Privacy Policy

1. Scope

This policy covers information we process as the operator of the Services. It does not cover Roblox, Discord or any other service you use alongside ours, each of which has its own privacy policy. When a developer uses AVS to send us data about the players in their Experience, we process that data on the developer's behalf, as described in Section 2.3, and the developer's own privacy practices also apply.

2. Information we collect

You don't have to give us personal information, but we need your sign-in information to create your Account, and parts of the Services won't work without it.

2.1 Account and sign-in information

You sign in with Roblox or Discord. When you do, we receive and store:

• from Roblox, your user ID, username, display name and profile picture;
• from Discord, your user ID, display name or username, email address, whether that address is verified, and avatar;
• the tokens Roblox or Discord issue when you sign in, which contain the details above and, for Roblox, when your account was created; and
• a session record for each device you sign in on, which can include its IP address and browser type.

If our team issues you an AVS license before you have signed in, we create your record from the Roblox and Discord user IDs you give us.

2.2 Nebulro AVS

• License Keys. For each License Key, and each game token you create for the AVS data API, we store a hash, its first few characters and its label, never the full key. We also store the paid extensions linked to your Account.
• Studio plugin. While the plugin is open in Roblox Studio, it sends us your Roblox Studio user ID, the place and Experience you are editing, and the plugin version. It does so when it starts, once a minute while it runs, and when it stops, whether or not you have entered a License Key. If you have entered one, these reports are linked to your Account. The plugin also checks your License Key, downloads AVS releases, and reports which AVS versions are installed in the place after an install or update, when it opens in a published place that has AVS, and when you publish.
• License checks. Game servers running AVS verify their license using the place and Experience IDs. They send no player data for this check.
• Relayed requests. Some AVS features, such as Outfit Loader and Discord logs, reach Roblox or Discord through our servers. These requests can include Roblox user IDs and, for Discord logs, the contents of each message, such as player names, account age, playtime and purchases. We pass them on without storing them, apart from the request logs described in Section 2.7.

2.3 Game Data sent by developers

If a developer connects their Experience to the AVS data API, their game sends us data about its players. This can include:

• Roblox user IDs, and display names shown on leaderboards;
• purchases, including the item, its price in Robux, the transaction ID and, for gifts, who received them;
• outfit activity, such as views, try-ons and saves, and items added to carts or wishlists;
• outfits that players save, including their name, description and creator's user ID;
• leaderboard scores;
• when each event happened, and the place and server it came from; and
• any custom fields the developer adds.

Nothing is sent unless the developer writes code to send it. We process Game Data on the developer's behalf. We use it to build statistics for the developer, such as sales, leaderboards and when each player was first and last seen, and we return it to the developer's game, for example to show leaderboards and saved outfits to players.

2.4 Connected Experiences

If you connect an Experience for Roblox analytics, we ask Roblox for permission to read its analytics. We store your Roblox user ID and name, the Experiences you connect and their owners, and the access tokens Roblox issues to us, which we encrypt. Once a day, we copy each connected Experience's daily totals: daily active users, new users, Robux revenue, average playtime and retention. We do not receive data about individual players this way.

2.5 Nebulro Stats

Nebulro Stats is built from information Roblox makes publicly available about Experiences and avatar items, including names, descriptions, player counts, visits, favorites, votes, prices, Limited sales, and the names and IDs of their creators. We keep historical records of it, for example to chart an Experience's player counts over time. We do not collect information about the people who own, buy or sell items.

2.6 Nebulro Forge

Forge sends no information to us. It runs in Roblox Studio and uses Roblox's own services, such as uploading an item through your Roblox account, under Roblox's terms.

2.7 Usage and log information

• Our hosting providers log requests to our servers, including IP addresses and the addresses requested, so we can operate and secure the Services.
• We record product events to understand how the Services are used, including plugin sessions with the Studio user ID, AVS installs, license checks, catalog checks and downloads.
• Images of Experiences and items on the website load directly from Roblox's image servers, and a Discord profile picture loads from Discord's, so Roblox and Discord receive your IP address when they load.

2.8 Information we do not collect

We never ask for or store your Roblox or Discord password. We do not collect precise geolocation or build advertising profiles. When paid plans launch, the merchant of record will handle your payment details, and we will not receive your full card number.

3. Cookies and similar technologies

We use only cookies that the Services need to work. We do not use advertising cookies, third-party analytics or cross-site tracking.

• Sign-in cookies keep you signed in. The session cookie lasts up to 7 days and renews while you use the site. A second, short-lived cookie lasts 15 minutes, and a third protects the sign-in step itself and lasts 5 minutes.
• A connection cookie exists only during the Roblox permission step when you connect an Experience, and lasts 10 minutes.
• A preview cookie lets our team view the site before it launches, and lasts 30 days.

The site also keeps a small value in your browser's storage so that signing out applies to all your open tabs. If you block these cookies in your browser, parts of the Services will not work. Because we don't track you across other sites, we don't change how we handle your information in response to Do Not Track signals. We don't sell or share personal information, so a Global Privacy Control signal has nothing to opt you out of.

