Legal

1. Introduction

Welcome to Soteria ("Soteria", "we", "our", or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform located at soteria.rip, including our obfuscation service, our Oracle whitelist and key system, our Genesis decompiler, and our Script Library search tool (together, the "Service").

Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.

2. Information We Collect

We may collect the following types of information:

• Account information such as your name, email address, and password. If you sign in using a third-party provider (such as Google or Discord), we receive and store your provider account name and email address.
• Usage data including pages visited, features used, and time spent on the platform.
• Cookies and similar tracking technologies to enhance your experience.
• Payment information processed securely via Stripe. We do not store your card details on our servers. Your Stripe customer ID is stored in your account record.
• Files you submit to the Service for obfuscation or decompilation, limited to plain text, Lua, and Luau script files.
• Login and device information, including your IP address and your browser and operating system details, collected when you sign in to your account and associated with your account to secure it and power session management (see Section 4).
• If you enable two-factor authentication, an encrypted authenticator secret and one-time backup recovery codes, which are stored only in hashed form. We also track the last-used time step to prevent replay attacks.
• API keys generated for programmatic access to the Service. These keys are stored in your account record.
• Email validation data. When you register, we validate your email address by checking your email domain's MX records and comparing them against known disposable, temporary, or suspicious email providers. Accounts using disposable or temporary email addresses may be rejected.
• CAPTCHA verification data. We use Cloudflare Turnstile to protect forms against automated abuse. Turnstile may collect interaction data to determine whether you are a human user.
• Any data included in HTTP requests sent to our platform, including headers, query parameters, and request body content.
• Event logs generated by your activity on the platform, including but not limited to obfuscating scripts, signing up, signing in, redeeming codes, generating or revoking keys, creating or modifying Oracle services and scripts, and other significant account actions. These logs may include timestamps, your account identifier, IP address, and metadata about the action performed.
• Usage metrics, including daily obfuscation counts, script execution counts, decompilation counts, and key generation counts, tracked per user and globally for operational and analytics purposes.
• Username change timestamps. When you change your username, we record the date of the change to enforce a cooldown period.
• If you link a Discord server to your account using our Discord bot, we collect and store the Discord server (guild) ID, server name, and server icon, along with which Oracle service the server is bound to and which Discord roles have been granted access to bot commands. See Section 3 for details.

Event logs are recorded to internal logging systems for security, abuse prevention, and operational monitoring purposes. These logs are not publicly accessible and are retained for as long as necessary to fulfill their security and operational purpose.

3. Script, Oracle, and Gateway Data

When you use the obfuscator, Oracle (our whitelist and key system), Genesis (our decompiler), or interact with a gateway, we collect certain data to operate, secure, and improve the Service. The specific data collected depends on the context:

4. Account Login Sessions

When you sign in to your account, we create a session and store limited information about the device used to access it, so that you can review and manage where your account is logged in. For each active session, we store:

• The IP address the login originated from.
• Browser and operating system information, derived from your browser's user agent.
• An approximate location (country), derived from the IP address.
• The time the session was created and the time it was last active.

We use this information to operate the account session manager, which lets you see your active sessions and sign out of a specific device or all other devices, to help secure your account, and to detect and respond to unauthorized access. When sessions are shown to you in the interface, IP addresses are partially masked.

This data is linked to your account and retained for the life of the session. A session, along with the data stored for it, is deleted when you sign out of it, when it is revoked (including when you or a password change signs out other devices), or automatically after 30 days of inactivity. Changing your account password signs out all of your other active sessions.

5. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service, including the obfuscator, Oracle, and Genesis.
• Process transactions and send related information.
• Send administrative information such as updates or security alerts.
• Improve and personalize your experience on our platform.
• Analyze usage trends to enhance features and performance.
• Detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service.
• Look up IP addresses and email addresses using third-party geolocation, intelligence, or verification services for security, abuse prevention, and legal purposes. The specific services we use may change over time without notice.
• Log significant account events to internal systems for security monitoring and incident response.
• Comply with legal obligations and enforce our terms.

