Dieses Dokument ist auf Englisch und Türkisch verfügbar. Unten steht die englische Fassung.
Privacy Policy
We designed rblxstat to work with as little personal data as possible. This page explains what data we process and why, how we protect it, and your rights.
Zuletzt aktualisiert: 29. September 2026
In short
- You don't need an account to use the site. Game statistics are public and collected from Roblox's public pages.
- We don't use advertising, analytics or tracking tools, and we don't sell your data to anyone.
- If you create an account, your email address, 2FA key, session IP address and device information are stored encrypted with AES-256-GCM; your password is stored in a form that can't be reversed (PBKDF2, 600,000 iterations plus a server-side secret key).
- You can delete your account at any time in Settings; all your account data is deleted permanently.
Data we collect
Visitors (without an account)
- Technical logs: IP address, browser information, the requested page and time. Kept briefly in server logs for security (detecting abuse and attacks) and rate limiting.
- Essential cookies: a security token, your language and your cookie choice. Details in the Cookie Policy.
- Search text: what you type into the search box and the AI game finder is processed to return results.
Members
- Account: username, display name, email address, a hash of your password, and an optional bio and social links.
- Preferences: theme, accent colour, notification and privacy settings.
- Activity: your favorites, the games you follow and the games you viewed recently.
- Security: your open sessions (creation and last use time, IP address, device/browser information) and, if two-step verification is on, your encrypted 2FA key.
- Roblox link (optional): your Roblox username and ID; your profile picture is shown from Roblox.
Why we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Creating an account, signing in and account security | Account and security data | Entering into and performing a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)) |
| Favorites, following and notifications | Activity and preference data | Performing a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)) |
| Preventing attacks, spam and abuse | Technical logs, session information | Legitimate interest (KVKK art. 5/2-f; GDPR art. 6(1)(f)) |
| Remembering theme and layout (without an account) | Preference cookies | Consent (cookie banner) |
| Legal obligations | The minimum data required | Legal obligation (KVKK art. 5/2-ç; GDPR art. 6(1)(c)) |
How we protect data
- Encryption in transit: every connection is forced over HTTPS (TLS 1.2/1.3) with HSTS.
- Encryption at rest: email, 2FA key, session IP address and device information are encrypted with AES-256-GCM at the application layer. The key is kept separately, not in the database, so a database backup alone doesn't reveal this data. Sign-in by email looks up a keyed hash (HMAC-SHA256) instead of plain text.
- Passwords: stored with PBKDF2-HMAC-SHA256 (600,000 iterations, random salt) and a server key that isn't in the database. We can't see your password either.
- Sessions: the session cookie is closed to JavaScript (HttpOnly, Secure). Only a SHA-256 hash of the token is kept on the server. Changing your password signs out every other session; you can see and close your open sessions in Settings.
- Private data service: our data isn't offered through a public API. Access to the data service from outside the site is blocked; the site's own requests are verified with signed, expiring tokens and rate limited.
- Two-step verification (TOTP), rate limits on sign-in attempts, CSRF and clickjacking protection and strict content security headers.
No system is 100% secure; if we notice a breach, we'll inform you and the relevant authorities as the law requires.
Sharing and transfers
- We don't sell your personal data or share it for advertising.
- Hosting: data is kept (encrypted) on the infrastructure of the server provider we run the service on.
- AI game finder: when you search with AI, only the text you typed may be sent to our AI service provider to be turned into game filters. This provider may be located abroad. Your account details, IP address and cookies are not sent. Please don't type personal information into the search box.
- Roblox: game images are served from our own domain, so your browser doesn't connect to Roblox's servers directly. When you click links like “Play on Roblox”, Roblox's own privacy policy applies.
- With competent public authorities when required by law.
Retention
- Account data: as long as your account is open; deleted immediately and permanently when you delete your account.
- Sessions: 30 days from last use; deleted immediately when you sign out.
- AI search results: cached for at most 1 hour so repeated questions are answered quickly (not linked to your identity).
- Server logs: for the short time needed for security, then deleted.
- Game statistics are not personal data and are kept indefinitely.
Your rights
Under Article 11 of the Turkish KVKK (and the GDPR where it applies) you have the right to learn whether your data is processed, request information, ask for it to be corrected or deleted, object to processing and claim compensation if you suffered damage. You can do much of this yourself:
- Edit your profile, email and privacy settings in Settings.
- See and close your open sessions: Settings → Security.
- Delete your account and all your data permanently: Settings → Privacy.
For other requests, reach us through the contact channel given on the site; we reply within 30 days at the latest.
For more detail, see the KVKK Notice.
Children
Many Roblox players are young. You don't need an account to browse the site, and we don't collect personal data from visitors without an account. If you're under 13, please ask a parent before creating an account. Parents can ask for an account belonging to their child to be deleted.
Changes
When we update this policy we change the date at the top of the page. We announce important changes on the site.