Privacy Policy
This explains what TurningMatter (a DBA of Colossus Rentals LLC) (“we”) collects when you use RoStack, why, and what you can do about it. Short version: we keep what we need to run your account and bill you. Your chats and your game stay on your computer unless you choose to send chats with a problem report, and the AI provider sees what you send it.
At a glance
| What | Where it lives | Who else sees it |
|---|---|---|
| Roblox ID, username, display name, avatar | Our servers | Nobody |
| Subscription and payments | Stripe (card details); we keep status and amounts | Stripe |
| Email for receipts (asked at checkout) | Our servers and Stripe | Stripe |
| AI usage: model, tokens, cost, time | Our servers | Nobody |
| Your prompts, game code, screenshots you share | Passed through to the AI provider; not stored by us | The AI provider answering the request |
| Chats, History checkpoints, settings | Your computer only | Nobody |
| Signed-in devices (browser/OS, last used); for the app: version, OS, whether it’s open and active, whether Studio is connected | Our servers | Our support team |
| Problem reports you send from the app: your message, system info, the app log and, only if you pick them, chats | Our servers | Our support team |
What we collect
Account
When you sign in with Roblox we receive your Roblox user ID, username, display name and avatar picture. We don’t receive your password or your Roblox email address. We don’t keep your Roblox access tokens after sign-in.
Payments
Payments are handled by Stripe. Your card details go to Stripe, never to us. We keep your Stripe customer ID, subscription status, renewal date and the amounts you’ve paid.
Roblox sign-in doesn’t share an email address, so we ask for one the first time you pay. We use it for receipts and important account notices (like a failed payment or a change to these policies), not for marketing.
AI usage
For each AI request through our service we record the model, the number of tokens, the credits it used, when it happened and a request ID. This is how we bill you and show your usage. We don’t store the content of your prompts or the AI’s replies.
Devices and sessions
We keep a list of where you’re signed in: a label like “Chrome on macOS”, and when it was created and last used. Sign-in tokens are stored only as one-way hashes.
App presence
While the RoStack app is open and you’re signed in, it tells our servers every couple of minutes that it’s open: its version, your operating system, whether you’ve used it in the last few minutes and whether Roblox Studio is connected. It doesn’t send what you’re doing, your chats or your game. Support uses this to see whether the app is running when you ask for help.
Problem reports
When you send a report with Help → Report a Problem, we receive your message, the reason you picked and basic system info (app version, operating system, memory, language, whether Studio is connected). You choose whether to include the app log (errors and what the app did recently, with sign-ins, keys and tokens removed before it leaves your computer) and any of your chats you pick (your messages, the AI’s replies and its Studio actions; attached images aren’t sent). You see what’s included before sending. Reports become a support ticket; only support staff with access to reports can open the files, and every time they do is logged. They’re deleted with your account.
Cookies
We use one essential cookie to keep you signed in on the website, plus a short-lived one during sign-in. We don’t use advertising or tracking cookies.
What the AI provider sees
To answer a request, RoStack sends the AI provider what it needs: what you typed, relevant parts of your game (such as scripts, object names and properties), screenshots you choose to attach or allow the AI to take, and Studio output. With our AI service the request goes through our servers to our provider (currently OpenRouter, which routes it to the model’s maker); with your own key it goes straight from your computer to your provider.
Providers handle this data under their own policies. Where a provider offers a setting that keeps data out of model training, we turn it on. Don’t put passwords, API keys or personal information about other people in your prompts or games.
What stays on your computer
Your chats, your History (a copy of your places in a local folder, used for undo), the app’s settings and your own AI key (encrypted with your system’s keychain) stay on your computer (a chat leaves it only if you pick it for a problem report). The app log (logs/rostack.log in the app’s data folder) also stays on your computer unless you send it. The Studio plugin talks only to the RoStack app on the same computer. Screenshots of Studio are taken only when you ask, or when the AI asks and you’ve allowed it.
How we use it
- To run your account, sign you in and show your account page.
- To charge for your subscription and AI usage, and to prevent fraud and abuse.
- To fix problems and keep the service secure.
- To contact you about your account or important changes.
We don’t sell your personal information, and we don’t use it for advertising.
How long we keep it
We keep your account data while your account is open. Billing records are kept as long as tax and accounting law requires. Expired sign-in sessions and one-time codes are deleted or become unusable automatically.
Your choices and rights
- See your usage and sign devices out on your account page.
- Cancel your subscription in Billing.
- Ask for a copy of your data, a correction, or deletion of your account by emailing [email protected]. We’ll answer within 30 days. Billing records we must keep by law are kept until that period ends.
Depending on where you live (for example the EU, UK or California) you may have more rights, such as objecting to processing or complaining to a data protection authority. Contact us and we’ll help.
Children
You must be at least 13 to use RoStack, and purchases must be made by an adult. If you believe a child under 13 has an account, email [email protected] and we’ll delete it.
Security
We use encrypted connections, store sign-in tokens only as hashes, keep money movements on the server, and limit who can access production systems. No system is perfectly secure; if something happens that affects your data, we’ll tell you as the law requires.
International transfers
Our servers and service providers may be in other countries, including the United States. Where the law requires it, we use appropriate safeguards for those transfers.
Changes
If we change this policy in a way that matters, we’ll let you know in the app or on the website before it takes effect.
Contact
TurningMatter (a DBA of Colossus Rentals LLC). Privacy questions and requests: [email protected].