Privacy Policy
This Privacy Policy explains how bWare Studios LLC ("bWare Studios", "we", "us") collects, uses, shares and protects personal data when you use the bWare Player Panel at panel.bware.studio (the "Player Panel"), the bWare Admin Panel at admin.bware.studio (the "Admin Panel"), and related services (together, the "Services"). The Services support our Roblox experiences and our Discord community.
The Services are not operated by, affiliated with, or endorsed by Roblox Corporation or Discord Inc.
1. Who we are and how to contact us
Data controller: bWare Studios LLC. Privacy contact: braden@bware.studio.
2. Who may use the Services
The Player Panel is intended for users aged 13 or older. We do not knowingly collect personal data from anyone below that age. If you believe a child has created an account, contact us and we will delete it. The Admin Panel is restricted to authorised staff of bWare Studios.
3. Personal data we collect
3.1 Data you provide by signing in
You sign in with Discord and/or Roblox. We receive only what those providers share for the requested scopes:
| Provider | Scope | Data received |
|---|---|---|
| Discord | identify (Player Panel); identify, guilds.members.read (Admin Panel) | Discord user ID, username, avatar hash; for staff, membership and roles in our Discord server |
| Roblox | openid profile | Roblox user ID, username, display name |
We never receive your Discord or Roblox password, email address, or payment details. Provider access tokens are used only during sign-in (Player Panel) or held server-side to re-check staff roles (Admin Panel) and are never exposed to your browser.
3.2 Data you submit
- Ban appeals: the text you write, the game or Discord server appealed, timestamps, the outcome, and any staff reply.
- Roleplay server listings: names, descriptions and settings you edit for servers you own in our Roblox experiences.
3.3 Data we generate
- Account records: an internal account ID and a history of which Discord/Roblox identities were connected to, disconnected from, or refused by an account, with timestamps.
- IP address hash: when you connect or disconnect an identity we store a one-way hash of your IP address (salted with a server secret). We do not store the IP address itself. This is used only to detect ban evasion through repeated re-linking.
- Moderation and audit logs: actions taken on your account or in our experiences (for example bans, unbans, appeal decisions, listing edits), who took them, and why.
- Technical data: request logs held by our hosting provider (see section 6), including IP address, user agent, timestamps and requested URLs, used for security and troubleshooting.
3.4 Data from our games and platforms
To show your ban status and server information we read data our Roblox experiences already hold about you through Roblox's developer APIs (game-join restrictions, roleplay server records and statistics), and we read your ban status in our Discord server through the Discord API.
4. Why we use your data and our legal bases
| Purpose | Legal basis (GDPR/UK GDPR, where applicable) |
|---|---|
| Creating and authenticating your account; keeping you signed in | Performance of a contract (our Terms of Service) |
| Showing your ban status and processing ban appeals | Performance of a contract; legitimate interests (fair, consistent moderation) |
| Letting server owners view and edit their roleplay servers | Performance of a contract |
| Preventing ban evasion, abuse, fraud and unauthorised access (including the hashed IP and link history) | Legitimate interests (protecting our community and services); legal obligations where applicable |
| Audit logging of staff and player actions | Legitimate interests (accountability, security, dispute resolution) |
| Complying with law and responding to lawful requests | Legal obligation |
We do not use your data for advertising, profiling for marketing, or automated decisions that produce legal or similarly significant effects. Appeal decisions are made by human staff.
5. How long we keep data
| Data | Retention |
|---|---|
| Player account (identities, usernames, avatar) | Until you delete your account or ask us to; usernames are refreshed at each sign-in |
| Admin Panel staff profile and display preferences | Until you delete your account or ask us to |
| Sign-in sessions | Player Panel: 30 days of inactivity; Admin Panel: 24 hours. Deleted immediately on sign-out |
| Sign-in state cookies | 10 minutes |
| Identity link/unlink history and hashed IP | Life of the account; deleted with the account |
| Ban appeals and staff replies | 2 years after the decision, or when you delete your account |
| Competition entries (text, images, video links, Discord post links, the facility you entered) | Until the competition is deleted by staff, or when you delete your account |
| Admin Panel audit log | 30 days, then automatically deleted |
| Cached ban status and server lists | Up to 5 minutes |
| Hosting provider request logs | Per our provider's retention, typically up to 30 days |
Ban records themselves are held by Roblox (game-join restrictions) and Discord (server bans) under their own policies.
