Privacy Policy

The controller of your personal data is Matěj Wernisch, with registered office at Sokolská 1883/8, 120 00 Prague 2, Czech Republic, company ID (IČO) 29519641, registered in the Czech trade register (the "provider", "we", "us").

Contact for all privacy matters: hello@anyutil.io. We have not appointed a data protection officer, as we are not required to do so under Article 37 of the GDPR.

This policy applies to the website devstats.gg and the DevStats dashboard (the "service"). It is issued under Regulation (EU) 2016/679 (GDPR).

a) Roblox account information. When you sign in with Roblox we receive your Roblox user ID, username, display name and avatar image URL, plus OAuth access and refresh tokens. We never receive or store your Roblox password. Purpose: to identify you and operate your dashboard. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

b) Your configuration. The experiences you choose to track, your stated ownership percentage per experience, and your dashboard layout preferences. Purpose: to provide the service. Legal basis: performance of a contract (Article 6(1)(b)).

c) Open Cloud API keys. If you add a Roblox API key, we store it encrypted and use it solely to query Roblox analytics for the experiences you track. Purpose: to provide the service. Legal basis: performance of a contract (Article 6(1)(b)).

d) Experience analytics. Revenue, player counts, engagement and similar figures for your experiences, retrieved from Roblox. This is primarily business data about your experiences rather than about identified individuals, and Roblox provides it to us in aggregated form only. Legal basis: performance of a contract (Article 6(1)(b)).

e) Share links. If you create a share link, we store a snapshot of the selected statistic so it can be displayed to anyone holding the link, together with your chosen expiry and a view count. Legal basis: performance of a contract (Article 6(1)(b)); publication happens only at your instruction.

f) Server logs. Our web server records IP addresses, timestamps, requested URLs, response codes and user-agent strings. Purpose: operating and securing the service, diagnosing faults and preventing abuse. Legal basis: our legitimate interests (Article 6(1)(f)) in keeping the service available and secure.

We do not sell personal data, do not use it for advertising, do not build marketing profiles, and carry out no automated decision-making or profiling producing legal or similarly significant effects within the meaning of Article 22 of the GDPR.

We use a single strictly necessary cookie to keep you signed in. It holds an encrypted session identifier, expires after 30 days at the latest, and is deleted when you sign out. Under Section 89(3) of Czech Act No. 127/2005 Coll. on Electronic Communications, cookies strictly necessary for providing a service you requested do not require consent.

Your browser may additionally store your chosen dashboard layout and colour theme locally on your device. That information stays in your browser and is never transmitted to us.

We use no analytics, advertising or cross-site tracking cookies of any kind.

Hosting. The service runs on servers operated by Hostinger International Limited, physically located in Frankfurt am Main, Germany. All data described above is stored there, inside the European Union.

Roblox Corporation. To provide the service we send requests to Roblox APIs, which necessarily discloses your Roblox user identifier, the experience identifiers you track and, where applicable, your API key to Roblox. Roblox is an independent controller for its own processing; see Roblox's privacy policy.

We disclose data to no one else, except where we are required to do so by law or where it is necessary to establish, exercise or defend legal claims.

Your data is stored in Germany. However, Roblox Corporation is established in the United States, so requests we make on your behalf involve a transfer of a limited set of data (identifiers and your API key) to the United States. That transfer is necessary for the performance of the contract between you and us within the meaning of Article 49(1)(b) of the GDPR, and it happens only because you have asked us to retrieve your Roblox data. If you would rather avoid it, do not connect a Roblox account.

• Session data: until you sign out, or 30 days at the latest.
• Account information, tracked experiences and API keys: until you delete them or ask us to delete your account.
• Share link snapshots: until the expiry you selected, or until you revoke the link.
• Cached analytics figures: at most 6 hours, after which they are re-queried or discarded.
• Server logs: approximately 10 days, then rotated and deleted.

Under the GDPR you have the right to:

• access your personal data and obtain a copy (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased (Article 17);
• restrict processing (Article 18);
• data portability (Article 20);
• object to processing based on our legitimate interests (Article 21);
• withdraw any consent at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise any of these, write to hello@anyutil.io. We will respond within one month. You can also delete most data yourself: remove an API key or a share link in the app, or sign out to end your session.

If you believe we are processing your data unlawfully, you may lodge a complaint with the Czech supervisory authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz. You may also complain to the authority in your country of residence.

All traffic is encrypted in transit with TLS. API keys are encrypted at rest and are never displayed back to you or included in share links. Analytics caches are separated per credential so one user's data can never be served to another. Access to the server is restricted to the provider.

No system is perfectly secure. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you in accordance with Article 34 of the GDPR.

The service is intended for people who develop Roblox experiences and is not directed at children. You must be at least 15 years old (the age of digital consent in the Czech Republic) to use it, and if you are under 18 you must have your parent's or guardian's permission. We do not knowingly process the personal data of children under 15; if we learn that we have, we will delete it without undue delay.

We may update this policy as the service develops. The date at the top of this page shows the latest revision. If a change materially affects your rights, we will make it apparent in the service before it takes effect.

Matěj Wernisch, Sokolská 1883/8, 120 00 Prague 2, Czech Republic, IČO 29519641, hello@anyutil.io.

DevStats is not affiliated with, endorsed by or sponsored by Roblox Corporation. Roblox and Robux are trademarks of Roblox Corporation.