Event data emitted by Roblox experiences that integrate this platform. The exact fields are defined per experience by its developer in a schema, so there is no single fixed list. Typical content includes gameplay events, quantised player positions, session start and end, and in-experience purchases.
Every field carries a declared sensitivity class: none,
pseudonymous, personal, or sensitive.
Roblox user IDs are treated as pseudonymous.
Three identity regimes are supported per tenant, and may be set per player region:
The regime in force is recorded on every stored record.
Retention follows a declared class per event type. ephemeral
and operational data is deleted on a schedule.
archival data is retained indefinitely and is not
deleted.
Archived data is not destroyed. A deletion request is honoured by suppression: the records are marked so they are excluded from all queries, dashboards, exports and any onward disclosure, and the underlying bytes remain in storage. Suppression is reversible and both directions are recorded in an append-only log.
The platform operator retains ownership of collected data by default, and the platform is built to permit its disclosure or sale to third parties, in raw or aggregated form, subject to per-record rights flags. Developers receive analytics without charge; retained data ownership is the consideration for that.
This is the clause most in need of review. It is the mechanism by which the service is funded, it concerns a platform whose users are substantially minors, and it is disclosed here because the architecture makes it true.
Some data is emitted by a player's own device and is marked as client-attested. It is treated as unverified and is excluded from any decision where correctness matters.
Processing and storage occur on Amazon Web Services in the United States (us-east-1).