Privacy Policy

Version 1.0 · Effective [EFFECTIVE DATE] · Last updated [EFFECTIVE DATE]

The plain-English version

1. Who we are

Forge is operated by [COMPANY LEGAL NAME], a [STATE] [ENTITY TYPE] doing business as Maddock Studios. Our address is [BUSINESS ADDRESS]. We are the controller of the personal information described here.

This policy covers the Forge website, the Forge web panel, and the Forge Bridge desktop application. It does not cover Roblox, Roblox Studio, or anything you publish to Roblox — those are governed by Roblox's own privacy policy.

Forge is not affiliated with Roblox Corporation or Anthropic PBC.

2. What we collect

2.1 From Roblox, when you sign in

We use Roblox's official OAuth sign-in. Roblox gives us, and we store:

• your Roblox user ID (a number);
• your Roblox username;
• your display name;
• the URL of your avatar image (we link to it; we do not copy the image); and
• the date your Roblox account was created (we use it to decide free-trial eligibility).

We do not receive or store your Roblox password, your Roblox session cookie, two-factor codes, your email address at Roblox, your friends, your games, or any Roblox API key.

2.2 From you

• Email address — so we can send receipts, security notices, and important account messages. Required before you can purchase.
• Age band — we ask your year of birth once, at sign-up, to confirm you are 13 or older and to know whether you are under 18. We store the resulting age band and the year, not a full date of birth.
• Chat messages — everything you type to the agent.
• Project names that you create.
• Your own Anthropic API key, if you choose the Bring-Your-Own-Key option. It is encrypted (AES-256-GCM) before storage, shown only masked, never written to logs, and decrypted in memory only while running your own messages.
• Support messages you send us.

2.3 From your Roblox Studio, through the Bridge

See section 3 — this is the part that deserves its own section.

2.4 Generated by using the Service

• Chat history: your messages, the agent's replies, and tool-call metadata — which tools the agent used, with which arguments, and whether they succeeded. Tool results are truncated, and screenshots are replaced with a placeholder note before anything is stored.
• Token usage and cost per message.
• Credit ledger: purchases, trial grants, reservations, settlements, refunds and clawbacks.
• Bridge tokens: stored only as a SHA-256 hash, never in plain text, with the device label you give it and the connection time.
• Security and operational logs: IP address, timestamp, user agent, request path, and error information. Logs are automatically scrubbed of API keys and tokens.

2.5 Payments

Payments run through Stripe Checkout, hosted by Stripe. Your card number, CVC and expiry never touch our servers. We store only Stripe's identifiers — the checkout session ID and payment intent ID — plus the amount, currency, purchase time, and the country/state Stripe reports for tax purposes.

3. What leaves your computer, exactly

This is the question serious creators ask, so here is the honest answer.

Depending on what you ask for, that can include:

• the text of scripts the agent reads or edits;
• names, hierarchy and properties of instances in your place;
• Studio console output, including error messages;
• screenshots of the Roblox Studio viewport during playtests; and
• the Luau code the agent runs and its results.

What the Bridge does not do:

• capture your desktop, other windows, your webcam or your microphone;
• read files outside Roblox Studio;
• run when it is closed, or for any account other than the one whose token it holds;
• publish your game or change your Roblox account.

Screenshots

You control all of this by controlling the Bridge: it only works while it is running, only against the Studio place you have open, and you can disconnect or revoke its token at any time from the panel.

4. Why we use it

5. Who we share it with

We share personal information only with the service providers below, only for the purposes shown, and only under contracts that require them to protect it. These are all of them.

We may also disclose information: to comply with a valid legal request; to enforce our Terms; to protect the rights, safety or property of our users, the public, or us; or in connection with a merger, acquisition or sale of assets — in which case we will notify you before your information becomes subject to a different privacy policy.

6. What we do not do

7. Cookies and tracking

Forge uses one cookie.

That is the complete list. There are no analytics cookies, no advertising cookies, and no third-party trackers, which is why you do not see a cookie banner. Signing out clears the cookie.

If we ever add analytics, we will update this policy, ask for consent where required, and give you a way to say no.

8. How long we keep it

9. How to see, export or delete your data

Everyone gets these rights, wherever you live. We do not make you prove you are Californian or European first.

• See it. Your projects, chat history, credit ledger and account details are visible in the panel at any time.
• Export it. Panel → Settings → Export my data. You get a JSON file with your account record, projects, chat history, and full ledger.
• Correct it. Update your email in Settings. Your Roblox username and display name come from Roblox — change them there and sign in again.
• Delete it. Panel → Settings → Delete my account. This permanently removes your account, projects, chat history, bridge tokens, BYOK key and credit balance. It cannot be undone, and unused credits are forfeited — if you want a refund, ask before deleting. We keep only the payment records described in section 8.
• Withdraw consent for anything you consented to (such as marketing email) at any time, without affecting what happened before.
• Complain. Write to us first at [PRIVACY EMAIL]. You may also complain to your local data protection authority or state attorney general.

If you cannot use the panel, email [PRIVACY EMAIL] from the address on your account, or tell us your Roblox username, and we will handle it manually. We respond within 30 days (45 for US state requests where the law allows an extension, and we will tell you if we need it). We may ask you to verify your identity by signing in, which is the only way we can be sure it is really you.

We will never charge you, degrade your service, or treat you differently for exercising these rights.

You may use an authorized agent to make a request where the law allows; we will ask for proof of their authority and may still ask you to verify directly.

