Privacy Policy

1. Introduction

Rebirth is operated from England. This Privacy Policy explains how Rebirth ("we", "us", or "the Service") collects, uses, and protects your personal information when you use our AI-powered Roblox game development platform. We are the data controller for the personal data we process through the Service.

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address, from your Google account for authentication
• Name, your display name from Google
• Profile picture, your avatar URL from Google

Roblox Account Information (Optional)

If you choose to connect your Roblox account via Roblox OAuth, we receive only:

• Roblox User ID, your unique numeric Roblox identifier
• Roblox Username, your public Roblox display name

We do not receive your Roblox password, email, payment details, friends list, private messages, group membership, or anything else from your account. The OAuth scopes we request are limited to public identity. We cannot log in as you, change your account settings, or see anything you would not show on your public Roblox profile.

Subscription and Payment Information

For paid features, we store:

• Subscription status, your current plan (free, pro, etc.)
• Subscription period, start and end dates of your billing cycle
• Stripe identifiers, customer and subscription IDs for payment processing

We do not store your credit card details. All payment information is securely handled by Stripe, our payment processor.

Usage Information

• Credit balance, your available credits for AI features
• Credit transactions, history of credit purchases and usage

AI Prompts and Conversation Data

When you use AI features, we collect and process:

• Your prompts and messages, text you send to the AI assistant
• AI responses, generated code and content from the AI
• Conversation history, stored to maintain context across sessions

3. How We Use Your Information

We use your information to:

• Provide and maintain the Service
• Authenticate your identity and manage your account
• Process payments and manage subscriptions
• Connect the Roblox Studio plugin to your account
• Track credit usage for AI features
• Communicate with you about the Service
• Improve and develop new features

4. Data Sharing

We share your information only with:

• Stripe, for payment processing
• Supabase, our database and authentication provider
• AI service providers, to process your AI requests. We send your prompts, messages, studio context, and images to these providers to generate responses. These providers may process and temporarily store your data according to their own privacy policies.

Important: We store your conversation history securely in Supabase, our enterprise-grade database provider, for service functionality and context continuity. Supabase implements industry-standard security measures including encryption at rest and in transit, row-level security, and regular security audits. Your prompts and AI responses are stored securely by us, but are also transmitted to and processed by third-party AI service providers. These providers may use your data for training purposes according to their own privacy policies, which we do not control.

We do not sell your personal information to third parties.

5. International Data Transfers

Your data may be transferred to and processed in countries outside the UK, including the United States, where our service providers (Supabase, Stripe, and AI service providers) are based. These transfers are protected by appropriate safeguards as required by UK data protection law, including standard contractual clauses and adequacy decisions where applicable. We maintain data processing agreements with our key service providers to ensure your data is handled in accordance with applicable data protection standards.

6. Data Security

We implement appropriate security measures to protect your information, including:

• Encrypted data transmission (HTTPS)
• Secure authentication through Google OAuth
• Enterprise-grade database security via Supabase with encryption at rest and in transit
• Row-level security on database tables
• Regular security updates and audits

7. Roblox Open Cloud API Keys (Direct-to-ROBLOX mode)

Direct-to-ROBLOX is an optional mode. If you use it, you provide a Roblox Open Cloud API key so we can publish your AI-generated game directly to a Roblox experience. We treat this key with extra care, because the scope of what it can do is set by you when you create it on Roblox's side.

What the key can and cannot do

• The wizard asks you to enable two permissions on the key: universe-places, so we can publish your place file, and luau-execution-sessions (read and write), so we can run short Luau scripts inside your experience to look at what's there and apply the AI's changes. Without the second one, Direct-to-ROBLOX mode has no way to inspect or modify your game, because there's no Studio plugin running locally to do it. With those two scopes the key can publish place files and run short Luau scripts in your experience, and that's it. It can't read your DataStores from outside that code, manage subscriptions, send messages, or do anything outside the experiences it is scoped to.
• The luau-execution-sessions scope lets us run server-side Luau scripts that Roblox executes inside your experience, the same way they'd run if you typed them into Studio's command bar yourself. Those scripts can see whatever your game's own server scripts can see, including anything you've stored in DataStores or in workspace state. We only run the scripts the AI generates in response to your prompts (for example "list every Part in the Workspace", "rename this script", "spawn an NPC"), and the script source plus its return value are kept in your conversation history. We don't run scripts on your experience outside the context of an active prompt.
• When you create the key on Roblox, you also choose which experience(s) it applies to. We strongly recommend scoping it to a single experience (the one you want Rebirth to publish to). If you do that, neither the key nor any Luau script we run with it can touch any of your other games. If you leave the key unscoped, it could in theory act on any of your experiences, so please pick the experience explicitly when creating it.
• We do not get your Roblox password, your Roblox account email, your payment information, your friends, your private messages, or your group membership. The Open Cloud API does not expose any of that to key holders, and we do not request any of it.

How we store it

• The key is encrypted at rest using AES-256-GCM with a per-row random initialisation vector. Only the encrypted ciphertext lives in our Supabase database. The plaintext is never written to disk.
• The encryption key itself is stored as a Fly.io platform secret on our backend. It is not in the database, not in source code, and not accessible from any frontend or browser session.
• Database row-level security (RLS) is enabled on the table. Policies restrict reads to your own row only. No other user can query your encrypted key, and anonymous access is denied entirely.

