Privacy Policy

Who runs this site

rowikis (rowikis.com) is a website of wikis for Roblox games, run by Sowd, based in the United Kingdom. The controller of the personal data processed through the site is Sowd. Contact: [email protected].

The short version

• Signing in with Roblox is optional. It gives us your Roblox user id, username and display name, which live in a signed cookie in your browser. We never see your password and keep no account database.
• Where a game's developer allows it, a signed-in player can see their own game data (like their inventory). It is read only when you open that page, shown only to you, and not stored.
• Item values come from in-game sales as totals and averages. No player's name or trades are shown.
• Wiki search runs in your browser and is never sent anywhere.
• What you send through our request, editor and contact forms goes to a private Discord server that only the rowikis team can see.
• Nothing from Google or Cloudflare Web Analytics loads until you make a choice in the cookie dialog.
• We never sell your data.

Hosting

The site runs on our own server behind Cloudflare, which delivers pages and protects the site from attacks. To do that, Cloudflare processes technical request data such as your IP address, browser type and the page requested (legal basis: legitimate interests). Our server keeps no request logs that identify you. When you first visit, your browser asks Cloudflare which country you are in so the cookie dialog can apply the right rules; the answer stays in your browser for that visit only.

Signing in with Roblox

Sign-in happens on Roblox's own site through Roblox OAuth, so this site never sees your Roblox password. We ask Roblox only for the openid and profile scopes, which tell us your Roblox user id, username and display name.

• Where it's kept: in the rw_session cookie in your browser, signed so it can't be changed. We keep no copy on our server. While you sign in, a short rw_login cookie holds a one-time code that protects the sign-in, for up to 10 minutes.
• How long: 30 days, or until you sign out, which deletes the cookie.
• Your avatar: our server asks Roblox's public thumbnail service for your avatar headshot and keeps its address in memory for up to an hour. Roblox serves the image to your browser.
• Why: to show you that you're signed in and your own game data (legal basis: legitimate interests, and providing the feature you asked for). The cookies are strictly necessary for signing in, so they don't need consent, and they are never used for ads or tracking.
• Logs: our server's log notes the Roblox user id of each sign-in, to help us fix sign-in problems.

Your game data

Some wikis can show a signed-in player their own data from the game (now: Titan Tower Defense, your inventory). This only exists where the game's developer has given us permission and read access to the game's saved data.

• Only yours, only to you: when you open the page, our server reads your own saved data from the game using your Roblox user id, and sends it to your browser. Nobody else can see it, and it is never read for anyone who isn't signed in and asking.
• Not stored: the answer is kept in our server's memory for up to a minute, so reloading the page is quick, and is never written to disk or logged. We also count how often each player loads it, in memory, to stop the page being overloaded.
• Read only: we never change anything in the game.

Item values

Some wikis show what items sell for between players, from the game's own market data with the developer's permission. We receive and publish only totals and averages (like the recent average price and number of sales). No player's name, user id or trades are shown.

Your cookie choice

Your choice is saved in your browser's local storage so you aren't asked on every page. It holds only what you chose and when, never leaves your device, and is asked again after six months or when this policy changes what we ask for. This is strictly necessary to respect your choice, so it doesn't need consent.

Advertising (Google AdSense)

The site shows ads from Google AdSense to pay for itself. Google acts as an independent controller of the data it collects. What loads depends on your choice and where you are:

• Before you choose: nothing from Google loads.
• UK, EEA and Switzerland: ads only load if you allow ad cookies (legal basis: consent), and are personalised only if you also allow that. If you reject, the site shows no ads and Google sets no cookies.
• Everywhere else: once you have chosen, Google shows ads based only on the page you're reading, and may set cookies to limit how often an ad repeats and to detect fraud. Ads are personalised from your activity only if you allow it.
• Global Privacy Control: if your browser sends this signal, ads are never personalised.

Google's use of advertising cookies lets it and its partners serve ads based on visits to this and other websites. See how Google uses data from partner sites and how Google uses cookies in advertising, and manage personalisation in My Ad Center.

Visit counts (Cloudflare Web Analytics)

Visit counting is off at the moment. If it is switched on and you allow it, Cloudflare Web Analytics counts page views and load times. It sets no cookies, doesn't fingerprint you and doesn't follow you across sites (legal basis: consent). See the Cloudflare privacy policy.

Cookies and storage

Change your choice at any time with Cookie and ad settings in the footer. Withdrawing consent removes Google's cookies from this site and reloads the page without them.

Forms and emails

The Request a Game, Apply for Editor and Contact forms send what you type to the rowikis team. Each one becomes a post in a private Discord server that only the rowikis team can see; nothing is posted publicly, and our own server keeps no copy.

• What's sent: the fields you fill in (including your email address, if you give one) and the time you sent it. An editor application also sends the Roblox user id, username and profile link of the signed-in account, which is why it needs sign-in. A request or contact message sent while signed in includes them too. Your IP address is not sent.
• Who sees it: the rowikis team only. Discord stores the posts for us as our service provider, under its own privacy policy.
• Limits: to stop spam, our server remembers your IP address, and your Roblox user id when signed in, for 10 minutes in memory to count how many forms you've sent. Its log notes only that a form was sent, never what it said.
• Why: to deal with your request, application or message (legal basis: legitimate interests).
• How long: only as long as it takes to deal with it, then deleted; email us and we delete it sooner.

If you email us instead, we use what you send only to deal with it, and keep it only as long as that takes.

International transfers

Cloudflare, Google and Discord may process data outside the UK, including in the United States. They rely on the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses (with the UK Addendum) to protect it. Roblox handles sign-in and game data under its own privacy policy.

Children

Many Roblox players are young, and the site is made for them as much as anyone. It never asks for personal information beyond the optional Roblox sign-in, which follows Roblox's own account rules, and an optional email address in its forms. If you tell the cookie dialog you are under 13, ads are never personalised, and in the UK, EEA and Switzerland no ad cookies are set at all. If you are a parent or guardian and think your child's data has been processed, email [email protected]and we will delete it.

How long we keep data

• Sign-in: in your browser's cookie for up to 30 days; nothing kept on our server.
• Avatar address: up to an hour in our server's memory.
• Your game data: up to a minute in our server's memory.
• Cookie choice: six months in your browser.
• Form posts and emails: only as long as it takes to deal with them.
• Form spam limits: 10 minutes in our server's memory.

Your rights

Under UK data protection law (UK GDPR) you can ask for access to your personal data, ask us to correct or erase it, object to or restrict how we use it, ask for a copy to take elsewhere, and withdraw consent at any time without affecting what happened before. To ask, email [email protected] with your Roblox username; we reply within one month. Signing out removes your sign-in cookie straight away. For ads and visit counts, requests are best made to Google or Cloudflare directly, but we will help.

If you are unhappy with how your data is handled, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local data protection authority.

US residents: we do not sell personal data. Showing personalised ads can count as "sharing" under some US state laws; rejecting personalised ads in the cookie dialog, or sending Global Privacy Control, opts you out.

Changes

If this policy changes, the date at the top changes too, and if the change affects what we ask your permission for, the cookie dialog asks you again.