Cookie policy

Cookies

• `__Host-lf_session` (strictly necessary): keeps you signed in. HttpOnly, Secure, first-party. Lasts until you sign out or the session expires.
• `__Host-lf_device` (strictly necessary, security): set after you sign in, so this browser can skip the “confirm you are a person” check next time. A random value; we store only its hash with your account. HttpOnly, Secure, first-party. Lasts 90 days, and stops working when you change or reset your password.
• `__Host-lf_oauth` and `__Host-lf_signup` (strictly necessary): carry a Roblox sign-in or sign-up that is in progress, so the reply from Roblox can be checked. HttpOnly, Secure, first-party. Deleted after 15 minutes or less.
• `lf-theme` (preference): remembers your theme setting (dark unless you change it) so the dashboard opens in it without a flash. First-party, kept for a year, set only when you use the dashboard.

Browser storage

Your browser’s local storage keeps small settings on your device, such as your theme, the last studio you opened and choices you made on screens like AI review. These settings never leave your browser and you can clear them in your browser settings.

One item is sent to us: a random browser id (shiplua.device) that is not tied to your hardware. The app sends it with each request so we can block a banned person from signing in again from the same browser, and we keep a hashed copy with your sign-in sessions. Clearing site data, a private window or another browser makes a new one.

What we do not use

No advertising cookies, no tracking pixels, no third-party analytics and no cross-site tracking. Fonts are served by shipLua itself. Game thumbnails load from Roblox’s image servers (rbxcdn.com), which see your IP address like any image request but do not get a shipLua cookie. The one third-party script is Cloudflare Turnstile, loaded on the login page only when a sign-in has to confirm it is a person, to stop automated password guessing; it is used for security, not tracking.

Why there is no cookie banner

Every cookie above is either needed to sign you in or keeps a setting you chose, so privacy laws such as the EU and UK rules do not require asking first. If we ever add a cookie that is not needed, we will ask before setting it and update this page.

Contact

Questions: email support@shiplua.com. See also the privacy policy.