Privacy policy
This policy explains what Rostack collects about you, why, where it is stored, how long it is kept, and how to get it back or remove it. It is written to be read.
Last updated 8 September 2026
Who is responsible
Rostack is operated by an individual, not a company. The operator of rostack.app is the data controller for the personal data described here. For any question about this policy, or to exercise a right that is not self-service, write to privacy@rostack.app.
What is collected, and why
| Data | Where it comes from | Why | Legal basis |
|---|---|---|---|
| Roblox user ID, username, avatar URL | Roblox, when you sign in with Roblox | To identify you and show who did what | Performing the service you asked for |
| Email address and password hash | You, if you add an email | Account recovery, and a way to reach you about a failed payout | Performing the service; your consent to add it |
| Authenticator secret (encrypted) | Generated when you enrol | Second factor for payouts | Performing the service; security |
| Workspace seats, permissions, invitations, warnings | Workspace administrators | Running the community's staff management | Performing the service; legitimate interest of the community |
| Audit log entries naming you as the actor | Generated by your actions | Accountability for actions that affect real Roblox groups | Legitimate interest; legal claims |
| Payout ledger lines naming your Roblox account | Generated by payout runs | Financial record of Robux paid | Legal obligation to keep financial records |
| Roblox credentials you connect (encrypted) | You | Ranking and payouts on your behalf | Performing the service; your explicit consent |
Rostack does not collect your location, your device fingerprint, your browsing on other sites, or anything for advertising. There are no analytics or advertising trackers on the site.
Cookies
Rostack sets exactly one persistent cookie, __session, which keeps you signed in for fourteen days. It is httpOnly, Secure and SameSite=Lax. During sign-in with Roblox a second cookie holds a random value for ten minutes to prevent login forgery. Both are strictly necessary to provide the service you requested, which is why there is no cookie banner: there is nothing optional to consent to.
Where data is stored and who processes it
Data is stored on Google Cloud in the United States (Firestore multi-region nam5). Google processes it on Rostack's behalf under the Google Cloud Data Processing Addendum, which incorporates the European Commission's standard contractual clauses for transfers out of the EEA and the UK.
| Processor | What they process | Why |
|---|---|---|
| Google Cloud (Firebase, Cloud Run, KMS) | Everything above | Hosting, database, authentication, encryption keys |
| Roblox Corporation | Your Roblox user ID and group IDs | Rostack calls Roblox's APIs to read groups and change ranks; Roblox is a separate controller of its own data |
Rostack does not sell personal data and does not share it for advertising.
How long data is kept
| Data | Kept for |
|---|---|
| Session cookie | 14 days, or until you sign out |
| Account, profile, authenticator | Until you delete your account |
| Your staff record in a workspace | Retained as that community's employment record. Deleting your account removes the link to it and your stored avatar; what stays names only your Roblox user ID |
| Warnings recorded against you | Until you delete your account |
| Unaccepted invitations | 7 days, then they expire |
| Application form answers | Until the join request is accepted or declined, or 90 days, whichever comes first; deleted with your account |
| In-game activity and session attendance | Retained against your Roblox user ID, as the community's record of work done |
| Time off requests and promotion recommendations | Retained against your Roblox user ID, as the community's record of decisions made |
| Moderation bans | Until a moderator lifts them or they expire; deleting your account does not lift them |
| Audit log | Retained; your name is replaced with "deleted user" if you delete your account |
| Payout ledger | Retained as a financial record |
| Connected Roblox credentials | Until you replace or remove them |
Your rights, and how to use them
Under the GDPR, the UK GDPR, the CCPA and similar laws you can access, take with you, correct, delete and object to the processing of your personal data. Most of this is self-service in Settings so that you do not have to ask:
| Right | How |
|---|---|
| Access and portability | Settings, Download my data. A JSON file of everything Rostack holds about you. |
| Erasure | Settings, Delete account. Immediate. The confirmation screen lists exactly what is removed and what is retained. |
| Rectification | Change your email in Settings. Your Roblox username and avatar come from Roblox; change them there and they update at your next sign-in. |
| Objection, restriction, complaints | Write to privacy@rostack.app. |
What deletion retains, and why: audit log entries you authored, with your name replaced, because they are the evidence trail for actions that affected other people's groups; payout ledger lines that paid your Roblox account, as financial records; and join-request decisions about your Roblox user ID, which record a decision another community made. These identify a Roblox user ID, which is public on Roblox, and no longer identify a Rostack account.
If you are in the EEA or the UK you can also complain to your local data protection authority. California residents will not be discriminated against for exercising any of these rights.
Age
Rostack is for people who administer Roblox communities. You must be at least 16 years old to create an account. Rostack does not knowingly collect personal data from anyone younger; if you believe it has, write to privacy@rostack.app and it will be deleted.
If something goes wrong
If a breach affects your personal data, Rostack will tell you and, where the law requires it, the relevant authority, within 72 hours of becoming aware of it, and will say what happened and what to do.
Changes to this policy