Where required by law, our legal basis for this processing is the performance of our contract with you through these Terms, our legitimate interest in operating a secure and functioning Service, your consent where you have given it, or compliance with a legal obligation.

Automated Decision-Making

The Service uses automated systems to make certain decisions without human review. These include, but are not limited to:

• Automatic account suspension upon initiation of a payment chargeback or dispute.
• Automatic rejection of account registration attempts using disposable, temporary, or suspicious email addresses based on MX record validation.
• Automatic rate limiting of requests based on IP address, API key, or Oracle key usage patterns.
• Automatic enforcement of HWID, User ID, and usage limits on Oracle keys.
• Automatic scanning of uploaded scripts for indicators of malware or Terms of Service violations.

These automated decisions are made to protect the security and integrity of the Service and to enforce our Terms of Service. If you believe an automated decision has been made in error, you may contact us to request a manual review, though we are not obligated to reverse any automated action.

6. Advertising

Gateway pages on the Service require you to complete one or more checkpoints powered by third-party monetization providers before a key is issued. The providers currently supported are Work.ink, Linkvertise, and LootLabs. Script owners choose which provider to use for their gateway links.

In addition, Soteria automatically injects its own checkpoint on gateway links belonging to users on the Plus membership. This additional checkpoint uses the same provider the script owner has already selected for their gateway, Work.ink, Linkvertise, or LootLabs, rather than a fixed provider chosen by Soteria. Users on all other memberships are exempt from this additional checkpoint.

These third-party providers may use cookies, web beacons, or similar technologies to collect information about your browsing activity. This information may include your IP address, browser type, device information, pages visited, and the date and time of your visit. This data is collected and processed by the respective provider, not by Soteria, and is subject to that provider's own privacy policy.

We do not control the data collection practices of these third-party providers, and we are not responsible for how they use the information they collect. We encourage you to review the privacy policies of any third-party provider whose checkpoints appear on the Service. You may be able to opt out of personalized advertising through your browser settings or through industry opt-out tools.

Google AdSense

We display ads on certain pages of the Service (such as gateway and blocked-script pages) through Google AdSense. Google may use cookies and similar technologies to serve ads, measure their performance, and, where you have granted consent, personalize the ads shown to you based on your prior visits to this and other websites. Ads are served regardless of your cookie choice, but Google will only use cookies to personalize ads or measure ad performance if you have consented to the Marketing cookie category through the consent banner presented on the Service. You can review and change this choice at any time, and can learn more about how Google uses this data, or opt out of personalized advertising entirely, at policies.google.com/technologies/partner-sites and adssettings.google.com.

7. Cookies

We use cookies and similar tracking technologies to track activity on our platform and hold certain information. Cookies are small files sent to your browser from a website and stored on your device. Cloudflare may also set cookies or use similar technologies as part of delivering and securing the Service.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, some portions of the Service may not function properly. We do not currently respond to browser "Do Not Track" signals. For more details, see our Cookie Policy.

8. Sharing Your Information

We do not sell, trade, or rent your personal information to third parties. We share data with the service providers that help us build and operate Soteria, and in certain cases with Oracle service creators as described below:

