Privacy policy

What we store

• Your account: email address, display name, a hash of your password, and hashes of your sign-in sessions.
• Roblox sign-in: your Roblox user ID, username and avatar. shipLua never asks for, sees or stores your Roblox password or cookie.
• Roblox connections: the Open Cloud access tokens you approve, encrypted at rest and used only for the read access you granted.
• Your studio’s work: experiences, tasks, releases, audit results and findings, agent runs and approvals.
• Uploaded place files: scanned in memory and not kept. Only the audit facts and findings are saved, with a few lines around each finding and credentials masked.
• Activity and server logs: who did what and when, with IP address and browser, for security.

The full list, with how long each item is kept, is on the data handling page.

Who can see it

Only members of your studio, according to their role. Workspaces are isolated from each other in code and in the database. We do not sell your data or use it for advertising.

Who processes it for us

• Roblox, through its official APIs, to read the data you connect.
• Render, which hosts the website, API and database.
• Our email provider, to send sign-in and account emails.
• Anthropic, only for optional AI features your studio turns on, and only with your studio’s own data. Scripts sent for AI review are sealed and erased when the review ends, or after 24 hours if it never runs.

Cookies

One sign-in cookie to keep you logged in. No advertising or tracking cookies.

Deleting your data

Self-service deletion of accounts and studios is in development. Until then, ask through the contact page and we will delete your account or studio, except activity log entries we must keep for security.

Contact

Questions about your data: use the contact page.