Privacy policy

Last updated: 31 October 2026

Krypton is an anti-cheat for Roblox games, with a web panel where a game's developer and their team review what it finds. This page explains what data Krypton handles, why, who can see it, how long it is kept, and what you can ask for.

Who runs Krypton

Krypton is run by Roufox, and its servers are in Paris, France (EU). For anything about your data, contact [email protected].

Two kinds of data

• Panel accounts. If you sign up for the panel, Krypton decides how your account data is used and is responsible for it (the "controller").
• Players of games that use Krypton. When you play a game that runs Krypton, the game's developer decided to use it and is responsible for that data. Krypton processes it on their behalf (as their "processor") and only to run the anti-cheat for that game.

Panel accounts

What we collect

• Your username, display name and password. The password is stored only as a salted hash.
• Your Roblox account ID and username, if you link your Roblox account. Linking is done with a short code you put in your Roblox profile or enter in our Roblox verification place.
• Your license: whether you own the Krypton License game pass (checked through Roblox), or a license granted by Krypton staff, and any extra game slots.
• Payment records if you pay by card: amount, currency, status and the payment provider's reference. Card details are handled by the payment provider and never reach Krypton.
• When you created your account and last signed in.
• A security log of account events (sign-ins, failed sign-ins, registration, account deletion) and changes made to games in the panel. Sign-in, registration and deletion events include your IP address.
• One cookie that keeps you signed in. Krypton uses no analytics, advertising or tracking cookies.

Why, and on what basis

• To provide the panel and your license: necessary to perform our agreement with you (GDPR article 6(1)(b)).
• The security log and IP addresses: to protect accounts and the service from abuse, which is our legitimate interest (article 6(1)(f)).

How long

• Account data is kept until you delete your account (Account page, Delete account). Deleting it also deletes the games you own and all their data.
• IP addresses are removed from the security log after 90 days. The web server's own access logs are deleted after 10 days.
• Payment records are kept as long as accounting law requires.

Players of games that use Krypton

What the game sends to Krypton

• Your Roblox user ID, username, display name, account age, membership type and language setting.
• Which of the game's servers you were in, and on which days you played.
• What the anti-cheat found, if anything: the type of finding, technical details such as the name of a suspicious interface or a line from the game's console on your device, the server, and the game version.
• Actions the game's team takes: kicks, bans, banwave entries, whitelisting, a review status, and notes they write about you.

What Krypton looks up on Roblox

For players the game has seen, Krypton reads your public Roblox profile through Roblox's public APIs: account creation date, profile description, avatar picture, verified badge, past usernames, numbers of friends, followers, followings and groups, and whether Roblox has banned the account. This helps the game's team tell a new or throwaway account from an established one.

Why, and on what basis

To detect cheating and exploits in the game and let the game's team review findings and act on them. The basis is the game developer's legitimate interest in keeping their game fair and working for other players (article 6(1)(f)). Krypton does not ask for your name, email or age, and does not use this data for advertising.

Automated decisions

A finding alone never bans anyone: banwaves wait for a person on the game's team to approve each player. If a game turns on automatic kicks, a finding can remove you from that server; you can join again. Bans can be applied through Roblox's ban system so they hold in every server of that game.

Who can see it

• The game's owner and the people they add to the game's team in the panel.
• Krypton staff, to provide support, check for false detections and investigate abuse. Staff access is read-only.
• If the game's team connects a Discord webhook, findings for that game (with your username and user ID) are also posted to their Discord server.

Data from one game is never shown in or used for another game. Krypton does not sell data or share a ban list between games.

How long

• As long as the game uses Krypton. When the game is removed from the panel, or its owner deletes their account, all of its player data is deleted.
• The game's team can delete findings at any time. Deleted findings can be restored for 90 days, then they are erased. Records of kicks and bans sent to game servers are deleted after 90 days.

Who processes data for Krypton

• Oracle Cloud Infrastructure: hosting, in the Paris region (France, EU).
• Roblox: Krypton calls Roblox's APIs to look up public profiles, check game pass ownership and, when a game uses it, apply bans.
• Discord: only when a game's team connects a webhook.
• Stripe: card payments, when card payment is offered.

Krypton's servers are in France, so its own data stays in the EU.

Your rights

Under the GDPR you can ask to access your data, correct it, delete it, restrict or object to its use, and get a copy of it. Contact [email protected] with your Roblox user ID or panel username. We answer within one month.

For player data, the game's developer decides about their game; we will pass your request to them and help them answer it. A game may keep a record of an active ban where it is needed to enforce it.

You can also complain to the data protection authority where you live, for example the CNIL in France (cnil.fr).

If you run a game with Krypton

For your players' data you are the controller and Krypton is your processor. Krypton only processes that data to run the anti-cheat for your game and to support you. Tell your players that your game uses an anti-cheat service, for example by linking to this page from your game's description.

Security

The panel is served over HTTPS, passwords are hashed, Discord webhook addresses are stored encrypted, and access to the server and database is limited to Krypton staff.

Changes

If this policy changes, the date at the top changes too. Significant changes will be announced in the panel.