Last updated: 19 October 2026.
This policy explains what personal data RoVibeCoder handles: in the desktop app, in the content service that checks licenses and delivers skill packs, when you buy a license from us on Discord, and on our website at rovibecoder.nearcsx.dev.
1. Who we are
RoVibeCoder is run by its owner, who decides what happens to the personal data this policy describes ("we", "us"). You can reach us only on our Discord server, which every page of our website links to. Ask us there about anything in this policy (section 14).
2. In short
- Your projects, assets, prompts, terminal output and Roblox Studio data stay on your PC. The app never sends them to us.
- The app has no analytics, telemetry or crash reporting. Its logs stay on your PC.
- Until you activate a license, the app sends nothing to us.
- After you activate a license, the app sends us only what is needed to check the license and deliver skill packs (section 5).
- We sell licenses by hand on our Discord server. For a sale we keep your Discord username and user ID, our conversation, an email address only if you offer one, what you bought and the record of your payment from PayPal or the blockchain (section 6). Discord, PayPal and the blockchain network handle their part under their own rules.
- The website sets no cookies, runs no analytics and loads nothing from other companies.
- The AI agents you run send your prompts and the project content they read to the AI providers you chose, under those providers' terms (section 4).
3. What stays on your PC
- Projects. New projects go to your Documents folder or a folder you choose.
- App data. RoVibeCoder keeps its data in two folders under
%APPDATA%and%LOCALAPPDATA%(the Diagnostics page shows them): a database with your projects list, settings, your asset bank's records, the state of your license and skill packs, and a log of every tool call your agents make (file contents in it are replaced by their size and fingerprint); the asset files and their previews; the virtual machine's disks; installed skill packs; and the logs. - Logs. One file per day; the app keeps the last 14. They can contain folder paths (which can include your Windows user name), project names and error messages, but never keys or tokens. Crashes are written to the log and shown to you in a message; RoVibeCoder sends no crash reports.
- Your license sign-in. The app's sign-in token for the content service is kept in Windows Credential Manager, for your Windows user only, protected by Windows and not copied to your other PCs. Short-lived access tokens are kept in memory only. Your license key is not stored after activation.
- Agent sign-ins and API keys. RoVibeCoder never reads, stores or forwards the credentials of your agent tools. Each tool keeps its own sign-in: on your PC wherever the tool keeps it, or, for agents in the virtual machine, on the machine's disk.
- The virtual machine runs on your PC and sees only the project you are working on.
- The Roblox Studio plugin connects only to RoVibeCoder on your own PC.
- Roaming profiles. If your Windows account uses a roaming profile, as some organisations
set up, Windows copies the
%APPDATA%folder, including the database, to your organisation's server. That is done by Windows, not by us.
You can delete this data at any time. Uninstalling with "Delete app data" removes both data folders; project folders and a virtual machine folder you chose outside them are never deleted. To sign the PC out of your license first, and free its device slot, use "Deactivate this device" on the Account page.
4. Other companies RoVibeCoder connects you to
- AI agents. Agent tools send your prompts, the files they read, the Roblox Studio data they read through RoVibeCoder's tools, and their own output to the AI provider behind the tool. That happens between you and that provider, under its terms and privacy policy. RoVibeCoder does not see or control it. Agents in the virtual machine can reach the internet.
- Setting up the virtual machine. When you start the download on the Runtime page, the app downloads the Ubuntu base image from Canonical's servers. While it sets itself up, the virtual machine downloads Node.js from nodejs.org, Ubuntu packages from the Ubuntu archive and the agent tools you selected from the npm registry. Those servers see your IP address and what is downloaded, under their own privacy policies.
- Installing QEMU. Only if you choose Install QEMU with winget on the setup checklist, RoVibeCoder starts Windows' winget. winget reads the QEMU package's listing from Microsoft's winget source and downloads QEMU's installer from the server that listing names. Those servers see your IP address and what is downloaded, under Microsoft's privacy policy and that server's own. Download QEMU from qemu.org opens the QEMU project's web page in your browser instead.
- The app window is drawn by Microsoft Edge WebView2, a Windows component. It loads nothing from the internet; Microsoft's own terms cover the component itself.
