Privacy policy

Who we are

RBLX.SI (“we”) is an independent community directory of Roblox projects, tools and creators built with AI. It is not affiliated with or endorsed by Roblox Corporation. Questions or requests: hello@rblx.si.

What we collect

If you only browse

No account is needed. We set no cookies for anonymous visitors. Our hosting provider (Cloudflare) processes your IP address and request details to deliver the site and protect it from abuse. If product analytics is enabled (see below) it records pageviews without cookies.

If you create an account

• Sign-in details. Your name, avatar, and email address if the provider shares one, from GitHub, X, Roblox or your email sign-in. For X and Roblox we may not receive an email at all.
• Linked identities. Your public handle on each provider you link (for example your X @handle, GitHub login or Roblox user id). We use these only to verify that you own the projects, tools or profiles you claim. We read the handle once with a short-lived token and do not keep the provider’s access tokens. We never post or act on your behalf.
• Session data. When you are signed in we store a session with your IP address and browser type for security, for up to 30 days.
• What you add. Submissions, listings you manage, your public profile, build stories, images you upload, workflows, votes, saves, ownership claims (including the evidence we matched), owner edits, and promotion requests (company and contact details you give us).
• Activity log. An internal record of ownership, moderation and account actions (who did what, when) so decisions can be audited.
• Notification preferences. Whether you want outcome emails.

Information we fetch about links you submit

When you paste a link we read public information from the source (an X post via X’s official embed API, a Roblox experience via Roblox’s public APIs, a YouTube video, a GitHub repository, or a website’s title and preview image) and keep it as the listing’s provenance. We do not scrape private content. A public source does not mean its author has endorsed or submitted a listing.

Why we use it

• To run the directory: show listings, let people claim and manage them, moderate submissions, and prevent abuse and spam (legitimate interests, and contract with you where you have an account).
• To verify ownership and keep the “Claimed” and “Verified” marks honest (legitimate interests).
• To email you about things you did, such as a submission decision or a claim result, and to alert admins to items needing review. You can turn the outcome emails off.
• To understand which pages and features are used, so we can improve the site (analytics, below).

We do not sell personal data and we do not use it for third-party advertising. Paid placements on the site are labelled and are not based on tracking you.

Analytics

We use PostHog for product analytics. It is set up to be privacy-light: requests go through our own domain, there is no session recording, no heatmaps, no automatic capture of clicks, typing or text, and nothing stored on your device (no cookies, no local storage). We use PostHog’s cookieless mode: PostHog’s servers (hosted in the EU) derive a short-lived anonymous identifier from your IP address and browser type with a key that rotates daily, so a visit can be counted without recognising you across days or linking you to an account. We record pageviews, a handful of deliberate button clicks (for example “Play” or “Submit”), and anonymous page-speed measurements (Core Web Vitals). Query strings are removed from URLs, private pages (dashboard, admin, sign-in) are never sent, and the browser’s Do Not Track and Global Privacy Control signals are respected. For a few actions (for example submitting a listing or upvoting) the server sends an event keyed to a salted hash of your user id, never your email or name.

Who else handles data

• Cloudflare: hosting, database (D1), file storage (R2) and caching.
• Resend: sending sign-in links and notification emails.
• GitHub, X and Roblox: only if you choose to sign in or link with them; their own policies apply to your account there.
• PostHog (EU region): analytics.

Some pages load images from other services’ CDNs (for example Roblox and YouTube thumbnails), which can see your IP address like any image request. We do not load X’s or YouTube’s players until you click to load them; when you do, that service’s own terms and cookies apply.

Cookies

After you sign in we set one strictly necessary cookie (rblxsi.session_token; HttpOnly, Secure, SameSite=Lax; up to 30 days) so you stay signed in, plus short-lived cookies during the sign-in handshake. We use no advertising or tracking cookies, so there is no cookie banner.

How long we keep it

• Sessions: up to 30 days. Rate-limit counters: minutes to an hour.
• Account data: until you delete your account. Public listings you submitted stay on the site but become unowned (you can ask us to remove them).
• Activity log entries: kept for accountability; they may remain after account deletion in de-identified form where reasonably possible.
• Backups held by our infrastructure provider expire on their own schedule.

Your rights and choices

• Access and export: Dashboard → Account → “Download my data”.
• Correction: edit your profile and listings in your dashboard.
• Deletion: Dashboard → Account → “Delete my account” removes your login, linked identities, votes, saves and ownership.
• Email choices: Dashboard → Account → Notifications.
• Listings about you or your work: if something is listed that you want corrected or removed, claim it, or email us.

If you are in the EU, UK or a similar jurisdiction you also have the rights to object to or restrict processing, and to complain to your data-protection authority. Email hello@rblx.si for anything the self-service tools don’t cover.

Children

Roblox has many young users, but RBLX.SI accounts are for people aged 13 or over (or the minimum age in your country, if higher). Browsing needs no account. We do not knowingly collect personal data from children under 13; if you believe we have, email us and we will delete it.

Security

Access is restricted to the people who run the site, sessions are protected with secure cookies, uploads are validated, and we limit what we store. No system is perfectly secure; tell us promptly if you find a problem.

Changes

We will update this page when our practices change and revise the date above. Significant changes will be announced on the site.