6. Who we share data with
- Cloudflare, Inc. — hosts the Services. Data is processed under Cloudflare's data processing terms.
- Roblox Corporation — sign-in, and reading/updating ban and server data in our experiences.
- Discord Inc. — sign-in, reading and lifting Discord server bans, and staff notifications posted to private staff channels via webhooks (these may include your username, ID and appeal text).
- bWare Studios staff — authorised moderators see appeals, account link history and moderation logs to do their job. Staff access is role-restricted and logged.
- Legal — where required by law, to enforce our Terms, or to protect the rights, safety and property of users, staff or the public.
We do not sell personal data and do not share it with advertisers or data brokers.
7. International transfers
Our providers operate globally, so your data may be processed outside your country, including in the United States. Where GDPR/UK GDPR applies, transfers rely on adequacy decisions or Standard Contractual Clauses offered by the providers listed above.
8. Cookies and similar technologies
We use only strictly necessary cookies: a session cookie (bWarePlayer on the Player Panel, bWareSession on the Admin Panel) and a short-lived sign-in state cookie. They are HttpOnly, Secure and SameSite. We use no analytics, advertising or third-party tracking cookies. Your browser's local storage may hold display preferences (such as theme); it never leaves your device. A short cookie notice is shown when you sign in. Because these cookies are strictly necessary, the Services cannot be used without them; you can clear them at any time by signing out or through your browser settings.
9. Your rights
Depending on where you live you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. In the Player Panel you can disconnect an identity yourself, and you can delete your account yourself (see 9.1). To exercise any other right, contact braden@bware.studio; we respond within one month (GDPR) or the period required by applicable law. We may keep minimal records needed to enforce bans and prevent evasion where we have a lawful basis to do so.
You may also lodge a complaint with your data protection authority.
9.1 Deleting your account
You can delete your account yourself from Settings (Admin Panel) or Account (Player Panel). After you confirm, the account is scheduled for deletion 7 days later. During those 7 days, signing in shows a notice with the options to sign out or to cancel the deletion; cancelling reinstates the account with nothing lost. Once the 7 days pass, an automated daily job permanently deletes the account.
What is deleted: your bWare account record and its internal ID, linked Discord and Roblox identities (ID, username, avatar), identity link/unlink history and hashed IPs, sign-in sessions, display preferences, your ban appeals and the staff replies to them, and your competition entries including uploaded images. This cannot be undone. Signing in again afterwards creates a new, empty account.
What is not deleted: data held by Roblox and Discord, and moderation records about you in our systems. Deleting your account does not lift or remove Roblox game bans, Discord server bans, Discord infractions (warnings, mutes, kicks, bans), or the moderation audit log. For staff, your actions in the Admin Panel (audit log entries, competition ratings and reviews you produced) remain attributed to your Discord ID as part of our administrative records. This data is retained under the periods in section 5 because we have a legitimate interest in enforcing our rules and preventing ban evasion. If you believe a moderation record is wrong, contact us.
California residents: we do not "sell" or "share" personal information as defined by the CCPA/CPRA, and we do not use sensitive personal information to infer characteristics. You have the rights to know, delete, correct and to non-discrimination described above.
10. Security
Data is encrypted in transit (TLS) and at rest by our hosting provider. Access to production systems and the Admin Panel is limited to authorised staff, requires Discord authentication with role checks, and is audited. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as required by law.
11. Third-party links and platforms
The Services link to Roblox and Discord. Their handling of your data is governed by their own privacy policies, which we encourage you to read.
12. Changes to this policy
We may update this policy from time to time. Material changes will be announced in our Discord server and reflected in the "Last updated" date above. Continued use after the effective date means you accept the updated policy.
13. Contact
bWare Studios LLC · braden@bware.studio