5. The content service
5.1 What the app sends
- Activation: your license key (once), a random installation ID the app creates, a device name (the app suggests your Windows computer name; you can change it before you activate) and the app version.
- License checks (at launch, every 6 hours and when you click "Check now"): the app's sign-in token. The app also reads a public status page (the minimum app version and service notices).
- Skill sync: the app version, and requests for the skill files your license includes.
- The Account page: requests to list your devices and to deactivate them.
Every request also carries the app's name and version, and, like any internet connection, your IP address.
The app never sends us project files, prompts, terminal output, Roblox Studio data, anything from your agent tools, your asset bank or your logs. The virtual machine never contacts our server.
5.2 What our server stores
| Record | What it holds |
|---|---|
| Customer | Your Discord user ID and username, your email address if you offered one (at least one of the two), a customer ID and when it was created |
| License | A fingerprint (SHA-256) of your license key, never the key itself; your plan, status, device limit and when the license ends |
| Devices | For each activation: the installation ID, device name, app version, when it was activated and last seen, and when and why it signed out |
| Sign-ins | Fingerprints of the app's sign-in and access tokens, never the tokens themselves, with when they were issued, used, revoked and expire |
| Support audit | What we did on your license: who, what, when, the license, customer or device ID, and the reason given |
The database holds no IP addresses and no payment details. Support lookups are recorded under your customer ID, not your email address or Discord account. Anyone signed in on a device of your license can see the names, app versions and dates of that license's devices.
5.3 Logs
- The content server writes one line per request: a request ID, the kind of request (not its contents), the result and how long it took. Activations, sign-in renewals and deactivations are logged with the license and device IDs. Your IP address is logged only when a request is refused for going over a rate limit. Keys, tokens, request headers and request bodies are never logged.
- The web server in front of it keeps an access log of each request: your IP address, the time, the address requested (for skill sync this includes the app version), the result and the request's headers, such as the app's name and version. Headers that carry sign-in tokens are removed from it.
- Rate limits count requests per IP address in the server's memory only. They are never written to disk and are forgotten when the server restarts or needs the room.
6. Buying a license on Discord
We sell licenses by hand on the RoVibeCoder Discord server. There is no online shop.
- Discord. You buy by talking to us on Discord, on the server or in direct messages. Discord Inc. runs Discord and handles everything you do there, including our conversation and the message that carries your license key, under its own Privacy Policy.
- What we keep for a sale:
- your Discord username and user ID, as Discord shows them to us, and our direct message conversation about the purchase;
- an email address, only if you offer one;
- what you bought (the plan, the number of days, the price and the date), the license it is for, and your agreement to immediate supply;
- for a PayPal payment, the transaction record PayPal gives us: your name and email address, the amount, the date and the transaction ID;
- for a crypto payment, the wallet address you paid from, the transaction ID and the amount. These are public on the blockchain, where anyone can see them and nobody can delete them.
- Where: our record of a sale is kept privately by us, never in a Discord channel. Our server stores only your Discord user ID and username, your email address if you offered one, and your license (section 5.2).
- Your license key goes to you in a Discord direct message. We keep no copy of it, and our server stores only its fingerprint.
- What we use it for: to check that your payment arrived and came from you, to issue and renew your license, to send your key, to replace a lost key (also when you ask from a new Discord account, by comparing the purchase details you give us with our record), to handle refunds, disputes and chargebacks, and to keep the records the law requires. We use an email address you offered only to find your license, for example if you lose access to your Discord account. We contact you only on Discord, and we do not send marketing messages.
7. The website
The website sets no cookies, runs no analytics or tracking, and loads nothing from other companies' servers. It has no forms and asks you for no personal data. Like any web server, ours receives your IP address with each request in order to answer it. It keeps no record of the requests it answers (no access log). When it cannot answer a request, for example while the site is being restarted, it records the error together with the request: your IP address, the address you asked for and your browser's request headers. Those error records are kept as section 12 says.
The website's links to our Discord server are plain links: the site loads nothing from Discord, and Discord sees your visit only when you follow one, under its own privacy policy.
8. Support
Support happens on our Discord server, and our conversations are kept as section 12 says. If you send us a log file, look through it first: it can contain folder paths with your Windows user name, and project names. Never post your license key or a log in a public Discord channel.