4. How we use information

We use the information described above to:

• provide and operate the Services, including signing you in and linking your Roblox and Discord accounts;
• issue and verify AVS licenses, deliver AVS updates, run AVS features, and process Game Data for developers;
• operate Nebulro Stats;
• secure the Services, prevent fraud and abuse, and find and fix problems;
• respond to your requests and messages;
• measure, in aggregate, which features are used, so we can improve the Services; and
• comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use it for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

5. Legal bases for processing

If you are in the European Economic Area, the United Kingdom or another place that requires a legal basis for processing personal information, we rely on the following:

• Performance of a contract. To provide the Services you ask for, including your Account, AVS licenses and connected Experiences.
• Legitimate interests. To secure the Services, prevent abuse, understand how the Services are used, and run Nebulro Stats from publicly available data, where your rights do not override those interests.
• Consent. Where we ask for it, such as when you authorize us to read a connected Experience's analytics. You may withdraw consent at any time.
• Legal obligation. To comply with applicable law and lawful requests.

6. How we share information

We share personal information only as described below.

• Service providers. Companies that host our website and API, store files and usage data, provide our database and sign-in infrastructure, and run the systems that collect public Roblox data for Nebulro Stats. They process information only on our behalf and under our instructions. The systems that collect data for Nebulro Stats receive no information about your Account.
• Roblox and Discord. To sign you in, and to carry the AVS requests described in Section 2.2. Roblox also provides the data behind Nebulro Stats and connected Experiences.
• Developers. We make Game Data, and statistics built from it, available only to the developer whose Experience sent it and to that developer's game.
• The public. Nebulro Stats displays publicly available information about Experiences and items, including the names and IDs of their creators.
• Payment providers. When paid plans launch, a third-party merchant of record will process payments and receive the information needed to complete your purchase.
• Legal and safety. When the law or legal process requires it, or when we believe disclosure is needed to protect the rights, property or safety of any person or of the Services.
• Business transfers. As part of a merger, acquisition, financing, reorganization or sale of assets of Nexus Code, LLC. This policy will continue to apply to any information transferred.

7. Data retention

We keep personal information for as long as we need it for the purposes in this policy, unless the law requires a longer period. Specifically:

• Account information, including your License Keys and the install reports linked to them, stays until you ask us to delete your Account.
• Sign-in sessions expire within 7 days of your last use. We keep the session records, including their IP addresses, with your Account information.
• Studio plugin reports stay until you ask us to delete them.
• Product usage events are deleted after 3 months.
• Our hosting providers keep request logs for a short period they set.
• Game Data, including earlier versions of saved outfits and past leaderboards, stays until the developer who sent it asks us to delete it or to delete their Account.
• When you disconnect an Experience, we delete its tokens and ask Roblox to revoke our access. We delete its synced statistics once no Account has it connected. We keep a record of the connection, with your Roblox user ID and name and the Experiences involved, until you ask us to delete it.
• Nebulro Stats keeps full detail for 90 days, hourly figures for 2 years and daily figures after that. We also keep an archive of the raw public data we collect.

We may keep some information longer where reasonably necessary to resolve disputes, prevent fraud and abuse, enforce our agreements or comply with the law.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, export or restrict the processing of your personal information, to object to how we use it, and to withdraw consent where we rely on consent. You can also disconnect Experiences from your dashboard and sign out at any time.

To exercise these rights, email support@nebulro.com. We may need to verify your identity, for example by asking you to confirm the request from your signed-in Account. We will respond within the time the law requires, and usually within 30 days. We will not treat you differently for exercising your rights. If you are in the European Economic Area or the United Kingdom, you may also complain to your local data protection authority.

• Creators. If you want your name or items left out of Nebulro Stats, email us and we will handle it.
• Players. If you want data that an Experience sent us removed, email us and we will handle it.

California residents

To the extent the California Consumer Privacy Act applies, California residents have the right to know what personal information we collect, use and disclose, and to delete it, correct it and opt out of its sale or sharing. We collect identifiers (such as user IDs, usernames, email addresses and IP addresses), internet activity (such as request logs and product events) and commercial information (such as the paid extensions on your Account and purchase events in Game Data), from the sources and for the purposes described in this policy. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information for any purpose that would require a right to limit its use.

9. Children's privacy

Nebulro Accounts are for people 13 and older. We do not knowingly create Accounts for children under 13 or knowingly collect their personal information through sign-in. Roblox players of any age may play Experiences that run AVS. Their user IDs, and sometimes their display names and activity, reach us when the developer sends Game Data or uses the AVS features described in Section 2.2. We use them only to provide those features and that developer's statistics. We never use player identifiers to contact players, build profiles of them or advertise to them. If you believe we hold information about a child under 13, email support@nebulro.com and we will delete it.

10. Security

We use reasonable technical and organizational measures to protect personal information. Traffic to the Services is encrypted in transit, License Keys are stored only as hashes, and tokens for connected Experiences are encrypted. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. International transfers

We operate the Services from the United States, and our service providers process information in the United States and other countries. Data protection laws in those countries may differ from the laws where you live. Where the law requires it, we use appropriate safeguards for these transfers.

12. Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date at the top of this page. If a change is material, we will give notice on the Services or contact you directly before it takes effect.

13. Contact

If you have questions or requests about this policy or your personal information, contact Nexus Code, LLC at support@nebulro.com.