Privacy Policy

RobloxVerifieds (robloxverifieds.com) is an unaffiliated, third-party tracker for the public verified-badge state of Roblox accounts. This page explains what data we collect, why, and what your rights are. We are not affiliated with, endorsed by, or sponsored by Roblox Corporation.

1. Data we collect about Roblox accounts (without you signing in)

For every Roblox account tracked by the service we record, via Roblox's public APIs:

• Roblox user ID
• Username and display name (current and a short history of past usernames)
• Whether the account currently holds the Roblox verified badge
• The history of verified-badge state changes we observe (date + new state)
• The avatar headshot URL returned by Roblox's thumbnails API (cached, not stored as binary)
• Timestamps for when we first saw the account and when we last rechecked it

All of this is information that anyone can see on the account's public Roblox profile. We do not collect, attempt to obtain, or store private profile fields, friends lists, private messages, payment information, or anything behind authentication on Roblox.

2. Data we collect when you sign in via Roblox OAuth

If you choose to sign in using "Sign in with Roblox" (the OAuth 2.0 flow at apis.roblox.com/oauth/v1/authorize), Roblox will send us:

• Your Roblox user ID (sub)
• Your username (preferred_username) and display name (nickname)
• Your avatar URL (picture)

We request only the openid and profile scopes. We do not request access to your email, inventory, friends, or any other private Roblox data, and we will never be able to act on your behalf on Roblox.

Sign-in is used solely to:

• Identify you in the Shoutbox so other verified users can see who posted a message
• Restrict posting to currently-verified, non-flagged Roblox accounts
• Let you apply as an investigator. Any Roblox account can sign in for this, and an account we don't track isn't added to the site by doing so.

If you link a Discord account, we keep a record of every Roblox account it has been linked to or used to apply with, even after you unlink it. Roblox accounts that share a Discord account are treated as the same person: we link them together, and a flag on one applies to all of them, including the roles in our Discord server.

3. Shoutbox messages

If you post a message in the global Shoutbox while signed in, we store:

• Your Roblox user ID (so we can render your avatar and name)
• The text content of the message
• The timestamp the message was posted

Messages are public: anyone visiting the Shoutbox can read them. Admins may soft-delete individual messages or all messages from a given user. Soft-deleted messages are retained in the database for moderation auditing but are not shown publicly.

4. Browser extension

The RobloxVerifieds Chrome extension shows our data on roblox.com. It sends us:

• The Roblox user IDs shown on pages you visit, so it can look up their status
• If "Help discover verified accounts" is on, the IDs of accounts Roblox shows with a verified badge, including the profile you're viewing when it isn't tracked yet
• Your IP address, as with any request, used only for rate limiting and not stored with the IDs

When you open a profile, the extension loads that profile's public data (followers, groups, games and catalog items) from Roblox in your browser, the same way roblox.com does, and keeps the results in your browser. That data isn't sent to us. The extension never reads your Roblox login. Its settings and cache stay in your Chrome profile, and uninstalling it removes them.

5. Investigator applications

If you apply to be an investigator, we store:

• Your Roblox user ID, username and display name, and your Discord username and ID
• The email name you ask for and your answers on the form
• Whether you were accepted, and any reason we give you if you weren't
• A keyed hash of your IP address instead of the address itself, so we can tell if the same connection applies twice

Only admins can see applications. Linking Discord while applying also adds you to our Discord server. If you're accepted, your @robloxverifieds.com mailbox is hosted by our email provider, MXroute. The site's owner manages these mailboxes and can reset or delete them. Contact us to have your application or mailbox removed.

6. Sponsored placements

Some pages show ads we sell directly to advertisers. Ad images are served from our own server. We use no ad networks, third-party ad scripts or tracking pixels.

We count how many times each ad is seen and clicked, and keep only the totals. To avoid counting the same visitor twice, your IP address is held in memory for 30 minutes and never written to disk. Clicking an ad takes you through a robloxverifieds.com link to the advertiser's site, which has its own privacy policy.

7. Donations

Donations go through Ko-fi, which handles the payment. Ko-fi tells us the amount, the name and message you gave, and your email. We keep the amount, name and message, plus a one-way hash of your email so separate donations from you add up; the email itself isn't stored. If your message has a Discord username, we look it up in our Discord server to give you a supporter role, and keep your Discord user ID with the donation.

8. Cookies

The service sets the following first-party cookies. We use no third-party analytics or trackers.

• rvf_session: set after you successfully sign in via Roblox OAuth. Contains a random 64-character session ID that maps to a row in our database. HttpOnly, SameSite=Lax, Secure in production. 30-day lifetime.
• rvf_oauth_state: set only during the OAuth handshake to prevent CSRF. Auto-deleted after the callback (10-minute lifetime).
• rvf_applicant: set when an account we don't track signs in to apply as an investigator. Contains a random ID for your Roblox and Discord details while you apply. HttpOnly, 7-day lifetime.
• rvf_admin: set on admin login. Only present if you are an administrator of the service.

9. How long we keep your data

• Tracked-account data (username, verified state, history) is kept indefinitely while the account remains tracked, because the historical record is the point of the service. Use the opt-out flow (below) to hide it from public view. If you want it hard-deleted from the database, contact us.
• Sessions expire automatically after 30 days, or immediately when you click "Sign out."
• Shoutbox messages are retained indefinitely. Soft-deleted messages remain in the database for moderation history; if you want them hard-deleted, contact us.

10. Your rights

You can have your data removed from the service at any time:

• Opt out: hides your account from all public lists and disables sign-in features for that account. Opt-out does not delete any underlying data; you can opt back in at any time by signing in with Roblox again, and your prior data (history, links, moderation flags) will be restored. We retain moderation flags across opt-out / opt-in cycles so that bad actors cannot escape moderation by opting out.
• For full hard deletion of all data including Shoutbox messages, history, and sessions, contact us (below).

11. Data we share

We do not sell or share your data with third parties. The publicly-visible tracked-account pages are, by design, readable by anyone who visits the site (just like a Roblox profile is). Roblox itself receives standard OAuth callback parameters when you sign in. Investigator mailboxes are hosted by MXroute, and advertisers only ever see total view and click counts.

12. Security

Session IDs are cryptographically random (256 bits). The OAuth client secret is stored only in server-side environment variables. The database is stored on the server's file system and is not exposed to the public internet. We take reasonable measures to protect against unauthorized access but no service is ever 100% secure.

13. Children

Roblox accounts may be operated by minors. Where this is the case, only the public profile information about that account is collected (the same information already publicly visible on Roblox). We do not knowingly request, store, or process personally-identifying information beyond what Roblox already exposes publicly.

14. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of the page will reflect any change. Material changes will be highlighted on the home page.

15. Contact

For data-deletion requests, opt-out reversal, or any other privacy-related question, contact @.chloe on Discord.