Privacy Policy
Last updated: July 15, 2026
UGC Plus (“we”, “us”, or “the Service”) helps Roblox creators find copies of their user-generated content. This policy explains what we collect, why, and the choices you have. The Service is operated by VX Designs LLC.
Information we collect
When you sign in with Google, we receive and store your email address (and whether it is verified), your name, profile picture, and your Google account identifier. We use Google Sign-In only — we never see or store your Google password.
To run and protect the Service, we also store:
- Scan activity — the Roblox asset IDs you scan, timestamps, the number of matches found, and whether a scan was a re-scan.
- Anti-abuse signals — your IP address, approximate country, and a browser fingerprint (a hash of non-identifying browser/device characteristics), recorded at sign-up and on scans to prevent automated abuse and enforce fair-use limits. We also use Cloudflare Turnstile to distinguish humans from bots.
- Billing — if you subscribe to Pro, a Stripe customer identifier. Payments are processed by Stripe; we never receive or store your full card number.
Your Roblox session
To read an item's real mesh, texture, and UV data, the Service uses your own logged-in Roblox session, which you supply in your browser. For ordinary interactive scans this session token is sent with each request only to serve that request, is attached only to roblox.com, and is never stored or logged on our servers — it stays in your browser and is used solely to act on your behalf. The one exception is the optional Watchlist / auto-monitor feature described below, which you must explicitly turn on.
Auto-monitor (Watchlist) & stored session
The Watchlist is an opt-in Pro feature that re-scans items you choose on a schedule (daily or weekly) even while you are offline. Because those scheduled scans run without your browser present, enabling it requires us to store your Roblox session so the Service can act on your behalf at scan time. Specifically:
- What we store — your Roblox session token (
.ROBLOSECURITY), encrypted at rest with AES-256-GCM. The plaintext token is never written to our database or logs; the decryption key is held separately as a server secret.
- What we do with it — it is decrypted only in memory, only during a scheduled scan of your own watched items, and attached only to roblox.com. It is never shared, sold, or used for any other purpose.
- How long we keep it — until you disconnect auto-monitor, remove your watchlist, or the token expires. When you disconnect, your stored session is deleted immediately. If the token expires we mark it stale and email you to reconnect.
- Your control — you can disconnect at any time from the Watchlist page, which deletes the stored session and stops scheduled scans. Logging out of Roblox (which invalidates the token) also disables it. Auto-monitor is off unless you turn it on; interactive scans never store your session.
You are responsible for your own Roblox account and for complying with Roblox's Terms of Use when you enable this feature. Keeping your session token stored carries the normal risks of any stored credential; we protect it with encryption, but you should only enable auto-monitor on an account you control.
How we use your information
- To provide the Service — run scans, show results and history, and generate DMCA drafts.
- To operate your account and process Pro and Creator subscriptions (via Stripe).
- To prevent abuse, spam, and fraud, and to enforce usage limits.
- To respond to your support requests and account inquiries.
We do not sell your personal information, and we do not use it for advertising.
Third-party services
The Service relies on:
- Google — sign-in (privacy policy).
- Stripe — payment processing (privacy policy).
- Cloudflare — hosting, the accounts database, and Turnstile bot protection (privacy policy).
- Roblox — the Service queries Roblox's public APIs and, at your direction, acts through your Roblox session. We are not affiliated with or endorsed by Roblox.
Cookies
We use only strictly necessary cookies: a secure, HTTP-only session cookie to keep you signed in, and short-lived cookies during sign-in and bot checks. We do not use third-party advertising or tracking cookies. Cloudflare Turnstile may set its own functional cookie to perform its check.
Data retention & deletion
We keep your account data while your account is active. You can request deletion at any time by contacting us; on deletion we remove your account and scan history after a short grace period. Some records may be retained where required for legal, tax, or fraud-prevention purposes (for example, payment records held by Stripe).
Your rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. To exercise these, contact us at secretugcofficial@gmail.com. We will respond within a reasonable time.
Children
The Service is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.
Changes to this policy
We may update this policy; we will post the new version here and update the “Last updated” date. Material changes will be highlighted.
Contact
Questions about this policy or your data: secretugcofficial@gmail.com.