Privacy Policy
Effective November 11, 2026 · Version 1.3
We collect only the information needed to operate account verification and your server's configured features. Roblox public profile information is fetched when requested rather than copied into our account database.
1. Data we store
- Discord server ID and Discord user ID.
- Roblox account identifier (
sub, the Roblox User ID). - Verification status and verification/update timestamps.
- Server settings, saved embed/message templates, per-command embed bindings, verification panel channel/message IDs, and the creator's Discord ID.
- Your per-server public announcement and command visibility preferences (public verification announcements disabled by default; public member commands enabled by default); partner API-key identifiers, hashed keys, access scopes, and your explicit sharing permissions if applicable.
- Temporary OAuth state and PKCE verifier, which expire after 10 minutes and are deleted upon successful callback consumption.
2. Data we fetch but do not persist in the account database
When needed for a command or message template, SkyRoblox may request public Roblox data such as username, display name, account creation date, avatar thumbnail, description, group memberships/ranks, public friend/follower counts, official badges, user-created public games, past usernames, and avatar items. These results are used in memory for the current command. The stored account table does not contain avatar URLs or profile snapshots.
3. Data we do not request
SkyRoblox does not ask for Roblox passwords, security cookies, phone numbers, payment card details, private messages, or email addresses through its openid profile sign-in. OAuth access tokens are only used briefly during verification and are not saved to the account database.
4. Why we use your information
To link account identities, apply configured roles and nicknames, show requested public Roblox data, prevent duplicate links within a server, support admin-managed notifications, and authorize partner integrations only after your sharing consent.
5. Sharing and third parties
Your account link is not openly searchable through a public API. A registered partner needs a scoped API key and your /sharing grant permission to access the corresponding fields. Server administrators can inspect members’ account links with /whois. Successful verification notices are private by default. Only users who turn on public verification announcements through /mysetting may have a public success notice posted by the bot. Member command results are public by default; use /mysetting to make them private. This does not delete messages already published in Discord. If a message is published, it is stored by Discord according to Discord's policies and may remain after unlinking. Requests may pass through hosting/network providers including Cloudflare. Roblox supplies public profile information and Discord processes bot messages.
6. Storage, retention and security
The verification records are stored in Cloudflare D1. They remain while an account is linked in the server and are deleted when you use /unlink; partner grants for that link are deleted too. Removing SkyRoblox from a guild triggers removal of that guild's stored configuration and links when the bot receives the removal event. Operational/provider logs and backups may follow their separate retention policies. We use scoped authorization, HTTPS and hashed partner keys, but no internet service can guarantee absolute security.
7. Your controls
Use /mysetting to choose private/public command responses and success announcements, /info to view your linked account, /unlink to remove it, /sharing list to review partner consent, and /sharing revoke to withdraw access. For other data requests or corrections, contact [email protected].
8. Cookies and analytics
The included website does not intentionally set tracking cookies or load advertising analytics. Verification uses a short-lived OAuth authorization state passed in URLs; no persistent browser session is required by SkyRoblox. To update the original private Discord response, the bot temporarily keeps its interaction reference in server memory for less than 15 minutes, without storing its token in the D1 database.
9. International processing
Hosting and third-party services may process data outside your country. Their own policies govern data they independently process. We do not claim a specific storage region unless configured and confirmed by the operator.
10. Updates and contact
We may update this policy as features change, with a revised effective date. Contact [email protected] for privacy questions or deletion assistance.