privacy policy

1. Information We Collect

When you create a rotheme account using Roblox OAuth, we collect the following information:

• Roblox username and display name
• Roblox user ID
• Roblox profile URL and avatar

We also collect limited, non-personal information via cookies and local storage to:

• Maintain your login session
• Save local preferences (e.g., dismissed messages, theme settings)

In addition:

• We use a self-hosted instance of Umami to collect anonymous, aggregated analytics (e.g., page views). No personal identifiers are stored.
• If you subscribe to the Supporter Tier, Stripe will process your payment information. rotheme does not store your full payment details.

2. How We Use Your Data

We use your information to:

• Authenticate you and allow access to your account
• Enable theme creation, sharing, and marketplace functionality
• Provide essential site and extension features
• Improve rotheme through basic, non-personal analytics

We do not sell, rent, or share your personal data with third parties, except as required by law or to operate core services (e.g., Stripe, Cloudflare).

3. Cookies and Local Storage

We use essential cookies and local storage for:

• Remembering your login session
• Saving dismissed popups and theme preferences

We do not use advertising or tracking cookies.

4. Extension Communication

The rotheme Extension may communicate with the rotheme website to:

• Verify extension installation
• Retrieve your active theme
• Save new theme data locally in your browser

The extension does not track browsing history or collect unrelated site data.

5. Data Retention

We retain account data until one of the following occurs:

• You request deletion of your account
• Your account remains inactive for 3 years, after which it may be permanently deleted
• Retention is required by law or for legitimate security purposes

You may request deletion of your account at any time.

6. Data Hosting and Security

rotheme services are hosted within the European Union and protected with standard security measures (e.g., HTTPS, restricted access).

Cloudflare provides DDoS protection and caching. As part of normal operation, they may temporarily process your IP address.

Stripe handles payment processing for the Supporter Tier. We do not directly store your card or bank details.

7. Your Rights

Depending on your location, you may have the right to:

• Access the data we hold about you
• Request correction or deletion of your data
• Withdraw consent for data use (where applicable)
• File a complaint with your local data protection authority (e.g., the UK ICO for UK residents)

To exercise your rights, contact: [email protected]