Privacy Policy

What Deflua collects, why, how long we keep it, and what you can ask us to do with it.

Last updated 29 October 2026

1. Two roles

For seller accounts, Deflua decides what data is processed and is responsible for it. For buyers who run a seller’s script, we process data on the seller’s behalf to check keys and deliver the script; the seller decides how keys are used, and buyers should contact the seller first about their data.

2. What we collect

Seller accounts

• Username, email address and a hashed password.
• Discord server and user IDs, if you connect the Discord bot.
• Your projects, scripts, keys, settings and webhooks.
• Sign-in records: time, IP address and browser, to protect your account.
• Billing records for paid plans. Card details are handled by our payment provider and never reach our servers.

When a script runs

• The key used, a device identifier (HWID) and the executor name.
• IP address and the approximate country derived from it.
• The Roblox game (place) and the time of each run and session check-in.
• Discord user ID, when a buyer uses the seller’s Discord panel.

3. Why we use it

• To run the Service: check keys, bind and reset devices, deliver scripts and show sellers their analytics.
• To protect it: stop leaked keys, abuse, brute-force attempts and attacks.
• To contact account holders about their account, security and changes to the Service.

We do not sell personal data, and we do not use it for advertising.

4. How long we keep it

• Sign-in and registration attempts: 30 days.
• Account activity logs: 180 days.
• Run and key history: for as long as the seller keeps the project, or until the seller deletes it.
• Account data: until the account is closed, then deleted within 30 days, except records we must keep by law.

5. Who we share it with

Only with services we need to run Deflua: our hosting provider, our email provider, Discord (when you use the bot) and our payment provider, and with a seller for the runs of their own scripts. We may disclose data if the law requires it.

6. Cookies

The dashboard uses one session cookie to keep you signed in. We use no tracking or advertising cookies. This page loads fonts from Google Fonts and libraries from public CDNs, which see your IP address when they serve them.

7. Security

Passwords are hashed, traffic is encrypted with HTTPS, and access to servers and databases is restricted. No system is perfectly secure; if a breach affects your data we will tell you without undue delay.

8. Your rights

You can ask to see, correct, export or delete your personal data, or object to how we use it, by writing to [email protected]. Buyers whose data is held for a seller should ask that seller first; we will help the seller respond. You may also complain to your local data-protection authority.

9. Children

The Service is not meant for children under 13, and we do not knowingly collect their data.

10. Changes

We will post any change here and update the date at the top. Significant changes are announced to account holders before they apply.