Privacy notice
Last updated 13 October 2026
Who we are
RoScripts (roscripts.io) is run by Sirius. We are the controller of the personal data described here.
Privacy questions and requests: [email protected]. You can also reach staff through our Discord, but please use email for anything that involves your personal data.
RoScripts shares one account system with other Sirius products, including the Sirius Developer Platform (developer.sirius.menu). Your Sirius account (username, email, password, Discord link, role, Pro status and bans) is the same record in each of them, and Sirius is the controller for all of it.
What we collect and why
Account data. Username, email, password (stored only as a salted hash), profile picture, settings, sign-up and last-seen dates, and whether you are verified, staff, upload-blocked or banned. We need this to give you an account (contract).
Discord. If you sign in with or link Discord, we keep your Discord user ID, username and a copy of your Discord avatar, which we store on our own storage so we don't hotlink Discord. To let you upload, our Discord bot checks whether you are a member of the RoScripts Discord server and what roles you hold there; the answer is cached for up to 10 minutes. Staff roles are synced from that server. (Contract; legitimate interests in limiting uploads to accountable members.)
What you publish. Listings, script source and versions, thumbnails, tags, comments, votes, saves and reports. Listings and comments are public. (Contract.)
Security and sign-in data. For each sign-in session we keep your IP address and browser user agent. Password-reset requests record the IP that asked. An audit log records security events on your account (sign-ins, email and password changes, staff actions) with IP and user agent. We also keep short-lived counters keyed on IP address to rate-limit sign-in and other actions. We use Cloudflare Turnstile on sign-up to stop bots. (Legitimate interests: keeping accounts secure and preventing abuse.)
Usage and analytics. When a script is fetched through our loader (script.roscripts.io) or our public API (api.roscripts.io), we record the listing, the country the request came from (from Cloudflare) and basic request details, without your IP address, in Cloudflare Analytics Engine. Listing views and runs are counted once per IP per hour using a temporary counter. Search terms are counted in aggregate with no account or IP attached. We use this to rank listings and show counts. We don't run ads, sell data or use third-party tracking. (Legitimate interests: running and improving discovery.)
Moderation and abuse prevention. Reports about you or your content, strikes, sanctions (upload blocks, suspensions, bans), and notes and flags staff add to your account. To stop banned people coming straight back, we keep ban-evasion signatures: a banned Discord account ID, an email domain used only for abuse, and hashes or URLs of scripts confirmed malicious. (Legitimate interests: protecting users from malware and scams and enforcing our rules. We limit these records to what moderation needs, never use them for anything else, and you can object or ask about them using the contact above.)
Malware scanning (Scriptsight). Every uploaded script is scanned automatically. Parts of the source, and the listing's title and description, are sent to AI model providers (OpenAI and Anthropic) to judge whether the script is harmful, and to a GitHub Actions job that runs the scan. We send the script and listing text, not your account details. (Legitimate interests: keeping malicious scripts off the site.)
Verification. If you apply for the verified badge, we keep your application, the social links you give and staff's decision. (Contract; legitimate interests.)
Username history. When you change your username we keep the old one so nobody else can take it straight away and impersonate you. (Legitimate interests.)
Staff view-as. Moderators can view the site as a specific non-staff user, read-only, to investigate a problem. It needs a link issued to that staff member, lasts at most 15 minutes, can't change anything or open your account settings, and every use is logged. (Legitimate interests: support and moderation.)
RoScripts Pro billing. Payments are handled by Stripe through the Sirius Developer Platform. We keep your Stripe customer and subscription IDs and your Pro dates; we never see or store your card details. (Contract; legal obligation for financial records, which Stripe and the Sirius Developer Platform keep.)
Email. We send transactional email only: verification, password reset, security notices (such as an email change), verification decisions and ban notices.
Who we share it with
We share personal data only with these service providers, each for the purpose stated:
- Cloudflare: hosting, databases, file storage, security, Turnstile, logs and analytics. All data passes through Cloudflare.
- Stripe: payments for RoScripts Pro.
- Discord: sign-in, account linking, and the server-membership and role check.
- OpenAI and Anthropic: malware scanning of uploaded script source and listing title and description.
- GitHub (GitHub Actions): runs the scanning job and deploys the site.
