Privacy policy

This list comes first because it is the part that matters most on a platform built around Roblox accounts.

• Your Roblox password, .ROBLOSECURITY cookie, session token, API key or two-factor code. There is no field for any of them anywhere in our database, and there never will be. Anybody asking you for one — including anybody claiming to be us — is trying to take your account.
• Your bank details or card number. Our payment provider collects those directly and we never see them.
• Identity documents. Not a scan, not a number, not a file — including for seller verification.
• Your precise location. Country only, and only if you type it.
• Behavioural profiling or engagement tracking on accounts belonging to under-18s.

To give you an account: your email address, a password (stored hashed, never readable), your chosen username and display name, and your date of birth.

Your date of birth is collected because the platform is open from 16 but paid work is 18+, and we cannot apply that rule without knowing. It is never shown publicly — only the permission it decides is.

Because you put it there: your profile, portfolio, skills, links, listings, job posts, applications, projects and messages.

Because a transaction happened: contracts, deliveries, reviews, purchases and ledger entries. These are financial records with a retention obligation — see “Leaving”.

To keep people safe: reports, moderation decisions and risk signals. Messages are scanned automatically for credential solicitation and off-platform payment pressure. A message that asks for account credentials is refused and never stored; what is recorded is that it happened, not what it said.

Our payment provider, when you are paid or you pay somebody. They receive the amount and the parties, and they hold the payment details we never see.

Our email provider, when we send you a notification. Those emails deliberately contain no content — they say something happened and link back, so your conversations do not end up in a third party’s logs.

Our database and hosting providers, who store the data on our behalf and do not use it.

Nobody else. We do not sell data, we do not run advertising, and we do not share anything with Roblox Corporation — we have no relationship with them.

You can download everything we hold about you as a JSON file, at any time, from privacy settings. No request, no waiting period.

You can correct anything from your profile settings, and you can delete your account from the same page.

If you are in the EU or UK you also have the right to object, to restrict processing, and to complain to your data protection authority. Write to support@rowork.dev and a person will answer.

Deleting your account removes your profile, portfolio, skills, links and notifications outright. Your messages are blanked rather than removed, so the conversations other people were part of still make sense.

Some records are kept, attached to an anonymised account: completed contracts, ledger entries, reviews you received, and any moderation decision about you.

That is not us hedging. A completed contract is a financial record the other party and a tax authority may need, and a moderation record is the evidence behind a decision. Letting one side delete them would let one person destroy the other person’s proof of a transaction they were both in. They are retained for seven years.

You cannot delete while a contract is running, a dispute is open, or money is owed to you — we cannot pay an account that does not exist.

The platform is open from 16. Accounts under 18 get high-privacy defaults: no behavioural profiling, no engagement nudges, no “last seen”, and restrictions on who can message them first.

Nobody under 16 may use RoWork. If you believe a child under 16 has an account, write to support@rowork.dev and we will remove it.

support@rowork.dev. We answer privacy questions in writing, from a person.