Privacy Policy

RoViral (“RoViral”, “we”, “us”) operates the website at roviral.app and its subdomains (the “Service”), an analytics and creative tool for people who build games on the Roblox platform. We act as the data controller for personal data described in this policy.

Contact for any privacy question, request or complaint: support@roviral.app.

This policy covers the Service only. It does not cover Roblox, Google, Stripe, or any other third-party site, even where we link to them or display data sourced from them.

Account data. Your email address, a hashed password (if you sign up with email), your display name and avatar URL if you sign in with Google, your subscription tier, your AI credit balance, and your invite/referral code.

Google sign-in data. If you choose “Continue with Google”, we receive only your Google account’s basic profile (name, profile picture) and email address, using the openid, userinfo.email and userinfo.profile scopes. We never receive your Google password, and we do not request access to Gmail, Drive, Contacts, Calendar or any other Google service.

Content you create. Prompts, game names, style choices, chat messages you send to our AI features, generated thumbnail images, and saved alert settings and thresholds.

Billing data. Subscription status, plan, credit purchases and payment identifiers returned by our payment processor. Card numbers are entered on the processor’s own checkout page and are never transmitted to or stored by RoViral.

Technical data. IP address, browser and device type, pages viewed, timestamps and error logs, collected automatically so we can run, secure and debug the Service.

Public Roblox data. The charts, player counts and revenue estimates we display are derived from publicly available Roblox endpoints. That data is about games, not about you, and is not personal data.

We do not knowingly collect government ID, precise geolocation, biometric data, health data, or any other special-category personal data. Please do not send it to us.

• To provide the Service — create your account, authenticate you, show your plan, run AI generations, deduct credits, deliver alerts. Legal basis: performance of a contract.
• To take payment — process subscriptions and credit top-ups and prevent payment fraud. Legal basis: contract and legal obligation.
• To keep the Service secure and working — rate limiting, abuse prevention, debugging, backups. Legal basis: legitimate interests.
• To communicate with you — service notices, alert emails you enabled, and replies to your support requests. Legal basis: contract and legitimate interests.
• Marketing email — only if you opt in, and every message includes an unsubscribe link. Legal basis: consent.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use your prompts or generated images to train our own models.

RoViral’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google sign-in is used only to create and authenticate your RoViral account; it is never sold, never used for advertising, never transferred to others except as needed to provide the Service or where required by law, and never read by a human except with your explicit consent, for security purposes, or to comply with applicable law.

You can revoke RoViral’s access at any time in your Google Account under “Third-party apps with account access”.

We use a small number of processors, each bound by contract to protect your data:

• Hosting, database and authentication — to store your account and run the site.
• Payment processing (Stripe) — to take and manage payments. Stripe is an independent controller of your payment data under its own privacy policy.
• AI model providers — your prompts and related inputs are sent to the model provider that generates the response or image.
• Email delivery — to send alerts and account emails.

We may also disclose data where legally required, to enforce our Terms, to protect the rights or safety of anyone, or as part of a merger or acquisition (with notice to you).

Our providers may process data in the United States and other countries. Where personal data leaves the UK/EEA, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) or an adequacy decision.

• Account data: for as long as your account exists.
• Generated thumbnails, chat history and alert settings: until you delete them or delete your account.
• Billing and tax records: up to 7 years, because tax law requires it, even after account deletion.
• Server and security logs: typically up to 90 days.

After account deletion we erase or irreversibly anonymise the rest within 30 days, except for backups, which age out on their normal cycle.

Wherever you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent at any time. You can also delete your account yourself at any time from your account settings, which removes your profile, credits, chat history and generated images.

To exercise a right, email support@roviral.app from your account address, or have an authorised agent contact us with written proof of authorisation. We verify requests by confirming control of the account email. We respond within 30 days (45 days for California requests, extendable once where permitted), free of charge, and we will never penalise, downgrade or charge you differently for using a privacy right.

If we refuse a request we will tell you why, and you may appeal by replying to our decision email with “Appeal” in the subject line; we answer appeals within 45 days.

This section applies to residents of California (CCPA/CPRA) and, as applicable, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws.

Notice at collection. In the last 12 months we collected these categories of personal information, for the business purposes described in section 4, from you directly and automatically from your device: identifiers (name, email, account and device identifiers, IP address); commercial information (plan, purchases, credit balance); internet or network activity (pages viewed, feature usage, logs); approximate location inferred from IP address; and your own content (prompts, chat messages, generated images and settings). We disclose these categories to our hosting, payment, AI-model and email providers as service providers.

No sale, no sharing, no targeted advertising. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising or profiling that produces legal or similarly significant effects. Because we do not sell or share, there is nothing to opt out of; we also honour Global Privacy Control (GPC) signals as an opt-out request. We do not collect or process sensitive personal information for the purpose of inferring characteristics.

Your state rights. Depending on your state you may request to know, access, correct, delete and port your personal information, to opt out of sale/sharing/targeted advertising and certain profiling, to limit use of sensitive information, and to appeal a refusal. Use the contact route in section 9. California residents may also request the specific pieces of personal information we hold and the categories of third parties to whom we disclosed it.

We retain each category only as long as described in section 8, and we do not knowingly sell or share the personal information of anyone under 16.

RoViral is the controller of your personal data. Our legal bases are set out in section 4: contract, legal obligation, legitimate interests, and consent. Where we rely on legitimate interests, we have balanced them against your rights, and you may object at any time.

You have the rights to access, rectification, erasure, restriction, portability, objection (including to direct marketing at any time) and to withdraw consent without affecting prior processing. We do not carry out automated decision-making that produces legal or similarly significant effects about you.

Providing account and billing data is necessary to use the Service; without it we cannot create an account or take payment. International transfers are covered in section 7.

You may lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, your national data protection authority — though we would appreciate the chance to resolve it first at support@roviral.app.

Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act), Japan (APPI) and other national privacy laws grant broadly equivalent rights of access, correction, deletion and complaint. We apply the standards in this policy to everyone, so you can use the same contact route in section 9 wherever you live, and we will handle your request under your local law.

The Service is not directed to children. You must be at least 13 years old (or 16 where your country requires it) to create an account, and under 18 you may only use the Service with a parent or guardian’s permission. We do not knowingly collect personal data from children below that age; if we learn we have, we delete it promptly. Parents or guardians can contact support@roviral.app to request deletion.

We use strictly necessary cookies and browser local storage to keep you signed in, to remember your theme choice, and to keep the site secure. We do not use advertising or cross-site tracking cookies. Blocking essential cookies will stop sign-in from working.

Data is encrypted in transit with TLS and at rest by our hosting provider, passwords are hashed, database access is restricted by row-level security so you can only read your own records, and payment card data never touches our servers. No system is perfectly secure, so we cannot guarantee absolute security; if a breach affects your personal data we will notify you and the relevant regulator as required by law.

We may update this policy. If a change is material we will notify you by email or an in-app notice before it takes effect, and we always update the “last updated” date above. Continuing to use the Service after a change means you accept the updated policy.

Privacy requests: support@roviral.app. General support: support@roviral.app. See also our Terms of Service.