Privacy policy

1. Who we are

SONGBIRD//LABS runs SONGBIRD and decides how the data described here is used. We collect as little as we can: enough to verify purchases, deliver items, run shops and protect creators from leaks.

2. What we collect

• Discord: your user ID and display name, when you use the bot or sign in to the dashboard. Sign-in only asks Discord for your basic identity.
• Roblox: your user ID and username, when you link your account. We never receive your Roblox password, and we don't keep Roblox sign-in tokens.
• Purchases: which item you bought, from which shop, when, the price, how it was paid (gamepass, developer product or manual grant) and the Roblox purchase reference.
• Inventory checks: whether your Roblox inventory was public when you claimed, and when. We ask Roblox only whether it can be viewed; we do not copy your inventory.
• Deliveries: when and where an item was sent to you (DM, private reply or dashboard), the Discord message ID, and a fingerprint of what you received.
• Shops and artists: shop details, team roles, listings and the files you upload. Open Cloud keys are stored encrypted, and purchase-place keys only as a hash.
• Technical data: sign-in cookies and the server logs any website keeps (such as IP address and browser), used for security and fixing problems.

3. Why we use it

• To verify that you paid on Roblox and deliver what you bought, and to let you get it again with /purchases.
• To let shops see their own sales and run their team, and to let artists see sales of their own items.
• To trace leaks: if a bought item is shared, its fingerprint lets the shop find which purchase it came from. This protects creators' work and is a condition of buying.
• To keep SONGBIRD safe: preventing abuse, handling reports and takedowns, and enforcing the Terms of use.

We use your data to provide the service you asked for and in our legitimate interest in protecting creators and keeping the platform secure. We do not sell your data, show ads, or use it to build advertising profiles.

4. Who can see it

• The shop you buy from (owner, staff, and the artists who made the item) sees your Discord ID, Roblox account and purchase details for that shop's sales. Shops never see your purchases from other shops.
• Delivery-log channels in a shop's Discord server show who bought what, never the item itself.
• Service providers we rely on to run SONGBIRD: Supabase (database, sign-in and file storage) and our hosting provider. They process data only on our behalf.
• Discord and Roblox, as part of using their platforms (for example, Roblox when we check purchase ownership or upload a decal for a shop).
• Authorities, when the law requires it.

5. Cookies and local storage

The dashboard uses cookies to keep you signed in and a short-lived cookie while you link Roblox. It remembers your light or dark theme in your browser. There are no advertising or tracking cookies.

6. How long we keep it

Account and link details are kept until you ask us to delete them. Purchase and delivery records are kept while the shop exists, because they are proof of what you bought and are needed to resolve disputes and trace leaks; when we delete your account we remove or anonymise what we are not required to keep. Shop files are deleted when the shop deletes them or closes.

7. Your choices and rights

You can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. You can unlink your Roblox account by contacting us, and make your Roblox inventory private again at any time after a purchase. Depending on where you live, you may also be able to complain to your local data protection authority.

8. Young people

Many people in Roblox communities are young. SONGBIRD is only for people aged 13 or over who are old enough to use Discord and Roblox where they live, and under-18s need a parent or guardian's agreement (see the Terms). We don't knowingly collect data from children under 13; if you are a parent or guardian and think we have, contact us and we will delete it.

9. Security

Data is protected by access controls that keep every shop separate, by encryption for secret keys, and by keeping delivered files private. No system is perfect; if something goes wrong that affects you, we will tell you.

10. Changes

If we change this policy, we update the date at the top of this page. Significant changes will also be announced where SONGBIRD shops can see them.