Legal
Privacy Policy
Last updated: October 12, 2026
1. Who we are
KrulHub hosts community scripts and related features for Roblox executor users. This policy describes what data the service records, why it is used, and how long it is retained.
2. What we collect
Data collected varies by feature. KrulHub records aggregate script activity, information needed to deliver and moderate features, and optional diagnostics as described below.
Public scripts (no login)
- Script activity - public script runs increment aggregate hit counters. After a script payload loads, its loader sends the player's Roblox UserId in an online-count heartbeat about once per minute. The online-presence entry expires 90 seconds after the last successful heartbeat. This heartbeat is separate from optional diagnostics.
- Request metadata - Cloudflare handles request IP, time, and datacenter information. KrulHub also stores short-lived delivery, consent-token, and rate-limit entries that can contain a request IP address.
Discord login (optional)
- Discord account data - Discord sign-in provides your Discord user ID, username, and avatar hash. KrulHub uses them for session management and membership checks. A signed-in bundle submission also identifies your Discord account in its moderation record.
- Session token - an opaque random token is generated and stored server-side for the duration of your login window.
Ro-Clothes community submissions
- Submission records - a submission contains the bundle, status and timestamps, script and manifest versions, submitter name, a Roblox UserId or signed-in Discord ID, and the request IP. Administrators use these records to review submissions and enforce abuse controls.
- Published bundles - approved bundle data can be added to the community library. The moderation record retains its submitter fields.
Real-time avatar sync (opt-in)
- Per-server state - if you enable Avatar Sync in the Ro-Clothes script, your Roblox UserId, display name, current bundle, script version, Roblox placeId, and Roblox jobId (server instance UUID) are published to a short-lived endpoint so other opted-in users in the same server can render your bundle. State is ephemeral and expires 300 seconds after your last publish.
Diagnostics telemetry (opt-in, default off)
- Optional uploads - diagnostic uploads are off by default. When enabled, Ro-Clothes sends event names and timestamps, script version, executor and platform information, a random installation ID, and structured error fields. Review queued events in the script before sending.
- Installation ID - the random ID is stored locally and links events from the same installation. It is separate from your Roblox and Discord account IDs, but it can link the diagnostic events you send over time.
- Storage and access - accepted event batches are stored in Cloudflare R2 until an administrator purges them. Administrators can inspect raw batches and event samples, including installation-ID prefixes. KrulHub also uses the request IP in short-lived telemetry rate limits.
- Local-only logs - a local diagnostic log at
RClothesLerp/diagnostics.log is written regardless of the toggle for self-diagnostic purposes. The log never leaves your machine unless you copy it.
Moderation & administration
- Abuse ban entries - Roblox UserIds and, for signed-in submissions, Discord IDs can be stored when an administrator bans a user for abuse of submission or avatar-sync endpoints.
- Admin action log - administrator IP, action name, and timestamp are recorded when a privileged action is performed (script rename, chunk upload, submission approve/reject, etc.).
Diagnostic uploads are optional. The script-loader online-count heartbeat, chat activity, submissions, and Avatar Sync use separate data flows described here.
3. Why we collect it
- Hit counter - to display script popularity indicators on the homepage.
- Online-count heartbeat - to show the "Online now" number on the homepage.
- Discord account data - to manage sign-in, verify community membership, attribute signed-in submissions, and moderate abuse.
- Submitted bundles - to moderate community content and publish approved bundles.
- Avatar sync state - to let other opted-in users in the same Roblox server render your bundle in real time.
- Diagnostics telemetry (opt-in) - to investigate Ro-Clothes faults and summarize activity across executor, platform, and version combinations. Administrators can inspect individual events.
- Ban list - to enforce UID-level bans against abuse.
- Admin action log - administrative accountability and abuse investigation.
4. How long we keep it
- Hit counter - stored indefinitely as aggregate counters. Short-lived IP-keyed delivery and rate-limit entries expire separately.
- Online-count heartbeat - a Roblox UserId presence entry expires 90 seconds after its last successful heartbeat. Related IP and UserId rate-limit entries also have a 90-second TTL.
- Discord session - expires and is deleted when you log out or when the session token's TTL elapses.
- Submitted bundles - pending records remain until reviewed. Approved, rejected, and spam records have no automatic expiry in the current system.
- Avatar sync state - 300 seconds after your last publish. Refreshed on every publish; auto-deleted when you stop publishing.
