Privacy Policy

1. Who is responsible for your information

Wilt is operated as a Voltex project. For privacy questions or requests, email webingwme@gmail.com or contact the operator through the Wilt Discord.

2. Information we handle

• Account information: email address, password credentials managed by Supabase Auth, optional username, account identifier, and information returned by a sign-in provider when you choose Google, GitHub, or Discord sign-in.
• Profile information: optional Discord contact text you enter in your profile.
• Publisher content and settings: project names, script names and submitted build content, checkpoint provider links, and anti-bypass tokens. The build content is stored so Wilt can deliver it when authorized. Anti-bypass tokens are publisher secrets; do not reuse a password or disclose them.
• Key and checkpoint records: key hashes and short key prefixes (the plaintext key is not stored), script/project references, checkpoint session nonce, creation/expiry/completion timestamps, and the browser or execution-device identifiers associated with their respective session/key records.
• Usage data: per-account monthly obfuscation request counts and technical information needed to operate the service, investigate errors, and protect against abuse.
• Browser storage: Supabase's sign-in session is stored in browser storage; Wilt also stores your theme preference locally. The key page stores its mobile UUID, pending key session, and returned plaintext key in local storage so the flow survives a redirect or refresh. OAuth sign-in uses temporary session storage to complete the redirect.

3. Device identifiers

The browser key page creates the identifier used for its key sessions: a random value generated once and saved in your browser's local storage. It is sent to Wilt and stored with the related session and key records. It is a browser identifier, not a hardware serial number, and can be reset by clearing site data or using another browser. The key page does not fingerprint your browser and does not read an identifier from Roblox or Luau.

Separately, the existing Luau redemption client may use an executor-provided identifier or Roblox's client identifier to bind a key to the first execution device that redeems it. That execution identifier is stored separately from the key page's browser identifier.

4. Why we use information

• create and secure accounts, authenticate users, and prevent account abuse;
• store and manage publisher projects, scripts, provider settings, keys, and checkpoint sessions;
• obfuscate content when requested, report and enforce usage limits, and deliver authorized builds;
• verify signup email deliverability and respond to support requests;
• maintain, troubleshoot, secure, and improve Wilt; and
• meet legal obligations and enforce the Terms of Service.

Where privacy law requires a legal basis, processing is based on providing the service you request, operating and securing the service, your consent where requested, or compliance with legal obligations, as applicable to the purpose and your location.

5. Service providers and other recipients

• Supabase: account authentication, database, and Edge Functions.
• Cloudflare: website hosting, Worker requests, and security/operational logs.
• Kickbox: email deliverability checks during eligible email signups.
• Bias: script content submitted for obfuscation and related service requests.
• Google, GitHub, or Discord: if you choose their OAuth sign-in, they process that sign-in under their own terms and privacy policies.
• Page delivery providers: jsDelivr, Google Fonts, and Simple Icons may receive ordinary connection information when your browser requests their assets.
• Checkpoint providers: when you follow a publisher's link, that provider receives information under its own policy. To validate completions, Wilt's server sends Linkvertise the one-time completion hash and publisher authentication token, or asks Work.ink to validate the visitor token. Wilt does not send those publisher values to the browser. LootLabs is not used to issue keys because the supplied redirect documentation does not define a completion-verification endpoint.

We do not sell personal information. We may disclose information when necessary to operate the service through providers, comply with law, protect users or Wilt, or respond to a valid legal request.

6. Retention and deletion

Account and project data is kept while needed to provide the service. Account deletion is not currently self-service: the dashboard's delete-account control is not connected. Contact the operator in section 1 to request deletion and receive confirmation. When deletion is carried out, related records may be removed according to the database's deletion rules. Backups, security logs, and records that must be retained may persist for a limited period or as required by law. Session records have expiry timestamps; an expiry timestamp does not itself mean the row is immediately deleted.

Wilt does not currently publish a fixed retention schedule for operational logs or backups. Contact the operator to request deletion or ask about a particular record.

7. International processing and security

Our providers may process information in countries other than yours, subject to their terms and applicable safeguards. Wilt uses access controls and database policies, but no internet service can guarantee absolute security.

8. Your choices and privacy rights

You can update some profile information in the dashboard, change browser themes locally, and stop using third-party sign-in. To request account deletion or exercise privacy rights, contact the operator in section 1. Depending on where you live, you may also have rights to access, correct, delete, restrict, or object to certain processing, and to complain to a data-protection authority. We may need to verify your identity before responding.

9. Children

Wilt is not designed for children who are below the minimum age permitted to use the service under applicable law. We do not knowingly seek to collect personal information from children who are not permitted to use Wilt. If you believe such information was provided, contact the operator so it can be reviewed and deleted where appropriate.

10. Changes and contact

We may update this policy as the service or its providers change. The date above identifies the latest version. For questions or requests, email webingwme@gmail.com or contact the operator through the Wilt Discord.