10. Children's privacy

• We ask your year of birth at sign-up. If it indicates you are under 13, we block the account and delete the data, keeping only a one-way hash of the Roblox ID so the block can be enforced.
• If we learn at any time that a user is under 13, we close the account, delete the data, and refund any unused credits.
• Users aged 13–17 cannot purchase credits. Purchases must be made by someone 18 or older who is the cardholder or has the cardholder's permission.
• For accounts we know belong to a minor, we apply the shortest retention, the most protective defaults, and no profiling of any kind.
• There is no advertising and no ad tracking anywhere in Forge, for any user.

Parents and guardians: if you believe a child under 13 has provided us with personal information, email [PRIVACY EMAIL] with the Roblox username. We will delete the account and its data and confirm to you when it is done, at no cost and without requiring any legal process. You may also ask us to review, or to stop any further collection of, your child's information.

11. Security

We take security seriously and we publish what we do rather than asking you to trust us. The engineering detail is in our repository's SECURITY.md. In summary:

• Encryption in transit everywhere (TLS), with HSTS.
• BYOK API keys encrypted at rest with AES-256-GCM under a key held in the hosting platform's secret store, never logged, never displayed in full.
• Bridge tokens are 32 random bytes; only a SHA-256 hash is stored; they are revocable per device.
• Session cookies are signed, HttpOnly, Secure, and short-lived.
• Strict browser hardening: Content Security Policy, origin checks on every state-changing request, frame-ancestors denied, and output escaping.
• No card data on our systems. Payments are hosted by Stripe.
• Screenshots are never persisted. Tool results are size-limited before storage.
• Logs are scrubbed of API keys and tokens automatically.
• Access to production data is limited to what is necessary to operate the Service.

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and any required authority as the law requires, without undue delay. Keep your email address current so we can reach you.

If you find a vulnerability, please report it to [SECURITY EMAIL]. We will not pursue legal action against good-faith security research that does not access other users' data or disrupt the Service.

12. US state privacy rights (California and others)

Depending on where you live — including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws — you may have specific rights. We extend the following to all users regardless of state: the right to know, access, correct, delete, obtain a portable copy, and opt out of sale, sharing, targeted advertising and profiling.

12.1 Notice at collection (CCPA/CPRA categories)

We collect each category for the business purposes listed in section 4, and we keep it for the periods in section 8.

12.2 Sale, sharing and targeted advertising

12.3 Minors

We do not sell or share the personal information of consumers under 16, because we do not sell or share anyone's.

12.4 How to exercise your rights

Use the panel (section 9), or email [PRIVACY EMAIL]. We verify requests by asking you to sign in to the account. You may appeal a refused request by replying to our decision with the word "Appeal"; we will respond within [45] days with our reasoning, and if we still refuse we will tell you how to complain to your state attorney general.

12.5 Shine the Light

California Civil Code §1798.83 lets California residents ask about disclosures of personal information to third parties for their own direct marketing. We make no such disclosures.

13. GDPR / UK GDPR

Drafting note (remove before publication): fill in or delete this section based on the launch decision. If the EEA and UK are geo-blocked, replace this section with a short statement to that effect and delete the representative placeholders. If they are not blocked, an EU Article 27 representative and a UK representative must be appointed and named before launch, and Data Processing Agreements must be in place with every provider in section 5. See docs/LEGAL_EXPOSURE_2026-09-05.md §3.

If you are in the European Economic Area, the United Kingdom, or Switzerland, the following applies.

13.1 Controller and representative

[COMPANY LEGAL NAME] is the controller. Our EU representative under Article 27 is [EU REPRESENTATIVE NAME AND ADDRESS]. Our UK representative is [UK REPRESENTATIVE NAME AND ADDRESS].

13.2 Legal bases

We do not process special-category data under Article 9, and we do not carry out automated decision-making producing legal or similarly significant effects under Article 22.

13.3 Your rights

You have the right to access, rectify, erase, restrict processing, object to processing based on legitimate interests, and receive your data in a portable format. Use the panel or email [PRIVACY EMAIL]; we respond within one month. You may complain to your supervisory authority — in the UK, the Information Commissioner's Office.

13.4 International transfers

Your data is processed in the United States. Where we transfer personal data out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with technical measures including encryption in transit and at rest. Copies of the relevant safeguards are available on request from [PRIVACY EMAIL].

13.5 Children

Where you are under the age at which you can consent for yourself under your national law, a parent or guardian must agree to our Terms on your behalf. See section 10.

14. Where your data is processed

Forge is operated from the United States and your data is stored and processed there, on infrastructure provided by Fly.io and Supabase in [REGION]. AI processing is performed by Anthropic in the United States. Payment processing is performed by Stripe. If you use Forge from outside the United States, you are sending your data to the United States, where privacy laws may differ from those in your country.

15. Changes to this policy

We will update this policy as the Service changes. The version number and the "Last updated" date at the top always reflect the current version.

If we make a material change — for example, collecting a new category of data, adding a new processor, or using data for a new purpose — we will give at least 30 days' notice by email and in the panel before it takes effect, and we will obtain your consent where the law requires it. We will never apply a materially different use to data we already hold without telling you first.

16. Contact

Version 1.0 · Effective [EFFECTIVE DATE]. Draft prepared 2026-09-05. Not reviewed by a licensed attorney, and not yet verified line-by-line against the shipped product. Do not publish until both are done — a privacy policy that overstates what the product does is worse than none.