• Stripe, for payment processing. Your name and email address are shared with Stripe solely to create and manage your billing account. Your Stripe customer ID is stored in your Soteria account.
• Hosting and infrastructure providers, who run the servers the Service operates on.
• Cloudflare, which delivers, accelerates, and secures the Service, including protection against abuse and attacks. We also use Cloudflare Turnstile for CAPTCHA verification on forms such as sign-up and password reset.
• Third-party email delivery services, for sending account verification emails, password reset emails, and other essential account communications. Your email address is shared with these providers solely for the purpose of delivering these messages.
• Third-party hosting services, which store script content for saved pastes and Oracle scripts. Script metadata (title, author, timestamps) is stored on our servers, while the script content itself is stored by the third-party hosting provider.
• Roblox Corporation APIs, which we use to retrieve publicly available avatar thumbnails for Roblox User IDs associated with Oracle keys. Your Roblox User ID may be sent to Roblox's thumbnail API to display your avatar in the Soteria dashboard.
• Third-party geolocation, intelligence, and verification services, which we may use to look up IP addresses and email addresses for security, fraud prevention, abuse detection, and legal purposes. Your IP address or email address may be sent to these services to retrieve information such as approximate location, ISP, threat indicators, or email validity. The specific services we use may change over time, and we are not required to disclose or maintain a fixed list of providers.
• Third-party monetization providers, currently Work.ink, Linkvertise, and LootLabs, which power gateway checkpoints on the Service. Soteria also automatically injects an additional checkpoint, using the same provider the script owner selected, for users on the Plus membership. These providers may collect browsing data through cookies and similar technologies. See Section 6 for details.
• Google, through Google AdSense, which serves ads on certain pages of the Service and may collect browsing data through cookies and similar technologies, including for ad personalization where you have consented. See Section 6 for details.
• Google and Discord, if you choose to sign in using their OAuth services. When you authenticate with Google or Discord, we receive your account name and email address from the provider. We do not receive or store your password for these providers.
• Oracle service creators, who may receive execution data about end users of their scripts through webhook logging and the Soteria dashboard. This may include your Roblox profile link (derived from your User ID), approximate geolocation (country), device type, executor type, HWID, and the Oracle key used. This data is disclosed to enable service creators to manage and monitor their own services. Soteria does not control how service creators use, store, or share this data, and assumes no responsibility for their handling of it. See Section 3 for details.

Each of these providers only receives the data necessary for them to perform their function for us, and is bound by their own privacy practices. Stripe's privacy policy can be found at stripe.com/privacy, and Cloudflare's at cloudflare.com/privacypolicy.

We may also disclose information when required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Soteria, our users, or others.

Data Controller and Processor Roles

For personal data relating to your own Soteria account (such as your email address, login sessions, and billing identifiers), Soteria is the data controller. For personal data collected from the end users of a script through an Oracle service or a gateway, and then disclosed to the Oracle service creator through webhook logging or the dashboard, the service creator is the data controller, and Soteria acts only as a data processor or service provider handling that data on the creator's behalf and on their instructions. The service creator is responsible for establishing a lawful basis for that collection and for providing any notice to, or obtaining any consent from, their end users that applicable law requires. Soteria is not responsible for a service creator's failure to meet those obligations.

9. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy, or as required by law. Uploaded scripts are not retained at all; they exist only in memory during processing and are deleted immediately afterward, as described in Section 3. For Oracle key data specifically, HWIDs and User IDs are retained until the associated key is deleted, revoked, or expires, and gateway-collected IP addresses are retained only until the gateway flow is completed or expires, as described in Section 3. Login session data, including the IP address and device information associated with each session, is retained until the session is signed out, revoked, or inactive for 30 days, as described in Section 4. When data is no longer needed, we securely delete or anonymize it.

Security and event logs (as described in Section 2) may be retained after your account is deleted or terminated. These logs are kept for security, abuse prevention, fraud investigation, legal compliance, and dispute resolution purposes. We retain these logs for as long as we determine is reasonably necessary to fulfill these purposes, which may extend beyond the life of your account. This retention is based on our legitimate interest in maintaining the security and integrity of the Service and complying with legal obligations.

10. Your Rights

Depending on your location, you may have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your personal data.
• Request that we restrict or limit how we process your data.
• Request a portable copy of your data.
• Request that we stop processing your data where it is based on consent you previously gave.

To submit any of these requests, please contact us. Submitting a request does not guarantee a particular outcome. We may decline a request, in whole or in part, where we have a legal basis to retain or continue processing the data, including where the data is needed to complete a transaction, comply with a legal obligation, resolve a dispute, enforce our Terms of Service, or detect, investigate, or prevent fraud, abuse, or security incidents, including attempts to reverse engineer, attack, or compromise the Service. We may also need to verify your identity before fulfilling a request.

