps settings, or remove API keys from your key vault at any time.
- You have the right to complain to a data protection supervisory authority, for example in your country of residence or the Portuguese authority, the CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt).
If you are a player or staff member in someone else’s experience, you can also use the erasure option Roblox provides to that experience.
Children
RoWarden is a tool for developers and is not directed at children under 13. You must confirm you are at least 13 to sign up. Roblox requires users to be 13 or older to authorize OAuth apps. We do not collect dates of birth.
Contact
Questions or requests: support@rowarden.com. RoWarden is not affiliated with Roblox Corporation or Discord Inc.