9. Why we use your data
| Purpose | Legal basis (EU and UK GDPR) |
|---|---|
| Selling, issuing and renewing your license, checking your payment, sending your key | Performing our contract with you |
| Activating devices, checking the license, delivering skill packs | Performing our contract with you |
| Answering support requests, handling refunds | Performing our contract with you |
| Handling disputes and chargebacks, preventing payment fraud | Our legitimate interest in being paid for what we sell |
| Preventing key sharing and abuse, keeping the service secure (device limits, rate limits) | Our legitimate interest in a secure service that only paying customers can use |
| Logs, the support audit trail and backups | Our legitimate interest in running the service reliably and accountably |
| Keeping the sales records the law requires, answering lawful requests | Legal obligation |
10. Who we share data with
- Hosting: OVHcloud runs the servers of the content service and the website.
- Backups: database backups are encrypted before they leave the server for our private backup storage, so the storage provider cannot read them.
- Discord (Discord Inc.), where we sell licenses and answer questions. It handles our conversations as a controller in its own right, under its own privacy policy (section 6).
- PayPal, for a PayPal payment. It handles the payment as a controller in its own right, under its own privacy statement.
- The blockchain network, for a crypto payment: the payment is public on it, with the addresses it was sent from and to. The wallet or exchange you send it with handles it under its own policies.
- Authorities, when the law requires us to.
We do not sell personal data and do not share it for advertising.
11. International transfers
Discord Inc. is based in the United States, and PayPal and your wallet or exchange may process data in other countries; their privacy policies explain how they transfer it. A blockchain is copied to computers around the world.
12. How long we keep data
| Data | How long |
|---|---|
| Access token fingerprints | Deleted about an hour after the token expires (tokens last 15 minutes) |
| Sign-in token fingerprints | Deleted when they expire, 90 days after they were issued |
| Customer, license and device records | While your license exists, and up to 24 months after it ends. Signed-out devices are kept with it |
| Support audit trail | As long as the license it is about: while it exists, and up to 24 months after it ends |
| Sales and payment records (section 6) | Up to 24 months after the sale, and longer only where a law requires it |
| Server logs (section 5.3), website error records (7) | Up to 24 months |
| IP addresses counted for rate limits | In memory only, until the server restarts or needs the room |
| Database backups | Four weeks of backups, so deleted data can stay in them for up to about four weeks |
| Full database copies taken before each server update | The ten most recent are kept on the server |
| Our Discord conversations, sales and support | As long as Discord keeps them, unless you ask us to delete the messages we can delete |
| Crypto transactions on the blockchain | For good: nobody, us included, can delete them |
| Data on your PC | Up to you; the app keeps 14 days of logs |
13. Security
- License keys and tokens are stored only as fingerprints, so a copy of our database does not reveal them.
- The app talks to our server only over HTTPS, and the server accepts only TLS 1.2 and 1.3.
- The server runs under its own restricted account. Support actions are recorded in an audit trail that the server and the support tools can add to but cannot change or delete.
- Backups are encrypted before they leave the server.
- Skill packs are signed with a key that is kept offline, never on the server, and the app checks every file against that signature before it uses it.
- License keys go only to the buyer, in a Discord direct message; our server never holds one.
14. Your rights
Under the EU and UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or give it to you in a machine-readable form, and you can object to uses based on our legitimate interests. Ask us on our Discord server. We answer within one month and may ask you to show that the license is yours: by asking from the Discord account it was sold to or, if you lost that account, with details of your purchase (Terms, section 5). Without its records, a license cannot work, so deleting them ends the license. We cannot delete what Discord, PayPal or a blockchain keeps; ask them for that.
You can see and deactivate your devices yourself on the Account page.
You can complain to the data protection authority where you live or work.
15. Children
Licenses are sold to adults. If you are younger, a parent or guardian buys the license, and the Discord account, the payment and any email address we hold are theirs. If you think a child has given us personal data without a parent's consent, tell us on Discord and we will delete it.
16. The asset catalogue
The asset catalogue is not available yet. Before an app update adds it, we will update this policy to say what it sends, such as the search text and which assets you download.
17. Changes to this policy
We will publish any change here with a new date, and tell you on our Discord server before an important change applies to you.