What we do with it

• The decrypted key is only ever held in memory on our backend, only for the duration of a single Roblox API call (publishing your place, listing your scripts, running a Luau inspection task). It is not logged, not cached on disk, and not transmitted anywhere except directly to apis.roblox.com.
• Your browser never receives the full key after you save it. The dashboard only ever shows you the last four characters (e.g. •••• 0a3f) so you can confirm a key is set, without us shipping the secret back over the network.

Honest limits of our security

We want to be straight with you about what is and is not possible:

• Because we have to call Roblox on your behalf to publish your game, our backend has to be able to decrypt your key. Only the founder has access to both the production database and the production Fly secrets needed to do this. We do not check, read, or decrypt user keys as part of normal operations.
• Please keep your Roblox key scoped on Roblox's side to a single experience (the wizard guides you to do exactly this). That way, even in a worst case, the key can only act on the one experience you picked. It cannot touch any of your other games.
• You can rotate or revoke the key at any time on Roblox's API key page: create.roblox.com/dashboard/credentials. Any new key you paste in our wizard immediately replaces the old one. To fully invalidate the key, regenerate or delete it on Roblox's side. The copy we hold becomes useless the moment Roblox rotates it. To delete our stored copy as well, contact us at [email protected] and we will remove the ciphertext, IV, and associated experience IDs from our database.

Monetization keys (auto-create game passes and products)

"Auto-create game passes and products" is a separate, optional feature that is off by default. It is independent of Direct-to-ROBLOX, and you can use it whether you build with the Studio plugin or with Direct-to-ROBLOX.

• If you turn it on, you provide a Roblox Open Cloud API key scoped to the two permissions game-pass (write) and developer-product (write). With those scopes the key can create and update game passes and developer products in the experience you point it at, and nothing else. It cannot publish places, run Luau, read your DataStores, manage subscriptions, or touch experiences it is not scoped to.
• We only use the key when you have the feature turned on and the AI creates a game pass or developer product in response to your prompt. The item name, description, and price you asked for are sent to apis.roblox.com to create it.
• This key is stored exactly like the Direct-to-ROBLOX key above: AES-256-GCM encrypted at rest with a per-row IV, the encryption key held only as a Fly.io platform secret, row-level security restricting reads to your own row, the plaintext never written to disk or sent back to your browser (we only ever show the last four characters), and the decrypted key held in memory only for the duration of a single Roblox API call. It is a different key from your Direct-to-ROBLOX key because the required permissions are different.
• You can turn the feature off at any time from the Controls menu, which stops us from using the key. You can rotate or revoke the key itself on Roblox's API key page, or contact [email protected] to have us delete our stored copy.

Live game data (server logs, server health, community forum)

These are separate, optional features, each off by default with its own toggle in the setup checklist. They do not add a new stored credential: they reuse an Open Cloud key you have already saved (your Direct-to-ROBLOX key or your monetization key), with extra read-only permissions that you add to that key yourself on Roblox.

• Server logs uses the universe (read) permission to read the Error and Warning logs your live game servers produce, so the AI can debug issues your players actually hit. We read them only while the feature is on and only when the AI needs them for your prompt. Log lines the AI reads are kept in your conversation history like any other tool result.
• Server health reads player counts, server FPS, and ping from Roblox's public server list for your game. This is public data; no API key is used for it.
• Community forum uses the group-forum (read) permission to read posts and comments from your group's community forum (player bug reports and feedback). It is read-only: we cannot post, reply, or moderate, and it only applies to group-owned experiences that have forums enabled.
• When you open the setup for these features we make a small read-only test call to Roblox with your saved key to show you honestly whether it works, which permission is missing, or whether your game qualifies. Storage and handling of the key are unchanged from the sections above, and turning a toggle off stops us from using the key for that feature.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal or legitimate business purposes.

9. Legal Basis for Processing (UK GDPR)

We process your personal data under the following legal bases:

• Contract performance, processing necessary to provide the Service you signed up for (account management, AI features, credit system)
• Legitimate interest, we rely on legitimate interest for: (i) improving the Service based on usage patterns, (ii) monitoring for and preventing fraud, abuse, and security threats, and (iii) ensuring the stability and performance of the Service. We have assessed that these interests do not override your rights and freedoms.
• Legal obligation, where we are required to retain data by law (e.g., financial records)
• Consent, where you have given explicit consent (e.g., connecting your Roblox account)

10. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights:

• Right of access, request a copy of the personal data we hold about you
• Right to rectification, request correction of inaccurate or incomplete data
• Right to erasure, request deletion of your personal data
• Right to restrict processing, request that we limit how we use your data
• Right to data portability, request your data in a structured, machine-readable format
• Right to object, object to processing based on legitimate interest
• Right to withdraw consent, where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Cookies and Tracking

We use essential cookies for authentication and session management. With your permission, we also use Meta marketing technology to measure which advertisements lead to visits, registrations and purchases. This may process advertising click IDs, browser identifiers, page URLs and hashed account information. You can decline marketing tracking and continue using Rebirth normally.

12. Children's Privacy

The Service is intended for users aged 13 and over. We do not knowingly collect personal information from children under 13. If you are aged 13 to 17, you should review these terms with a parent or guardian. If you believe we have collected information from a child under 13, please contact us.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page with an updated date.

14. Contact Us

If you have questions about this Privacy Policy, or if you wish to exercise your rights under GDPR or other applicable data protection laws (including the right to access, correct, or delete your data), please contact us:

Email: [email protected]

Postal address:
Rebirth
Office 18995
182-184 High Street North
East Ham
London E6 2JA
United Kingdom

We are committed to resolving any privacy concerns you may have. We aim to respond to all data subject requests within 30 days.