Privacy Policy

1. Information We Collect

When you use ShadowConfig, we may collect:

• Account information — your Discord or Roblox user ID, username, and avatar, provided when you sign in via OAuth
• Game data — Roblox Universe IDs, game names, descriptions, and configuration variables you create
• Billing status — your current plan tier and plan expiry date, synced from Payhip webhook events. We do not collect or store your payment card details; those are handled entirely by Payhip
• Usage data — live player counts reported by your Roblox game servers, and timestamps of when your game last synced configuration data
• Roblox account linkage — if you link a Roblox account to a Discord-based account, we store the association between the two so purchases can be matched to the correct account
• Roblox Open Cloud key — if you connect a game to send in-game actions (announcements, rewards, kicks, custom commands), we store the Open Cloud API key you provide so we can relay those actions to your Roblox servers
• GitHub integration data — if you link a GitHub repository, we store the repository name, file path, and access token you provide, used to fetch configuration, scripts, and custom command definitions on your behalf
• Discord bot usage — if you use our Discord bot, we process the Discord user ID of whoever runs a command, the Discord server (guild) ID the bot operates in, and the command parameters entered (e.g. game, player, command name) needed to carry out that command

2. How We Use Information

We use the information above to:

• Authenticate you and maintain your session
• Serve your configuration variables to your own Roblox game servers when requested with a valid API key
• Enforce plan limits (games, variables, players, sync frequency, GitHub sync, and daily command volume)
• Apply plan upgrades when a matching Payhip purchase webhook is received
• Display your active player counts and usage on your dashboard
• Fetch configuration, scripts, and custom command definitions from a GitHub repository you've linked, on your request
• Relay in-game actions (announcements, rewards, kicks, custom commands) you trigger — from the web dashboard or Discord bot — to your Roblox servers via Roblox's Open Cloud Messaging Service
• Verify that a Discord user running a bot command owns or has access to the game they're targeting

3. What We Don't Do

We do not sell your information to third parties. We do not use your configuration data, scripts, or game details for advertising. We do not access your Roblox game's content beyond the configuration values, scripts, and commands you explicitly connect or create through the dashboard or Discord bot. We do not permanently store the contents of your GitHub-hosted scripts or configuration files — they're fetched from GitHub on request and cached briefly to serve your requests, not archived.

4. Third-Party Services

We rely on a small number of third-party services to operate ShadowConfig:

• Discord & Roblox — used for OAuth sign-in (we receive your basic public profile: ID, username, avatar) and, separately, to run our Discord bot in servers you invite it to
• Payhip — processes payments and sends us webhook events when a purchase is completed, which we use to update your plan tier
• Roblox Open Cloud API — used to fetch active player counts and, where you've connected a key, to relay announcements, rewards, kicks, and custom commands to your game servers
• GitHub API — used, only for games you've linked, to fetch configuration, scripts, and custom command files from your specified repository
• Our hosting and database providers — used to store account, game, and configuration data securely

5. Data Retention

We retain your account and game data for as long as your account remains active. If you delete a registered game from your dashboard, its configuration variables, API key, Roblox Open Cloud key, and any linked GitHub repository details are permanently removed. Unlinking GitHub from a game removes its stored access token immediately. If you'd like your account data deleted entirely, contact us using the details on our Discord Server.

6. API Keys & Access Tokens

Each registered game has a unique API key used to authenticate configuration requests from your Roblox game server. If connected, a game may also have a Roblox Open Cloud key (used to send in-game actions) and a GitHub access token (used to fetch your repository's contents). Treat all of these like passwords — anyone with them can read your configuration values, trigger in-game actions, or access your linked repository. You can view, update, or remove these from your dashboard.

7. Children's Privacy

ShadowConfig is a developer tool intended for use by Roblox game developers, not directly by players or children. We do not knowingly collect personal information from children through this Service beyond the public Discord/Roblox account information provided during developer sign-in.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

9. Contact

Questions about this Privacy Policy, or requests to access or delete your data,open a ticket on our Discord Server.