Privacy Policy

PrimaryPart ("the Service," "we," "us," or "our") is a platform developed and operated by PrimaryPart Labs. This Privacy Policy explains how we collect, use, and protect information when you use our website at primarypart.com, our API, and the PrimaryPart Grand Module (the "Module").

By accessing or using the Service, you agree to the practices described in this Policy.

1. Who This Policy Applies To

PrimaryPart provides analytics and extended API services to Roblox game developers ("Developers"). This Policy covers information we collect about Developers who register for or use the Service.

PrimaryPart is designed to prevent the collection of directly identifying information about players. Player data reaches us in pseudonymized form, so we cannot tie it to a named person on our own. See Section 5 for details.

2. Information We Collect

From Developers - via Roblox OAuth

When you connect your Roblox account to PrimaryPart, we receive from Roblox:

• Your Roblox user ID (read-only)
• Your Roblox username (read-only)
• Your Roblox universe (game) metadata, where authorized via the universe:read scope

This access is strictly read-only; we cannot modify your account or act on your behalf. We use Roblox's OAuth 2.0 protocol for authentication. We do not receive or store your Roblox password.

From Game Servers - via the Module

When you integrate the Module into your Roblox game, your game server sends analytical event data to our API. This data reaches us in pseudonymized form: it does not include Roblox usernames, raw user IDs, chat content, email addresses, or payment details. Under GDPR we treat it as pseudonymized personal data, not anonymous data, and protect it accordingly.

Event data may include gameplay and economy metrics such as session length, progression events, in-experience purchase events, coarse region and platform, and error reports.

Automatically

When you use the PrimaryPart dashboard or website, we may collect:

• Session tokens (stored in cookies for authentication purposes)
• Standard server logs (IP address, browser type, request timestamps) for security and reliability - retained for up to 90 days, then deleted
• Aggregate, cookie-free page-view and performance statistics

We do not use third-party tracking pixels, behavioral advertising, or persistent analytics cookies.

Public Roblox Data

Down the line, we may make use of publicly available Roblox information, like public game statistics from Roblox's own public APIs, simply to better understand the platform as a whole. Any private metrics collected through the Module or private integrations stay visible only in your authenticated dashboard, and are never sold, shared with third parties, or published.

3. How We Use Your Information

We use the information described above to:

• Authenticate and maintain your Developer account
• Provide analytics and platform features via the dashboard and API
• Enforce rate limits and prevent abuse
• Send service-related communications (e.g., account alerts)
• Improve the reliability and performance of the Service

We do not sell your information to third parties.

We may also use aggregated, de-identified data to improve the Service and to produce and share statistics. These are computed so that they cannot be attributed to any individual game, Developer, or player. We never sell or license Developer account data or game-level data that identifies your game.

4. Cookies

We use only cookies that are strictly necessary or functional. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies.

• Session cookies - keep you authenticated while using the dashboard. Cleared when the session ends or expires.
• Device cookie - a long-lived random identifier used to recognize a browser you have signed in from before. It helps us keep your account secure, apply proportionate rate limits, and reduce unnecessary re-authentication. It is not tied to advertising and is not shared with anyone.
• Preference cookie - stores interface settings such as light or dark theme, so pages render correctly on first load. Contains no personal data.

5. Player Data

PrimaryPart acts as a Data Processor, not a Data Controller, with respect to your players. The Developer, as the operator of the experience, is the Data Controller. Player data reaches us in pseudonymized form, and we treat it as personal data and protect it accordingly.

Deletion Requests. Players exercise their rights through the Developer. Because we do not receive directly identifying information about players, we cannot identify or locate an individual player on our own, so the Developer initiates erasure requests. When you ask us, through the deletion tools we provide, to delete a player's data, we permanently disassociate and anonymize the corresponding event records without undue delay, while retaining generalized telemetry.

6. Data Roles

7. Infrastructure and Storage

Our services are hosted on Cloudflare's global infrastructure, which we use for compute, storage, and delivery. Cloudflare operates globally distributed data centers. For details on Cloudflare's data practices, refer to Cloudflare's Privacy Policy.

International transfers. Because Cloudflare's network is global, data may be processed outside your country of residence, including outside the European Economic Area. Cloudflare acts as our sub-processor under its own data processing agreement and Standard Contractual Clauses, which provide the transfer safeguards for this processing.

Security incidents. If we become aware of a personal data breach, we will notify affected Developers without undue delay, together with the information reasonably available to us so that they can meet their own notification obligations toward their players and regulators.

8. Third-Party Services

• Roblox - OAuth 2.0 authentication and universe access. Governed by Roblox's Privacy Policy.
• Cloudflare - Hosting, edge compute, and storage. Governed by Cloudflare's Privacy Policy.
• Lemon Squeezy - Payment processing, billing, tax compliance, and Merchant of Record services. Governed by Lemon Squeezy's Privacy Policy.
• Amazon Web Services (Amazon SES) - Transactional email delivery only (e.g., sign-in links, security alerts, account and usage notifications). No marketing emails are sent without explicit opt-in. Governed by AWS Privacy Notice.

These are our current third-party vendors and sub-processors. If we add or replace one, we will update this list and notify Developers with an active account before the change takes effect.

9. Age Requirement and Children's Data

The Service is intended for users who are 13 years of age or older. By using PrimaryPart, you represent that you meet this requirement. If we learn that a user under 13 has created an account, we will promptly delete their information.

Players in your experiences. Roblox has a large audience under the age of 13, and we have designed the Service on that assumption. We do not receive Roblox usernames, raw user IDs, email addresses, contact details, precise location, chat content, or any other directly identifying information about players. We do not build advertising profiles, we do not use player data for behavioral advertising or targeting, and we do not disclose player-level data to anyone. Player data is processed solely to provide the analytics and related gameplay services that the Developer has integrated, and to maintain and improve the reliability and security of the Service - uses that fall within the support-for-internal-operations exception under COPPA.

The Developer, as the operator of the experience and the Data Controller, remains responsible for providing any notice and obtaining any consent required in their jurisdiction, and for complying with Roblox's own policies on the handling of player data.

10. Data Retention

Developer account data is retained for as long as your account is active. You may request deletion of your account and associated data at any time by contacting [email protected].

Indicative retention periods, which we will keep current as the Service matures:

• Developer account data - retained for the duration of the active account and permanently purged within 30 days of receiving a verified deletion request.
• Server logs - up to 90 days.
• Player event data - retained while the associated game remains registered, and deleted within 90 days after the game is removed or the account is closed.
• Aggregate statistics - retained indefinitely. These are computed over peer groups above a minimum size and cannot be attributed to an individual game or player, so deleting an account does not require their removal.

Note that during Stage A, as described in our Terms of Service, historical data retention is not guaranteed: data structures may change and older records may be dropped during platform updates.

11. Your Rights

You may have rights to access, correct, or delete your personal data. To exercise any of these rights, contact us at [email protected]. We will respond within a reasonable timeframe.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date at the top of this page. Your continued use of the Service after that date constitutes acceptance of the updated policy.

13. Contact

For questions, requests, or concerns regarding this Privacy Policy:
PrimaryPart Labs
[email protected]