Privacy Policy
Last updated October 6, 2026
What we collect, why, who else sees it, and the choices you have.
Draft: a lawyer has not reviewed this text yet, and it may change before launch.
01Who we are and our roles
Luaward is operated by [operator name and registered address — to be completed before launch]. For your account we decide why and how data is used (the controller). For the people who run your scripts or open your key pages we act for you (the processor). Privacy requests go through the notice form at /report; a direct privacy address will be listed here once it exists.
02What we collect
Account data: email, display name, sign-in method, passkeys and two-factor settings. Your scripts, stored encrypted. Your settings and what you do in the dashboard. Security records: IP address, browser, device and session details. When a script or key page runs: device ID, IP address, country, platform, executor, game and player identifiers, key and time. Payments: the plan, amount, method and time of each payment, and the reference Stripe or TrueMoney gives us for it. Card numbers go to Stripe and never reach us. Error reports, only for scripts whose owner turned them on: the error message the script raised, the script version, the executor and platform, and a one-way hash that lets the owner count how many players were affected. We do not store who the player is. Test in game, only if you use it: the lines your own game prints while you test, what your commands return, and a one-time copy of the script you chose to run. For each script run we also keep a short summary: the script and its version, how it went step by step, the first line of an error with its line number, and the game's name. They can include names or IDs of players in your own game. Each key also remembers the player ID of its latest run, so the key list can show who used it last. AI & MCP, only if you use it: when you connect an AI app (Claude, ChatGPT, Claude Code or another MCP client) we keep who you connected it to and what you allowed (the app’s name, the address it sends you back to, the permissions, when it connected and when it last called us), a one-way hash of any personal token you make, and a log of what it did by kind of action (the tool, the game and the time; never the code it sent or what the game printed).
03Why we use it
To provide the service you asked for (contract); to check keys, stop abuse and fraud, and keep Luaward secure (our legitimate interests); to meet legal duties; and for anything optional, such as Beta usage data, only if you agree, which you can withdraw. We do not sell personal data and we do not use it for advertising.
04Visitors to key pages
People who open a key page created by a developer are that developer’s visitors. We process their data on the developer’s behalf, to issue keys and stop bypassing. We keep: a random visitor ID in a cookie, a salted hash of the IP address (never the address itself), the country Cloudflare reports, the browser type (for example Chrome), which steps were done and when, the Discord account ID if the page asks you to link Discord (we read only that ID), and the key we issued. The developer sees the country, browser, progress and Discord ID of visits to their page, and can block a visitor. Link providers (Linkvertise, Lootlabs, Work.ink) and Discord are independent of us and have their own policies.
05Who else handles data
Cloudflare (delivery, DNS and security), an email provider for sign-in and notification emails, and the infrastructure that hosts Luaward. For payments: Stripe (cards and PromptPay) and TrueMoney (gift vouchers). These providers only get what they need to do their job and are bound by their own terms with us. Also: Discord (only if a key page asks you to link it) and the link providers a developer chooses (Linkvertise, Lootlabs, Work.ink). Roblox (its public web services): to show a player's name and picture and a game's name and icon, our servers send Roblox only the numeric ID of that player or game, and nothing else. The AI provider you choose: when you let an AI app read your connected game (objects, interface text, console lines and, only if you allow it, the source of your own scripts or your license keys), that data is sent to the app’s provider under your own account with them. We do not choose or control that provider and its own policy applies to what it receives.
06How long we keep it
Account data while your account exists. Raw run records for 30 days; after that only daily totals remain, with no address and no device. Beta test data for 90 days. Deleting a script, a workspace or an account removes its data from our live systems, and from backups as they roll over. The exception is records of payments: tax and accounting rules oblige us to keep them for years, so when an account is deleted they stay, without your name, email or workspace: only the amount, the date, the plan and the payment processor's reference. Key page visits and what happened on them: 90 days (a visit whose key is still valid is kept until the key ends). Error report samples: 30 days. A group of identical errors, with its running total, until 90 days after it last happens. Test in game: console lines and results for 24 hours, kept in temporary storage and never in our database; the one-time copy of a script is gone after 60 seconds. The short summary of each run stays in our database for 30 days. The player ID kept on a key stays until the key is deleted. Names and pictures that Roblox gives back are kept in temporary storage for up to 24 hours. AI & MCP: the scripts an AI decompiles from a game are kept for 24 hours and never saved to your account; a request waiting for your approval lasts 5 minutes; the record of a connection lasts until you end it, and ending it deletes its consent and tokens at once; an app that registered but was never approved is deleted after 7 days.
07Your rights
Depending on where you live (for example under the GDPR, the UK GDPR, Brazil's LGPD or Thailand's PDPA) you can ask to access, correct, export or delete your data, to restrict or object to some uses, and to complain to your data protection authority. In Settings, “Export my data” downloads a ZIP of your account, your scripts (with their original source) and your keys, and “Delete account” closes the account after 7 days, which you can use to change your mind. For anything else, send a Privacy request through the notice form; we answer within 30 days.
08Children
Luaward is for developers and is not directed at children under 13 (or the higher age your country sets). We do not knowingly collect their data. If you believe a child has an account, tell us through the notice form and we will delete it.
09Security and breaches
Scripts are encrypted at rest, connections use HTTPS, sign-in supports passkeys and two-factor codes, and access is limited. No system is perfectly secure, so tell us at once if you find a problem. If a breach affects you we will tell you and the authorities within the time the law requires.
10International transfers
Luaward is operated from Thailand and data may be processed in the other countries where our providers operate. Where the law asks for it we rely on safeguards such as standard contractual clauses.
11Regional notes
EU and UK: [representative, if required — to be completed before launch]. California: we do not sell or share personal information for advertising. Thailand: you may complain to the Personal Data Protection Committee. Brazil: you may reach our data contact through the notice form.
12Changes
When this policy changes in a way that matters we will tell you before it takes effect, and the date at the top shows the latest version.