Privacy

Last updated: 18 October 2026

Roblox Editors List (REL) is a UK-operated community website. The REL owner is responsible for how the project uses personal information. This notice explains what happens when you browse, create an account, submit an application or connect a YouTube channel through Google.

What REL collects and why

• Accounts: your email address, username, authentication records and account permissions let us sign you in, protect your account and provide account features. Passwords are handled by Supabase Auth; REL staff cannot view your password.
• Applications: your display name, profile link, editing software, styles, examples and optional notes let the team review your work. Please leave out home addresses, identity documents and other information the review does not need.
• Public profiles and rankings: editor names, pictures, social links, showcase links, software, descriptions, placements and contributor credits let visitors discover editors and their work.
• Moderation and security: profile-link requests, review decisions, staff actions and ranking history help resolve disputes and protect the list. Request limits use a hashed network address, action, count and expiry to reduce automated abuse. A hash is still treated as personal information.
• Website delivery: hosting and other service providers receive technical information such as your IP address and browser details when your browser connects to them. Cloudflare Web Analytics provides traffic and performance measurements.

What becomes public

Your confirmed, active account can have a public page showing your username, contributor credits and linked editor profile. Account email addresses and permission roles are not included in that public page.

Applications are available to authorised REL staff. When a Contributor converts an approved application into an editor profile, its public profile details become visible. Submission notes, verification messages and review reasons remain private to authorised staff.

Google authorisation and YouTube information

Connecting YouTube is optional. After signing into REL, you can authorise read-only YouTube access through Google and confirm the channel you want to connect. REL uses YouTube API Services to read your channel ID, channel title and public subscriber count, and to check that you continue to control the connected channel. REL does not request permission to upload, post or edit videos, and does not receive your Google password.

Your confirmed channel ID, title and verification date can appear on your public REL account profile. If your REL account is linked to an editor in the overall rankings, your public subscriber count and its update date can appear in Popularity. YouTube rounds subscriber counts; hidden or unavailable counts are excluded. Popularity is separate from the editing rankings.

Cloudflare processes the connection requests and Supabase stores the connection records. A Google refresh credential is encrypted in private server-side storage so REL can recheck channel access. Access tokens are used temporarily on the server and are not sent to your browser or shown publicly. Temporary cookies protect the authorisation flow and last up to ten minutes.

REL uses Google user data only to provide and secure these channel-connection and Popularity features. REL does not sell it, use it for advertising or use it to train artificial intelligence models. REL's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google processes authorisation and API requests under the Google Privacy Policy.

Subscriber counts are read when you connect or reconnect. They stop appearing after 29 days, and the maintenance job deletes expired snapshots. REL schedules channel-access checks approximately daily. A connection stops appearing publicly after two days without a successful check; the maintenance job removes stored connections after 29 days without a successful check. Revoked or inaccessible connections are removed when detected.

To revoke access and remove the stored YouTube connection, credential and subscriber count, choose Disconnect YouTube in My account. If revocation fails, REL asks you to retry. You can also remove REL's permission in your Google account connections; REL detects external revocations during scheduled checks. For a deletion request or help accessing your account, email [email protected]. Read the YouTube connection privacy notice for the full connection and retention details.

Our reasons for using information

We use information needed to provide the account and application services you request. We also rely on legitimate interests in running a community directory, crediting contributors, keeping accurate rankings and preventing abuse, while considering the interests and rights of the people involved. Where processing requires consent, we ask before it happens. You choose whether to load a YouTube video.

Service providers and other websites

Cloudflare hosts REL and provides Web Analytics. Supabase provides authentication, database and image storage services. Account confirmation and recovery messages are sent through the configured authentication email service.

Google Fonts supplies the site's fonts. Public profile pictures can be hosted by other providers. Those providers receive a request when the relevant resource loads. YouTube is contacted for a showcase only after you select “Load YouTube video”. Following a social or example link takes you to a separate service with its own privacy practices.

These providers may process information outside the UK. Their services and transfer terms determine where processing takes place and which safeguards apply. See the Cloudflare privacy policy, Supabase privacy policy and Google privacy policy.

How long information stays

Account and public profile information remains while it is needed to operate the account or listing. Application decisions and staff records may remain after a review so the team can explain decisions, resolve disputes and investigate misuse. These records do not currently have an automatic deletion schedule; you can ask us to review whether they still need to be kept.

Request-limit windows last up to ten minutes. Expired entries are removed in batches during later requests, so expiry does not mean immediate deletion. Hosting, authentication and backup copies can have separate retention periods.

Your choices and rights

You can edit a linked editor profile through My account. You can also ask for access to your personal information, correction, deletion, restriction or portability where applicable, and object to processing based on legitimate interests. Where consent is the basis, you can withdraw it. Some records may need to be kept for security or other lawful reasons; we will explain this when handling a request.

We may ask for enough information to verify that a request concerns you. You can raise a concern with the UK's Information Commissioner's Office.

Contact REL

Email [email protected] for privacy questions, account information requests or content removal. Include the relevant REL profile or page link and explain your request. Do not send your password or sign-in codes.