EEA, UK, and Swiss Users

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to object to processing that is based on our legitimate interests, and the right to lodge a complaint with your local data protection or supervisory authority. Where we transfer personal data outside your home country, we rely on appropriate safeguards recognized under applicable law, such as the European Commission's Standard Contractual Clauses or an equivalent transfer mechanism.

California Privacy Rights

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it, to request access to that information, and to request its deletion or correction, subject to the exceptions described above. You also have the right not to receive discriminatory treatment for exercising these rights. We do not sell your personal information for monetary consideration. Our use of Google AdSense to serve personalized ads, where you have consented to the Marketing cookie category, may constitute "sharing" for cross-context behavioral advertising as defined under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). You can opt out of this sharing at any time by rejecting or disabling the Marketing category in the cookie consent banner presented on the Service, which stops Google from using cookies to personalize ads or associate your activity across sites. To exercise any of these rights, contact us using the details in Section 15.

11. Security

We implement industry-standard security measures to protect your personal information, including encryption, secure servers, and access controls. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

This includes credentials, tokens, and secrets used to operate the Service and its integrations, such as our Discord bot. We take reasonable measures to protect these credentials, but we cannot guarantee that they will never be compromised, and we are not responsible for actions taken by a third party who obtains one through no fault of our own, or for actions taken through a Discord role or account that a service creator has authorized under Section 3.

Authorized Soteria administrators may access your account information, session data (including unmasked IP addresses), activity logs, and other data associated with your account for the purposes of security, abuse investigation, support, and enforcement of our Terms of Service. This includes analytics and usage data associated with your Oracle services and scripts, such as execution counts, key counts, live user counts, and gate/checkpoint metrics, which we may review to provide support, diagnose issues, monitor for abuse, and operate and improve the Service. Administrative access is limited to authorized personnel and is subject to internal access controls.

Data Breach

In the event of a data breach or security incident affecting personal information, Soteria may, at its sole discretion, notify affected users by email, in-app notification, or a notice posted on the Service. However, Soteria is under no obligation to notify individual users of any data breach, security incident, unauthorized access, or data loss, except where specifically required by applicable law. To the fullest extent permitted by law, you waive any right to receive notification of a data breach or security incident beyond what is legally mandated in your jurisdiction. You acknowledge that no system is completely secure and that the risk of a data breach is inherent in using any online service.

12. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any personal information.

13. Children's Privacy

Account registration is limited to individuals who are at least 13 years old, or the minimum age of digital consent in their country if that age is higher, as described in our Terms of Service. The Service and its website are not directed to children under 13, and we do not knowingly collect personal information directly from children under 13 for the purpose of creating or operating an account.

Oracle and gateway features may collect technical identifiers, such as Hardware IDs, in-game or platform User IDs, and IP-derived country, from the end users of scripts created by Oracle service creators. Soteria does not knowingly solicit this data from children, does not use it to build profiles of children, and collects it only to operate access control, security, and analytics on behalf of the service creator. Where these end users are children, the Oracle service creator is the data controller for that data (see the Data Controller and Processor Roles part of Section 8) and is responsible for complying with any law that applies to the collection of children's data, including the Children's Online Privacy Protection Act (COPPA), the GDPR, the UK Age Appropriate Design Code, and any similar law, and for obtaining any parental consent those laws require.

If you are a parent or guardian and believe that a child under 13 has provided personal information to us directly, or that a child's information has been collected through the Service, please contact us at [email protected] and we will take reasonable steps to delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time, at our sole discretion and without prior notice. The "Last updated" date at the top of this page reflects the most recent revision. We are under no obligation to notify you individually of any changes, and your continued use of the Service after a revision is posted constitutes acceptance of the updated policy. We encourage you to review this policy periodically to stay informed about how we protect your data.

15. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us: