Privacy Policy

• Radar needs no account. You can read every chart and page without signing in.
• You decide about analytics cookies. Cloudflare Web Analytics counts visits without cookies. Google Analytics uses cookies. In the European Economic Area, the United Kingdom, Switzerland and Türkiye it runs only after you accept it; everywhere else it is on unless you switch it off with "Cookie settings" in the footer.
• We never sell or rent your data, and there are no advertising trackers on the site.
• When you sign in, we store the name, email address and avatar your login provider shares, plus what you create here: watchlists, alert rules, Asset Blox workspaces and assets.
• The Radar browser extension only asks us for the public stats of the Roblox pages you open (see The Radar browser extension).
• Our servers and databases are in the European Union (Finland), behind Cloudflare.
• You can delete your account yourself from your account page. Personal data goes immediately; backups expire within 30 days.

Rival Ducks ("we", "us") operates rivalducks.com and the products under it: Radar, a public analytics site about Roblox experiences, and Asset Blox, a game-art generation tool. One Rival Ducks account signs you into both.

Rival Ducks is a Roblox games company. We are not affiliated with Roblox Corporation, and nothing here is endorsed by Roblox.

For anything about your data, write to [email protected].

Reading Radar, subscribing to the RSS feed or viewing an embedded card collects:

• Request logs. Our servers and Cloudflare record the usual server-log fields — IP address, requested URL, timestamp, browser user-agent — to keep the service running and to investigate abuse. These logs are kept only briefly for operations and security.
• Rate-limit counters. To protect the site from scraping and overload we count requests per IP address in a short window. Each counter expires automatically within minutes.
• Aggregate analytics. We use Cloudflare Web Analytics, which is cookieless and does not fingerprint or track individuals. We see page views and countries in aggregate, not who you are.

Google Analytics. On the company pages and on Radar we also use Google Analytics to see how the site is used: which pages are read, where visitors come from, and what kind of device and browser they use. It works with cookies, so it does not run for everyone:

• In the European Economic Area, the United Kingdom, Switzerland and Türkiye, and whenever we cannot tell which country a visit comes from, it runs only after you choose "Accept" in the cookie bar. Until you accept, nothing is sent to Google: no script, no cookie, no request.
• Everywhere else it is on by default, and you can switch it off.

To know which of these applies, our server reads the country Cloudflare derives from your IP address and answers only "ask" or "do not ask". The country itself is not stored. We have turned off Google's advertising features (Google signals and ad personalisation), and Google Analytics never loads on the sign-in and account pages, in Asset Blox or inside embedded cards. How to change your choice is under Cookies.

We do not use advertising networks, and we do not try to work out who an anonymous visitor is. Google Analytics tells one browser from another by a random identifier kept in a cookie, never by your name, email address or account.

You sign in through a provider of your choice — Discord, Google, GitHub, X or Roblox. We never see or store a password. From the provider we receive and store:

• your display name,
• your email address, when the provider shares one (Roblox and X do not, so those logins carry a placeholder address instead),
• your avatar image URL,
• the provider's account identifier, so you can sign in again and link more providers.

We do not read your messages, contacts, repositories or Roblox inventory, and we do not post on your behalf. Linking several providers to one account is optional and can be undone on your account page.

A session cookie keeps you signed in (see Cookies). Sessions expire on their own and end immediately when you sign out.

• Watchlist — the experiences you star.
• Alert rules — which experience, which condition (for example a concurrent-player threshold), and when a rule last fired.
• Delivery settings — an optional Discord webhook URL and/or a generic webhook URL that you provide. When a rule fires we send the alert payload to those URLs; you control them and can remove them at any time.
• In-app notifications — the alerts we have sent you, and whether you read them.

The Roblox data on Radar itself — experiences, creators, player counts, charts — is public information published by Roblox's own services. It is not data about you.

Rival Ducks Radar for Roblox is an optional browser extension that adds Radar's statistics to roblox.com. What it does with data:

• What it sends. When you open a Roblox experience, a user profile, a community or a page with game tiles, the extension asks rivalducks.com for the public stats of what is on that page, identified by Roblox's own experience, user or community ids. Like every request to our servers, those requests appear in the request logs described under Visiting without an account (your IP address, the address requested and the time); our servers keep those for at most seven days.
• What it asks Roblox. Where a game tile shows a rating but no player count, the extension asks Roblox's public games API (games.roblox.com) for the live count, and for the games it lists on the Roblox home page it asks Roblox's thumbnail API (thumbnails.roblox.com) for their icons, with the same requests roblox.com's own pages make. Those requests go to Roblox, not to us.
• What it never reads. Your Roblox account, Roblox cookies, messages, anything you type, or any site other than roblox.com and rivalducks.com.
• If you are signed in to Rival Ducks. Your browser sends your existing Rival Ducks session cookie with the extension's requests, so it can show and change your watchlist and check every five minutes for new Radar alerts to show as notifications. Nothing new is stored on our side: it is the same watchlist and alerts described under What Radar stores for you.
• What it keeps in your browser. The id of the last alert it showed you, so it does not show it twice. Removing the extension removes it.
• No analytics, no advertising and no third parties in the extension. We never sell or share what it sends.

• Workspaces and membership — the workspaces you create or join, your role, and invitations you send or accept.
• Your content — projects, prompts, reference images you upload, style anchors, and the icons, thumbnails and character concepts that are generated. Files are stored on Cloudflare R2.
• API tokens — if you create tokens for the Asset Blox API or MCP server we store only a hash of each token, never the token itself.
• Usage records — which generations ran, when, and their cost against your workspace's budget. Budgets are internal accounting; the site does not collect payment details today.

AI generation. To produce art, your prompt, the chosen settings and any reference images are sent to our generation provider, kie.ai, which processes them to return the image. We send nothing else about you — no name, email or account identifier. The provider may process that request outside the European Union under its own terms.

• Session cookie (better-auth.session_token, prefixed __Secure- in production) — set only after you sign in; identifies your session. Strictly necessary.
• Theme preference — whether you chose light or dark, kept in your browser's local storage. Never sent to us.
• Cloudflare security cookies (such as __cf_bm) — set by Cloudflare to tell browsers from bots while it protects the site. Strictly necessary.
• Google Analytics cookies (_ga and _ga_<id>, where <id> is our Analytics property) — a random identifier that tells one browser from another, and the state of your current visit. They expire 13 months after your last visit. In the European Economic Area, the United Kingdom, Switzerland and Türkiye they are set only after you accept; elsewhere they are set by default. Optional.
• Your analytics choice (rd-analytics-consent) — your answer to the cookie bar and whether your region requires us to ask, kept in your browser's local storage. Never sent to us.

The Google Analytics cookies are the only optional ones. Where we have to ask, a cookie bar asks before they are set, with "Decline" beside "Accept". To change your choice, use "Cookie settings" in the footer of any company or Radar page. Declining there stops the measurement at once and deletes the Google Analytics cookies from your browser.

• Hetzner Online GmbH — our servers and databases, located in Finland (European Union).
• Cloudflare, Inc. — the network in front of the site (CDN, DDoS protection), file storage for Asset Blox (R2), encrypted off-site backups, and cookieless analytics. Cloudflare's edge is global; the origin data stays in the EU.
• Google — Google Analytics on the company pages and Radar, only where it is on (see Cookies). The service is run by Google (Google LLC, and Google Ireland Limited in Europe). Google receives the pages you view, the page you came from, your device and browser type and, like any server your browser contacts, your IP address, from which it derives an approximate location. It may process them outside your country, including in the United States.
• Your login provider (Discord, Google, GitHub, X or Roblox) — handles the sign-in itself under its own privacy policy.
• Discord and any webhook endpoint you configure — receive the alerts you asked for.
• kie.ai — generates Asset Blox art from the prompts and reference images you submit.

We share personal data with no one else, and we sell it to no one. We would disclose data only if the law required it.

• Account, watchlist, alerts, Asset Blox content — until you delete them or delete your account.
• Sessions — until they expire or you sign out.
• Request logs — briefly, for operations and security.
• Rate-limit counters — minutes.
• Google Analytics — its cookies expire 13 months after your last visit, or at once when you decline. Google keeps the visit-level data for at most 14 months.
• Backups — daily encrypted backups of our databases are kept for up to 14 days locally and off-site, so deleted data can persist in a backup for no longer than 30 days before it is gone everywhere.

Radar's Roblox dataset — public information about experiences and creators — is kept indefinitely; that history is the product.

• Delete — on your account page, "Delete account" removes your login links, sessions, watchlist, alert rules, delivery settings, notifications, Asset Blox tokens, profile and memberships, and replaces your name, email and avatar with anonymous placeholders. Content you created inside a shared Asset Blox workspace stays with that workspace, attributed to a deleted user.
• Access and export — email us and we will send you a copy of the personal data we hold about you.
• Correct — your name, email and avatar come from your login provider; change them there and sign in again.
• Object or restrict — email us; we will explain what we can do.

We answer within 30 days. These rights follow from the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law (KVKK); if you believe we have mishandled your data you may also complain to the data protection authority where you live.

Legal bases. We process account data to provide the service you asked for (contract), and logs and rate limits to keep the service secure (legitimate interest). Google Analytics rests on your consent wherever we ask for it, and elsewhere on our legitimate interest in understanding how the site is used. Either way you can withdraw or object with "Cookie settings" in the footer, and it takes effect at once.

Radar is a public site and can be read at any age. You must be at least 13 years old to create a Rival Ducks account. If we learn that an account belongs to someone younger, we delete it. Parents and guardians can write to us at any time.

Radar collects public statistics and metadata about Roblox experiences — player counts, visits, ratings, names, genres, icons — and the public names of the users and groups that publish them, all from Roblox's public APIs. We add no private information and we do not track Roblox players. Creator names are shown because Roblox shows them on every experience page.

If you are a Roblox creator and believe something we display about you is wrong or should not be there, email [email protected] and we will look at it.

When we change this policy we update the effective date at the top. For changes that matter to you — new data we collect, new recipients — we will also say so on the site before they take effect. The current version always lives at rivalducks.com/privacy.