Privacy Policy

1. What we collect

Account data: your username, a password (stored only as a one-way bcrypt hash — never in plain text), an optional email address, the date and time your account was created, and the fact that you accepted this Privacy Policy when you registered.

Security data: your IP address, which is encrypted before it is ever written to our database. The plain-text form is discarded immediately and is only used in memory to detect shared connections and to stop the same device from creating two unverified accounts in a row. We do not sell or expose it.

Service data: the Roblox username you attach to your license for whitelisting, the license key that is bound to your account, and the session cookie that keeps you logged in (an httpOnly token that expires when you log out).

Game telemetry: when the service runs in a Roblox experience, that server sends us the game's place ID, server job ID, the number of players present and the Roblox user IDs of the players in it, plus execution records for scripts you ran through the service so moderators can review abuse reports.

Moderation data: strikes issued against your account, blacklist records, moderation notes, and warning records for scripts you submit.

Captcha data: sign-up and login protection is provided by Cloudflare Turnstile. The challenge token is redeemed with Cloudflare — we keep none of it.

2. Why we collect it

To provide the service you bought: keeping your account working, binding your license, and whitelisting the Roblox accounts you use (performance of our contract with you).

To keep the service safe: enforce the rulebook, issue strikes, block repeat abusers, limit accounts per device, and investigate incidents (our legitimate interests in security and fraud prevention).

To comply with law: responding to lawful requests, keeping required records.

You confirm you are 13 or older and accept this policy in the same action as sign-up — that consent is recorded permanently (the date and the policy version) and covers the rest of the processing described here. You can withdraw consent by requesting account deletion (section 5).

3. Who we share it with

We do not sell your data, and we do not share it with advertisers. It is processed only by the providers that make the service run: our hosting provider (application), our managed database provider (storage), Cloudflare (captcha), Roblox (public profile names and game thumbnails used to display whitelisted accounts and running games), and Discord (support tickets you choose to open).

We may disclose data if the law requires it or to protect the rights, property, or safety of the service, its users, or others — for example, to prove abuse of an account to Roblox or a host.

Your public profile information (username, badges) may be shown to staff inside the dashboard. Moderator accounts can see moderation records; owners can see account administration screens. No other user can see your data.

4. How long we keep it

Account, license, and whitelist data is kept while your account is active.

Security data (encrypted IP records) is kept with the account lifetime so the device limit keeps working, and is deleted when your account is deleted.

Strike and blacklist records are kept for as long as needed to enforce no-repeat-abuser decisions, even after the related account is gone.

Game telemetry and execution records are kept on a rolling basis for moderation review and are cleaned up automatically over time.

When you ask us to delete your account, we erase or fully anonymise everything not covered by the enforcement exception above.

5. Your rights

You have the right to access your data, correct it, restrict processing, object, request portability, and request erasure — no matter which country you live in; we apply these rights to everyone, everywhere.

To exercise any of them, open a ticket in our Discord server (link at the bottom of every page). Tell us which right you are using and the account it applies to. We answer within 30 days.

Deletion requests end your service: the account, its license binding, and its whitelists are removed.

If you believe we mishandled your request, you can complain to your local data protection authority — but please give us the chance to fix it first.

6. Children

The service is not directed at children under 13 and we do not knowingly collect their personal data. If we learn an account belongs to a child under 13, we delete it.

In-game conduct is additionally governed by Roblox's own terms, because the software only runs inside Roblox experiences.

7. How we protect your data

Passwords are hashed with bcrypt, never stored or logged in plain text.

IP addresses are encrypted at rest; plain-text copies exist only for the seconds it takes to compare them during the anti-abuse check.

Sessions are httpOnly cookies, and owner-level screens sit behind additional checks.

No system is perfect; if a breach ever affects your data, we will tell you without undue delay.

8. Changes to this policy

This policy is version 1.0, effective 18 October 2026. If we make a material change we will post the new version here and, for registered users, ask for acceptance again where the law requires it.

Continuing to use the service after a change takes effect means you accept the updated policy.

9. Contact

The service is operated by Mango. The fastest way to reach us is the Discord server linked below — open a ticket and staff will route it to the right person.

Questions about this policy, data access, corrections, or deletion all start in the same place.