Privacy is the product

The Roblox Safety Scan is a free tool operated by Keep AI Safe, a 501(c)(3) nonprofit dedicated to protecting children and adolescents from AI-related and online harm. We are not affiliated with, endorsed by, or sponsored by Roblox Corporation. Questions about this policy: support@keepaisafe.org.

You type a Roblox username and an age range. Our server uses that username to look up information Roblox already shows the public: the basic profile, the visible friends list, visible group memberships, visible favorites and creations, and publicly visible badges. We turn that into the report you see on your screen.

The username is processed in memory for the duration of the scan and then discarded. We do not store it, log it, or associate it with you. The report is sent back to your browser and exists only there. If you close the tab, it is gone. If you print or save it, that copy is yours and only yours.

Two outside services are involved in producing a scan, and each receives the minimum possible:

Roblox public APIs. We request the public data described above. Requests identify our tool by name in the User-Agent header. We never send Roblox anything about you.

Rotector threat-intelligence database. We send only numeric Roblox account ids and group ids from the visible friends and groups lists, to check whether they appear in that independent child-safety database. We never send names you have typed, report contents, your identity, or anything else.

Nothing is ever sent to advertising networks, data brokers, or analytics providers, because we use none.

Several features work entirely inside your browser, by design, because the information involved is too sensitive for anyone else to hold:

The Friend Map.The real names and statuses you assign to your child's friends are saved in your browser's local storage on your device. They are never transmitted to us or anyone else. The "Erase all names" button deletes them completely and immediately.

Re-contact detection. To spot a removed account that returns, your browser keeps a snapshot of the friend list from your last scan, on your device only.

The Playtime check. Every number you enter is compared in your browser. Nothing you type there is sent anywhere.

Connected Guardian dashboard entries.What you read from your own Roblox parental-controls dashboard and type into the guided report is analyzed in your browser and never transmitted. Only the child's username travels, to run the same public scan available on the home page.

Clearing your browser's site data for this site removes all of the above at any time.

Connected Guardian offers an optional "Verify with Roblox" sign-in using Roblox's official OAuth system. If you use it, Roblox tells us your Roblox username and an age bracket. We keep your username and a single yes/no adult flag in a signed, httpOnly cookie for up to two hours, then it expires. The age bracket label itself is discarded immediately and never stored. The sign-in token is revoked the moment we have read that one piece of information. Signing out deletes the cookie, which is the only record that the verification happened.

To keep the service available and to be a good citizen of Roblox's APIs, we rate-limit scans. The limiter holds a one-way cryptographic hash of your network address in server memory for a few minutes. Raw addresses are not kept, nothing is written to disk, and nothing is logged. Our hosting provider (Railway) may generate standard infrastructure logs to run the platform; we do not add usernames or report contents to any log.

This tool is for parents, guardians, and caregivers aged 18 or older. We do not knowingly collect personal information from children. The scanned username refers to a public Roblox profile and is processed transiently as described above; we have no way to know, and do not attempt to learn, who is behind any account.

Because we keep nothing about you, there is usually nothing for us to access, correct, or delete: the report vanished when you closed it, and everything else lives on your own device under your control. If you believe we hold anything about you, or you have any privacy question or concern, email support@keepaisafe.org and we will respond promptly.

If we ever add a feature that changes what data is handled, we will update this page before the feature ships and change the effective date at the top. We will never quietly weaken the promises above; the no-storage, no-analytics, no-selling core of this policy is the point of the tool.