Privacy & data

Updated October 24, 2026. Rscout helps Roblox developers research public creators and manage collaboration drafts. Contact ajstrong300@gmail.com for data access, corrections, removal requests or support.

Creator catalogue

We store public TikTok and YouTube account identities, available public metrics, discovered video information, discovery hashtags and published professional contact links. Some channel metadata comes from YouTube API Services; other records come from the separate public-data collection pipeline. A discovery hashtag does not establish a creator’s primary niche, availability, consent to outreach or audience demographics. Collection dates are distinct from publication dates.

API-derived caches follow their applicable refresh and expiry rules. Independently reviewed business contact records, source URLs, customer notes, lists and campaigns are stored separately from those caches. A contact does not disappear merely because its discovery cache is stale. Addresses may be incorrect or no longer maintained; a public business address is not a deliverability guarantee. Suppression records are retained to prevent further unwanted contact.

Your workspace

You can create an account with Google basic identity or a one-time email code. We store your account identifier, verified email, optional name/profile image, and secure server-side sessions. Email codes are hashed in storage, expire after 10 minutes and are single use. Google login requests basic profile and email access; it does not authorize campaign email sending. Authentication requests are rate-limited, with limited security records retained to prevent abuse. Lists, notes, selected creators, campaign briefs, reviewed contacts, sender details, drafts and manually recorded outcomes belong to your workspace. The shared public catalogue is separate from your private records. Studio and customer contacts are not offered as creator contacts.

Google mailbox connection

The optional Gmail connection requests permission to send email and verify the connected mailbox identity. It does not read your inbox. Refresh credentials are encrypted in server storage and used only for your workspace. Rscout stores approved send snapshots, provider message identifiers and recorded outcomes. Provider acceptance does not establish delivery. Replies and bounces currently need to be recorded manually.

Disconnecting a customer mailbox revokes its Google grant and removes its stored refresh credential. You can also revoke access through Google account connections. Changing a mailbox or sender details clears existing message approvals.

Connected Google mailbox data is used for the connection and sending features you choose. We do not sell that mailbox data, use it for advertising, or use it to train AI models. Its handling and permitted transfers follow the Google API Services User Data Policy, including its Limited Use rules.

Recipient permission and withdrawal

Public contact details and sender review do not establish recipient permission. The opt-in page shows the studio, sending mailbox and Roblox collaboration marketing purpose. The recipient signs in with a verified receiving email, reads the disclosure, selects an unchecked consent box and submits their choice. Signing in alone does not grant permission. Permission applies to the identified studio and sender, not other customers.

We store permission and withdrawal receipts with a protected reference to the verified recipient, studio and sender details, purpose, policy version, the disclosure shown and its language, time and source invitation or action. These records support permission checks at approval, queueing and immediately before sending. We also store limited session and one-time challenge references to prevent consent replay. Invitation and unsubscribe tokens are stored as hashes.

Recipients can withdraw through their recorded choices or the unsubscribe link in a campaign email. Messages include a visible link and one-click unsubscribe headers for supporting email clients. The web link requires confirmation; opening the page alone does not change a choice. Withdrawal blocks future collaboration marketing from that studio and stops pending messages. Permission and withdrawal records may be retained to document choices, resolve disputes and prevent unwanted contact, including after a workspace deletion request.

Gmail campaign sending and self-test delivery remain paused while recipient opt-in controls and Google review are completed. Draft preparation does not send email. Rscout does not automatically send permission-request emails.

Manage collaboration email choices

AI features

AI message drafting and rewriting send the submitted brief or draft to OpenAI. Creator category filtering does not make an AI request. Thumbnail generation sends your scene description and visual instructions to OpenAI. Avoid putting private or sensitive information in those inputs. AI text requests use the API’s store:false setting. Generated image files are saved in private object storage and are served only to the owning workspace. AI results can be inaccurate and require review.

A limited public-data pilot may send saved public video titles and descriptions to TypeSafe/Jev to label their relationship to Roblox. It does not send Google mailbox data, private workspace records or contact records. Public video text can itself contain names or links. Pilot labels are stored separately and do not decide creator visibility or catalogue counts.

Payments

Stripe hosts checkout and subscription management. Rscout stores the Stripe customer and subscription identifiers, plan, billing dates and usage counts. Card numbers and bank details are handled by Stripe, not stored by Rscout. Stripe receives the billing and contact details needed to process your subscription; Rscout receives payment status events to maintain plan access.

Infrastructure and service providers

Rscout uses Sites hosting and its database/object storage for product records, AWS for the public creator catalogue, Google for optional sign-in and email sending, OpenAI for AI generation, and Stripe for payments when configured. Public profile images and links may load from their originating platforms and receive your browser’s request. External sites have their own privacy practices.

Access and removal

You can archive lists, remove saved creators and disconnect a customer mailbox in the workspace. To request deletion or export of your workspace records or correction of a public creator record, email ajstrong300@gmail.com. We may retain limited billing, security and suppression records where needed to resolve disputes, comply with applicable requirements or prevent unwanted outreach. Archiving preserves records; it is not a deletion request.

Platform terms

Use of YouTube API Services is subject to the YouTube Terms of Service. See the Google Privacy Policy and Stripe Privacy Policy. Rscout is independent of Roblox, TikTok, YouTube and Google.