Who We Are
StarX Studio is a game studio that builds experiences on Roblox. We are the controller of the personal data described here: the controlador under Brazil's Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018) and the controller under the EU and UK General Data Protection Regulation.
You can reach us about anything in this document at contact@starxstudio.com, or on our Discord server. Requests about your data should go to the email address: we cannot verify who you are from a Discord handle alone.
What This Policy Covers
This policy covers starxstudio.com, this website and nothing else.
Our games run on Roblox, on Roblox servers. What happens inside a game, meaning your account, your purchases, your chat and your progress, is handled by Roblox Corporation under the Roblox Privacy Policy. We see in-game data only through the tools Roblox gives every developer, and we never receive your Roblox password, your email address or your payment details from them.
What We Collect on This Site
Browsing the site as a visitor requires no account and no personal information. The list below is exhaustive.
- Server Logs
- Your IP address, browser user agent, the page you asked for and the time you asked for it. Standard web-server records, used to keep the site up, to enforce rate limits and to investigate abuse. Not used to build a profile of you.
- Essential Cookies
- A session cookie that expires after one hour, a sign-in cookie that exists only if you sign in, and a cookie that remembers your cookie choice for a year. All three are described one by one in the Cookie Policy.
- Game Statistics
- The visit counts, concurrent players, favourites and ratings you see on this site are fetched from public Roblox endpoints on our server, on a schedule. They are figures about games. No player identifiers are involved, and nothing is fetched about you when you load a page.
- Support and Bug Reports
- Whatever you type into the report form: the type of report, which game, your platform, your description, and, only if you choose to fill them, a Roblox username and a contact handle. This is delivered to a private staff channel and kept only as long as it takes to act on it.
- Accounts
- Public sign-up is currently switched off on this site, so no new accounts are being created. When it is on, an account stores a username, a display name, an email address, a password that is hashed and never stored in readable form, one-time codes sent by email to confirm the address, an optional profile picture, and any comments or likes you leave.
Why we are allowed to do this
Under the LGPD (art. 7) and the GDPR (art. 6), every use of personal data needs a legal basis. Ours:
- Legitimate Interest
- Server logs, rate limiting and abuse prevention. Keeping the site available and unattacked is an interest that does not override yours, because none of it is used to profile or advertise to you.
- Consent
- Anything non-essential, such as any future analytics or measurement cookie. Nothing of that kind runs today, and none will run before you have been asked. You can withdraw consent at any time.
- Performance of a Contract
- Running an account you asked us to create, and answering a support request you sent us.
- Legal Obligation
- Keeping records we are required to keep, and answering lawful requests from authorities.
Cookies
This site uses three cookies, all of them strictly necessary, and no advertising or analytics cookies at all. The Cookie Policy names each one, what it holds and how long it lives, and explains how to change your choice.
Who Else Sees Your Data
We do not sell personal data, we do not share it with advertising networks, and we do not trade it. It reaches these service providers only because they run parts of the site:
- Our Hosting Provider
- Serves the site and holds the server logs described above.
- MongoDB Atlas
- The database, including session records and, when accounts are enabled, account data.
- Cloudinary
- Image hosting and delivery. Serves the artwork on every page, and stores profile pictures when accounts are enabled.
- Discord
- Support and bug reports are delivered to a private staff channel through a webhook. Anything you type into the form is sent there.
- Our Email Provider
- Sends the one-time codes used to confirm an email address when accounts are enabled.
- Google Fonts
- Serves the typeface used across the site. Loading a font from Google means your IP address reaches Google, which is why it is listed here.
Where Your Data Goes
Several providers above operate outside Brazil and outside the European Economic Area, mainly in the United States. Where data is transferred internationally we rely on the safeguards those providers publish: standard contractual clauses and equivalent mechanisms recognised under the LGPD (art. 33) and the GDPR (chapter V).
How Long We Keep It
- Session Cookie
- One hour, then it expires on its own.
- Cookie Choice
- One year, or until you clear it.
- Server Logs
- Kept only as long as they are useful for security and diagnostics, then rotated out.
- Support and Bug Reports
- Kept while we work on the issue and for a reasonable period afterwards, so a returning report can be matched to the first one.
- Account Data
- Kept while the account exists. Delete the account, or ask us to, and it goes.
Your Rights
The LGPD (art. 18) and the GDPR give you rights over your data. Whichever applies to you, we will honour the list below:
- Confirmation and access. Ask whether we hold anything about you, and get a copy.
- Correction. Have incomplete or wrong data fixed.
- Deletion. Have it erased, unless a law requires us to keep it.
- Portability. Receive it in a machine-readable format.
- Objection and restriction. Tell us to stop a particular use.
- Withdrawal of consent. Take back a permission you gave, without affecting what was done before you took it back.
- Information about sharing. Ask who we shared it with.
- Human review. We take no automated decisions with legal effect about anyone, but if we ever did, you could ask for a person to review it.
Write to contact@starxstudio.com to exercise any of them. We answer within 15 days for LGPD requests and within one month for GDPR requests. We may need to ask a question or two to confirm you are who you say you are. That check exists to protect you, not to slow you down.
If you are unhappy with our answer, you can complain to the Brazilian data protection authority (ANPD), or to your national supervisory authority in the EU or the UK.
Children and Teenagers
A large share of the people who play our games are children. We take that seriously, and it is the reason this site collects as little as it does.
Under 13 (COPPA, United States). We do not knowingly collect personal information from a child under 13 through this website. Public sign-up is switched off, and the site can be browsed in full without giving us anything. If a child under 13 has sent us personal information anyway, through the support form for instance, a parent or guardian can write to contact@starxstudio.com and we will delete it. We will do the same on our own initiative the moment we notice it.
Under 18 (LGPD art. 14). Data of children and adolescents is processed in their best interest. Where the LGPD requires specific, prominent consent from a parent or guardian, we ask for it or we do not collect the data.
Under 16 (GDPR art. 8). Where consent is the basis and the person is below the age their country sets, the consent must come from a parent or guardian.
Please do not put your real name, address, school, phone number or email into the support form. Tell us the game, the platform and what went wrong. That is all we need to help.
How We Protect It
- The whole site is served over HTTPS in production.
- Passwords are hashed, never stored in a readable form.
- Sessions are held on the server, not in a cookie a browser could be tricked into revealing; the cookie itself is HTTP-only and same-site.
- Every form that changes something is protected against cross-site request forgery.
- A Content Security Policy limits what a page is allowed to load, and rate limiting caps how hard anyone can hammer the site.
- Input is sanitised before it reaches the database.
- No safeguard is perfect. If a breach ever put your rights at risk, we would notify you and the ANPD as the law requires.
Changes to This Policy
When this policy changes we update the date at the top. If a change materially affects you, such as a new kind of collection or a new recipient, we will say so on the site rather than quietly editing the page.
Contact
Questions, requests and complaints: contact@starxstudio.com. Player support and everything else: our Discord server or the support page.
THE OTHER DOCUMENTS