Privacy Policy

Last updated: October 19, 2026

This explains what information [x]Tracker collects when you visit our website or use our Discord bot, why we collect it, how long we keep it, and what you can ask us to do about it.

1. What we collect

When you visit the website. Like most websites, our server records technical details of each request: your IP address, the time, the page you asked for, your browser's user agent, the page that sent you, and whether the request succeeded. We use this to keep the site secure and working. The site has no accounts, no ads and no third-party analytics, and it does not set cookies. Our site is delivered through Cloudflare, which handles visitor traffic (including IP addresses) to protect and speed up the site and may set its own security cookies. See Cloudflare's privacy policy for details.

When you use the bot. To run a command we receive your Discord user ID and username, the server and channel you used it in, and what you typed, such as a Roblox username or ID. Staff-only logs record some activity, such as lookups with /bc, changes to the database and errors, including who did it, in which server, and what was looked up. Cooldowns are kept in memory and are cleared when the bot restarts.

The registry. For accounts that staff have flagged, we store the Roblox user ID and username, linked alternate accounts, staff notes and evidence (links, screenshots and videos in our evidence vault). Entries are visible to users of the bot by design, because that is what the registry is for.

Reports and tickets. If you submit a report or open a ticket, we store your Discord ID and username, your answers, any evidence you send and the ticket conversation. Ticket conversations are saved as transcripts so staff can review decisions and follow up, and a transcript can be sent to you.

Screenshot scanner (Tracker+). If you send an image to /ocr, our server reads the text in it to find Roblox usernames, then looks those usernames up with Roblox and checks them against the registry. The image is processed in memory and is not saved by us, but the bot's reply shows it again in the channel where you ran the command, so it stays visible there like any other message. The usernames it finds are sent to Roblox's public lookup service. We do not send your image to any third-party AI or text-reading service.

Tracker+ subscriptions. Tracker+ is sold and billed by Discord, and we never see your payment details. When you subscribe, Discord tells our bot which user subscribed, which plan, and when it ends. We store that (your Discord ID, the plan, the end date and Discord's entitlement ID). If you buy a Server plan and use it on a server with /activate, we also store that server's ID so the bot knows where to apply it so the bot can give you the perks. If you subscribe, the bot may give you a role in our community server, and we remove it when your subscription ends.

Verification. If you verify your account in our community, we store your Discord ID, the Roblox username you linked and the IP address used at the time, which helps us stop abuse and duplicate accounts.

API keys. If you generate an API key, we store the key together with your Discord ID. When a key is used, we log each request: the time, the IP address it came from, the endpoint, the Roblox ID that was asked about and the first few characters of the key. We keep this to run the API and to spot abuse, and our API Acceptable Use Policy explains how the data it returns may be used.

Roblox's public data. We read public information from Roblox, such as profiles, badges and groups. We do not get private Roblox information. Requests to Roblox may be sent through proxy services.

2. How we use it

to run the bot, website, vault and API;
to build and maintain the registry, handle reports and decide appeals;
to prevent abuse, such as rate limiting and blacklisting;
to keep things secure, find bugs and fix problems.

We do not sell your information and we do not use it for advertising.

3. Who we share it with

Staff who need it to run the Service.
Service providers that host, protect or help operate the Service, such as Cloudflare, our hosting and proxy providers. They only get what they need.
Discord and Roblox, as part of how the bot works.
Authorities or others when the law requires it or to protect people's safety.

4. How long we keep it

Website request logs are stored in log files that rotate automatically, and old files are deleted.
Registry entries stay until they are removed after a review or appeal.
Reports, tickets and transcripts are kept for as long as we need them for moderation and appeals.
Verification records are kept until you ask us to remove them.
API keys are kept until you delete them with /deletekey.

5. Your choices

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. We can't always delete everything straight away, for example evidence we need for safety or legal reasons, but we'll tell you what we can do. You can delete your API key yourself with /deletekey. If you think a registry entry about you is wrong, open an appeal ticket. Depending on where you live, you may also have legal rights over your data, and we'll respect them. We may need to confirm it's really you before acting on a request.

6. Children

The Service is meant for people who are old enough to use Discord (13 or older). We don't knowingly collect personal information from children under 13. If you think we have, contact us and we will remove it.

7. Security

We use reasonable measures to protect your information, including encrypted connections, limited staff access and rate limiting. No system is perfectly secure, so we can't promise absolute protection.

8. Where data is handled

Our services and our providers may handle data in countries other than your own.

9. Changes

We may update this policy. The date at the top shows when it last changed, and we will announce major changes in our Discord community.

10. Contact

For questions or requests about your information, join our Discord community and open a ticket.