Privacy Policy
Luaudit is a small tool run from the UK. This page explains what we collect, why, and what you can ask us to do with it. We've kept it as short and plain as we can.
Who we are
Luaudit is run by Chopskie, an independent developer based in the United Kingdom. Under UK data protection law (the UK GDPR and the Data Protection Act 2018), we're the controller of the personal data described on this page.
If you have a question about any of it, email [email protected].
The short version
- We only see your game code if you connect the Luaudit Studio plugin, and then we keep it encrypted for up to 15 minutes.
- We keep only what we need to run your account and your API keys.
- We don't sell your data, and we don't use it to train AI models.
- You can delete your account yourself at any time.
Your game code
Luaudit works through MCP. When you connect it, our server gives your AI an audit guide, the security checks and the report format. It doesn't log what your AI asks or what it finds.
If your AI reads your scripts itself, from Roblox Studio's own MCP connection or from your project files, or you paste them into a chat, your code is never sent to us.
If you connect the Luaudit Studio plugin, it sends your place's scripts to our server when your AI asks for them, and our server passes them to the AI using the same key. So your AI can read them, they wait for up to 15 minutes in a short-lived store run by Upstash, encrypted with a key worked out from your Luaudit key, and are then deleted automatically. We keep only a one-way hash of your Luaudit key, so the stored scripts can't be read without it: our server decrypts them only while answering a request made with that key. We never log them, share them or look at them. You can disconnect the plugin at any time.
Because your scripts are handled by your AI provider (for example Anthropic or OpenAI), that part is covered by their privacy terms, not ours. It's worth checking how your provider treats the content you share with it, including whether it can be used for training.
What we collect
- Your sign-in details. If you sign in with email, your email address. If you sign in with Roblox, your Roblox user ID, username and the basic profile details Roblox shares when you sign in. We never see your Roblox password.
- Your API key. We store a one-way hash of your key, not the key itself, along with its first 10 characters so you can recognise it, when you made it and when it was last used.
- Key usage counts. To spot a shared key, our server notes which networks a key is used from and counts its requests. For each network it keeps a scrambled code made from the first part of the IP address (the first three numbers of an IPv4 address, or the first three groups of an IPv6 address) and your key, never the address itself. These codes and counts are kept in Upstash for up to an hour, then deleted automatically.
- Your waitlist email. If you join the waitlist for hosted audits, your email address and when you joined.
- Tool call logs. Each time your AI calls a Luaudit tool, our server logs the time, the tool name and which key was used (its label, or its first 10 characters). Nothing else.
- Standard service logs. Our hosting and sign-in providers keep their own security and request logs, which can include IP addresses, browser details and error messages.
That's the full list. We don't take payments yet, so we hold no billing details.
Why we use it
The law asks us to name a reason (a "lawful basis") for each use. Ours are:
- To provide the service you signed up for (contract). Signing you in, running your account, checking your API keys.
- To tell you when hosted audits launch (consent). We use your waitlist email for that and nothing else. You can withdraw consent at any time by asking us to remove it.
- To keep Luaudit secure and working (legitimate interests). Preventing abuse, spotting leaked keys and fixing problems.
- To meet our legal obligations, such as keeping or sharing something when the law requires it.
How long we keep it
We keep your account and keys while your account exists. When you delete your account, your sign-in details and all your keys are deleted straight away. A revoked key is deleted as soon as you revoke it.
We keep a waitlist email until we've told you hosted audits are available, then delete it. Email [email protected] and we'll remove it sooner.
Key usage counts are deleted automatically within an hour.
Logs are kept only for the limited period our hosting and sign-in providers hold them, then deleted.
Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Correct anything that's wrong or out of date.
- Delete your data. You can do this yourself from the dashboard settings.
- Object to how we use it, including any use based on legitimate interests.
- Take a copy of the data you gave us.
To use any of these, email [email protected]. It's free, and we'll reply within one month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd be grateful for the chance to put it right first.
Younger developers
Plenty of great Roblox developers are young, but Luaudit isn't for anyone under 13. If you're under 18, please ask a parent or guardian before signing up. If we find out we're holding data from a child under 13, we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top. If the change affects you in a meaningful way and your account has an email address, we'll email you before it takes effect.
Contact
Email [email protected] with any privacy question. See also our Terms of Service.