- Diagnostics telemetry (opt-in) - raw R2 objects remain until manually purged by an administrator. Turning the diagnostics toggle off stops future diagnostic uploads; it does not delete earlier batches.
- Chat - identity records, including the chosen UID, nickname, and signing secret, have no automatic expiry. Messages remain in bounded histories until displaced, cleared by an administrator, or deleted with a group by its owner. Deleting your own global or direct message hides its text from participants while the original remains in server storage as long as that record exists. Reports remain in a moderator-only queue until removed or displaced.
- Ban list - chat hard bans remain until lifted by an administrator. Seven-day submission-spam bans expire on their own TTL.
- Admin action log - 30 days.
5. Who can access it
Administrators can access submissions, moderation records, and diagnostic batches. Chat participants can see messages and optional profile or join details in rooms and conversations they can access; admin tools let moderators review stored global and direct chat and reports, and clear group histories by group ID. Avatar Sync entries can be read by clients that know the relevant Roblox placeId:jobId pair. KrulHub uses the service providers listed below to deliver these features.
6. Third-party services
- Cloudflare - Workers, KV, R2, and ChatHub Durable Objects host the service. Cloudflare processes request metadata under its own policy.
- Discord - used for OAuth login and community membership checks. Your Discord account data is governed by Discord's own privacy policy.
- Roblox - the avatar-sync feature fetches Roblox user and asset thumbnails and (for moderation previews) temporarily creates/deletes outfit entries on bot accounts owned by the operator. No end-user Roblox credentials are ever requested or stored.
- Tenor - when you search for GIFs, KrulHub sends the search term to Tenor and displays Tenor media.
7. Cookies & browser storage
kh_session - set when you sign in via Discord. HttpOnly, Secure, SameSite=Lax. Holds an opaque session token only; cleared on logout or when it expires.kh_admin - set when an operator signs into the admin dashboard. HttpOnly, Secure, SameSite=Strict. Holds an opaque random token only (the server stores a hash of it); cleared on logout or after 8 hours.kh_oauth_init - short-lived anti-CSRF cookie set only during the Discord OAuth redirect flow. Deleted immediately after login completes.
No tracking or analytics cookies are set.
7.5. Global, direct & group chat
Chat identity: chat uses a chosen 8-character UID and nickname. Registration sends the signing secret to KrulHub, which stores it with the UID to verify later requests. A UID is a pseudonym; optional message details can connect it to a Roblox account.
What we record: global, direct, and group messages are stored in a Cloudflare Durable Object. Records include a UID, nickname, content, and time. When supplied by the client, they can also include a Roblox UserId, image or profile URL, and place/server join details. Participants can see details shared in rooms and conversations they can access.
Message deletion: deleting your own global or direct message hides its text from other participants. The original text remains in server storage for moderation until the record rotates out or is cleared.
Moderation access: the admin tools let the operator and delegated moderators inspect global and direct-message histories and reports. Moderators can mute, ban, and clear global, direct, or group histories.
Anti-spam metadata: per-UID send timing and sustained-volume counters are tracked in memory only; they are forgotten when the chat service restarts and are not written to persistent storage. The registration rate-limit counter is keyed by IP, scoped to one hour, and expires automatically.
Typing pings: a "typing" indicator is broadcast while you compose a message. It contains your UID and chosen nickname only and expires within seconds after you stop typing.
Reports: reporting a global or direct message adds your UID, the reported content, and your reason to a moderator-only queue.
Request IP: chat registration uses request IPs for temporary rate limiting. The optional Roblox UserId in a message may link the chat UID to a Roblox account.
Retention: identity records have no automatic expiry. Messages remain in bounded histories until displaced, cleared by an administrator, or deleted with a group by its owner. Temporary mutes expire automatically; hard bans remain until lifted.
8. Your rights & data removal
To ask about access, correction, or removal of your KrulHub records, open a private ticket in the KrulHub Discord server. Share a Roblox UserId, Discord ID, chat UID, submission ID, or installation-ID prefix only inside that ticket.
Avatar Sync: disabling the toggle stops new publishes; the stored state expires 300 seconds after the last publish. Diagnostics: disabling its toggle stops future diagnostic uploads but leaves earlier batches until an administrator purges them. Chat: deleting your global or direct message in the UI hides it from participants while its moderation record remains as described above.
9. Security
Admin areas require authentication, and selected public endpoints use rate limits. KrulHub stores feature data in Cloudflare KV, R2, and Durable Objects. Use the HTTPS address for the website.