Privacy Policy

RobloxVerifieds (robloxverifieds.com) is an unaffiliated, third-party tracker for the public verified-badge state of Roblox accounts. This page explains what data we collect, why, and what your rights are. We are not affiliated with, endorsed by, or sponsored by Roblox Corporation.

1. Data we collect about Roblox accounts (without you signing in)

For every Roblox account tracked by the service we record, via Roblox's public APIs:

• Roblox user ID
• Username and display name (current and a short history of past usernames)
• Whether the account currently holds the Roblox verified badge
• The history of verified-badge state changes we observe (date + new state)
• The avatar headshot URL returned by Roblox's thumbnails API (cached, not stored as binary)
• Timestamps for when we first saw the account and when we last rechecked it

All of this is information that anyone can see on the account's public Roblox profile. We do not collect, attempt to obtain, or store private profile fields, friends lists, private messages, payment information, or anything behind authentication on Roblox.

2. Data we collect when you sign in via Roblox OAuth

If you choose to sign in using "Sign in with Roblox" (the OAuth 2.0 flow at apis.roblox.com/oauth/v1/authorize), Roblox will send us:

• Your Roblox user ID (sub)
• Your username (preferred_username) and display name (nickname)
• Your avatar URL (picture)

We request only the openid and profile scopes. We do not request access to your email, inventory, friends, or any other private Roblox data, and we will never be able to act on your behalf on Roblox.

Sign-in is used solely to:

• Identify you in the Shoutbox so other verified users can see who posted a message
• Restrict posting to currently-verified, non-flagged Roblox accounts

3. Shoutbox messages

If you post a message in the global Shoutbox while signed in, we store:

• Your Roblox user ID (so we can render your avatar and name)
• The text content of the message
• The timestamp the message was posted

Messages are public — anyone visiting the Shoutbox can read them. Admins may soft-delete individual messages or all messages from a given user. Soft-deleted messages are retained in the database for moderation auditing but are not shown publicly.

4. Cookies

The service sets the following first-party cookies. We use no third-party analytics or trackers.

• rvf_session — set after you successfully sign in via Roblox OAuth. Contains a random 64-character session ID that maps to a row in our database. HttpOnly, SameSite=Lax, Secure in production. 30-day lifetime.
• rvf_oauth_state — set only during the OAuth handshake to prevent CSRF. Auto-deleted after the callback (10-minute lifetime).
• rvf_admin — set on admin login. Only present if you are an administrator of the service.

5. How long we keep your data

• Tracked-account data (username, verified state, history) is kept indefinitely while the account remains tracked, because the historical record is the point of the service. Use the opt-out flow (below) to hide it from public view. If you want it hard-deleted from the database, contact us.
• Sessions expire automatically after 30 days, or immediately when you click "Sign out."
• Shoutbox messages are retained indefinitely. Soft-deleted messages remain in the database for moderation history; if you want them hard-deleted, contact us.

6. Your rights

You can have your data removed from the service at any time:

• Opt out — hides your account from all public lists and disables sign-in features for that account. Opt-out does not delete any underlying data; you can opt back in at any time by signing in with Roblox again, and your prior data (history, links, moderation flags) will be restored. We retain moderation flags across opt-out / opt-in cycles so that bad actors cannot escape moderation by opting out.
• For full hard deletion of all data including Shoutbox messages, history, and sessions, contact us (below).

7. Data we share

We do not sell or share your data with third parties. The publicly-visible tracked-account pages are, by design, readable by anyone who visits the site (just like a Roblox profile is). Roblox itself receives standard OAuth callback parameters when you sign in.

8. Security

Session IDs are cryptographically random (256 bits). The OAuth client secret is stored only in server-side environment variables. The database is stored on the server's file system and is not exposed to the public internet. We take reasonable measures to protect against unauthorized access but no service is ever 100% secure.

9. Children

Roblox accounts may be operated by minors. Where this is the case, only the public profile information about that account is collected (the same information already publicly visible on Roblox). We do not knowingly request, store, or process personally-identifying information beyond what Roblox already exposes publicly.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of the page will reflect any change. Material changes will be highlighted on the home page.

11. Contact

For data-deletion requests, opt-out reversal, or any other privacy-related question, contact @.chloe on Discord.