Privacy Policy

1. Who We Are

Misty Sandbox Studios ("we", "us", "our") is an independent Roblox game development studio. This Privacy Policy applies to our website and associated member portal. We are not affiliated with Roblox Corporation.

2. Information We Collect

We collect only the minimum information necessary to operate the Service. When you sign in via Roblox OAuth, we receive and store the following from your public Roblox profile:

Data	Source	Why We Collect It
Roblox User ID	Roblox OAuth	Unique identifier to link your account across sessions
Username	Roblox OAuth	Display your identity on the dashboard and in the community
Display Name	Roblox OAuth	Personalize your welcome message and profile
Profile Picture URL	Roblox OAuth	Show your Roblox avatar on your profile
Account role	Our system	Manage member permissions (default: "member")
Join date & last login	Our system	Display membership history on your dashboard

2.1 Session Data

When you are logged in, we store a session cookie in your browser that identifies your session on our server. This cookie contains no personal information — it is a random identifier only. Sessions expire after 7 days of inactivity.

2.2 Server Logs

Like most web servers, ours may automatically log standard technical information such as IP addresses, browser type, pages visited, and timestamps. These logs are used only for debugging and security purposes and are not sold or shared.

2.3 What We Do NOT Collect

• Passwords (we never see your Roblox password)
• Email addresses
• Payment information
• Location data beyond what is in server logs
• Any private Roblox account data (messages, inventory, friends list, etc.)

3. How We Use Your Information

We use the information we collect solely to:

• Authenticate you and maintain your login session
• Display your profile on your dashboard
• Identify you within our community system
• Improve the security and functionality of the Service

We do not sell, rent, or share your personal data with any third parties for marketing or advertising purposes.

4. Data Storage & Security

Your data is stored in a local JSON file on our server. We take reasonable technical precautions to protect your data, including:

• HTTPS encryption for all data in transit (when deployed to production)
• HTTP-only session cookies to prevent client-side script access
• CSRF state verification on all OAuth flows
• No storage of sensitive credentials or tokens beyond the OAuth session

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

5. Roblox OAuth & Third Parties

Authentication is handled by Roblox's OAuth 2.0 service. When you click "Continue with Roblox," you are directed to Roblox's authorization page — we never see your Roblox password. The scopes we request are limited to openid and profile, which provide only your public identity information.

Roblox's handling of your data during authentication is governed by Roblox's Privacy Policy.

6. Cookies

We use a single session cookie (connect.sid) to maintain your login state. This cookie is:

• HTTP-only — not accessible via JavaScript
• SameSite: Lax — not sent on cross-site requests
• Session-scoped — expires 7 days after your last login

We do not use tracking cookies, advertising cookies, or analytics cookies.

7. Data Retention

We retain your account data for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us. Upon deletion, your entry is permanently removed from our database.

8. Children's Privacy

Our Service is intended for users who meet Roblox's age requirements. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it promptly. If you believe this has occurred, please contact us.

9. Your Rights

You have the right to:

• Access — request a copy of the data we hold about you
• Correction — request correction of inaccurate data (note: your Roblox username/display name updates automatically on next login)
• Deletion — request permanent deletion of your account and all associated data
• Opt out — simply stop using the Service at any time

To exercise any of these rights, please contact us through our community channels or Roblox group page.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page with an updated "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy, please reach out through our Roblox group page or community channels.