- Resend: sends our email.
- Roblox: we look up public game details for the game a listing is for. No personal data is sent.
- IndexNow (search engines): we notify them of new public listing pages. No personal data is sent.
- Other Sirius products, which share the same account record (see above).
Public content (listings, comments, your username, avatar and profile) can be seen by anyone, and listings are available through our public API. We may also disclose data where the law requires it or to protect people from harm.
International transfers
Several of these providers are based in, or process data in, the United States and other countries outside the UK and EEA. Where a provider processes data outside the UK or EEA, the transfer relies on that provider's data processing terms incorporating the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or on the UK–US Data Bridge where the provider is certified under it.
How long we keep it
| Data | Kept for |
|---|---|
| Account (username, email, password hash, profile, Pro status) | Until you delete your account. |
| Sign-in sessions, with IP address and browser user agent | 7 days from sign-in, then deleted. |
| Password-reset and email-verification requests (reset requests include the requesting IP) | Deleted 7 days after the link expires (links last 1 to 24 hours). |
| Account audit log (sign-ins, security changes) and staff action log | Events are kept while the account exists; the IP address and user agent on them are erased after 90 days. |
| Short-lived counters keyed on IP address (rate limits, view and run counting) | Between 1 minute and 24 hours, then they expire automatically. |
| Per-request country (API and script loader), in Cloudflare Analytics Engine | Up to about 3 months (Cloudflare's retention for that product). |
| Cloudflare Worker logs (a sample of requests, plus errors) | Up to 7 days (Cloudflare Workers Logs). |
| Search terms (aggregated, with no account or IP attached) | Daily counts 14 days; running totals deleted 90 days after a term was last searched. |
| Listings, versions, source code, comments | Until you or staff delete them. On account deletion you choose to delete them or leave them attributed to [deleted]. |
| Votes, saves, comment votes | Until you remove them or delete your account. |
| Username history | While the account exists (used to reserve old names and stop impersonation). |
| Verification applications | While the account exists. |
| Moderation records: reports, strikes, sanctions, staff notes and flags | While the account exists. Strikes stop counting after 180 days but stay on record. Reports you filed are kept without your account id after deletion. |
| Ban-evasion signatures (a banned Discord ID, an email domain, hashes or URLs of malicious scripts) | Until staff revoke them or they expire. |
| Staff view-as entries | Kept in the staff action log; the IP on the entry is erased after 90 days. |
When you delete your account, everything tied to it in the table is deleted at that point, except where the table says otherwise (reports you filed, staff action logs, ban-evasion signatures and any content you chose to leave up as [deleted]). Deleted data can remain in Cloudflare D1's point-in-time recovery (Time Travel) for up to 30 days, after which it is gone.
Your rights
Under UK GDPR you can ask for a copy of your data, have it corrected, have it deleted, restrict or object to how we use it (including anything we do on the basis of legitimate interests), and take it to another service. Contact us at the address above; we reply within one month.
Export. In account settings you can download a JSON file of your account data: your account record, username history, Discord link, sessions (with IPs and user agents), password-reset requests, audit log, verification applications, strikes and sanctions, API key details, your listings with every version's source, comments, votes, saves and reports you filed. Credentials (password hash, security tokens, API key secrets) are left out. Staff notes and ban-evasion signatures aren't in the file; ask us for them.
Delete. Also in account settings. If RoScripts Pro is active we cancel it first; if that fails, nothing is deleted and we tell you. Deletion removes your account, sign-in sessions, Discord link, profile picture, votes, saves, verification applications and moderation records, and revokes your API keys. You choose whether your listings and comments are deleted or stay up attributed to [deleted]; listings that are under an open malware or theft report, or that staff removed, are kept as [deleted] for moderation. Deleting is permanent.
You can also change your username, email, picture and connected accounts in settings.
If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to sort it out first.
Children
You must be at least 13 to make a RoScripts account. Many people interested in Roblox scripts are young, so we keep collection to what the site needs, don't profile or advertise to anyone, and don't show email addresses publicly. If you believe a child under 13 has an account, contact us and we'll delete it.
Changes
We'll update this page when what we do changes, and change the date at the top. Significant changes will be announced on the site or by email.