- We collect what it takes to serve loaders and stop key sharing: your email, your account key in hashed form, device signals from the machines that run your scripts, IP addresses and execution counts.
- Your script source is encrypted, never shared and never used to train anything.
- Device activity, including IP addresses, is deleted after 90 days.
- We don’t sell personal data. Linkvertise only sees someone when they start an ad unlock.
01Who this covers
Two groups of people touch AegisLoader, and we collect different things from each.
- Developers have an AegisLoader account. They upload scripts, choose how each one is unlocked, and manage license keys and devices from the dashboard.
- End users run a developer’s protected script through its loader line. They never create an AegisLoader account, but the loader talks to our servers every time the script runs.
“We” means AegisLoader, the service at aegisloader.com and api.aegisloader.com. This policy applies to both groups. Section 07 explains how responsibility is split between us and developers for end-user data.
02What we collect
From developers
- Account email until you delete the account
- Your recovery address. We use it to send verification codes and, after a code check, your account key when you ask for it back. No newsletters.
- Account key until you delete the account
- Logins are checked against a one-way hash of the key. A separately encrypted copy exists only so the key can be sent back to your verified recovery email.
- Username and settings until you delete the account
- The optional username you pick, your plan, and the settings for your projects, key systems and ad rewards.
- Scripts you upload until you delete the project
- Source files and the protected builds we compile from them. Section 04 covers how we treat these.
- Billing records as long as tax law requires
- Your payment processor handles card details. We receive a customer reference, your plan, amounts and payment status. We never see or store your full card number.
From end users, through the loader
- Device fingerprint while the license exists
- A fingerprint built from three things: the account and license the script runs under, hardware signals from the machine, and a random install ID the loader creates on first run. It’s what lets a license key lock to one device.
- Runtime details kept with the device record
- The Roblox username the script runs under, the executor name and the operating system. Developers see these on their Devices page to tell machines apart.
- IP address and approximate country 90 days
- Logged with each activation, validation and execution for abuse prevention, like spotting one key moving between countries every few minutes.
- Execution and security events 90 days, then counts only
- Each run, key activation, validation and ad unlock, plus flags such as tamper attempts, detected hooks or a VM. After 90 days only anonymous daily totals remain for the developer’s charts.
From everyone who visits the site
Cloudflare processes every request to aegisloader.com, including your IP address and browser details, to deliver pages and block attacks. Cloudflare Turnstile runs a bot check when you register. The dashboard keeps your session token in your browser’s storage. We don’t use advertising cookies.
03Why we use it
- To run the service. Compile and serve protected builds, check license keys, and bind each key to the first device that activates it.
- To stop abuse. Catch shared keys, tampering, credential stuffing and bulk signups, and investigate malware reports.
- To give developers their dashboard. Execution charts, device lists and security flags are all built from the loader data above.
- To bill you. Plans, renewals and receipts.
- To talk to you. Verification codes, key recovery, billing notices and changes to these policies. We don’t send marketing email.
Where the law asks for a legal basis: running the service is necessary to perform our contract with developers; abuse prevention and dashboard analytics rely on our legitimate interest in keeping the service secure and useful; billing records are kept because tax law requires them.
04Your scripts’ source code
Your source is the most sensitive thing you give us, so it gets the strictest rules.
- It’s encrypted at rest and only decrypted inside the build pipeline that compiles your protected builds.
- It’s never shared with anyone: not other developers, not end users, not partners.
- It’s never used to train anything, ours or anyone else’s, and never used to improve the obfuscator.
- Nobody on our side opens it during normal operation. The one exception: if a build is reported as malware, we may inspect that build to act on the report, as described in the Terms.
End users only ever receive protected builds, and each download is unique. Deleting a project deletes its source and builds within 24 hours.
05How long we keep it
- Device activity (events, IP addresses, security flags): 90 days, then deleted. Daily execution totals with no device or IP attached stay for your charts.
- Device records (fingerprint and runtime details) bound to a license: as long as that license exists, and 90 days after it’s revoked or expires, so you can still look up who held it.
- Account data and scripts: until you delete them. After you delete your account, everything is removed from live systems within 30 days and from backups within the following 30.
- Billing records: for as long as tax and accounting law requires, even after you delete your account.
07Developers and their users
When you protect a script with AegisLoader, you decide who runs it and how it unlocks. We collect end-user data so that your script and your licensing rules work. That makes you responsible for telling your users:
- that your script uses AegisLoader for delivery and licensing;
- that running it sends device signals, an IP address and their Roblox username to AegisLoader;
- where to read more. Linking this page in your script’s Discord or description is enough for most developers.
You can only use end-user data from your dashboard to manage your own licenses and stop abuse of your own scripts. Don’t export it to build profiles of players, and don’t share it publicly.
If an end user contacts us directly, we’ll handle their request and let you know when it affects a license, for example when deleting their device record unbinds a key.
08Your rights and deletion
Wherever you live, you can ask us to:
- See what we hold about you, and get a copy in a machine-readable format.
- Correct it. You can change your recovery email yourself under Profile.
- Delete it. Deleting your account removes your projects, keys, licenses and the device data attached to them. Your loader lines stop working right away.
- Object to or restrict processing we base on legitimate interest.
Developers: email [email protected] from your recovery address, or open a ticket in our Discord. We’ll confirm it’s you with a code sent to that email, then act within 30 days.
End users: ask the developer of the script, or contact us with your Roblox username and the script’s name. We’ll delete the device records we can tie to you. Any license key locked to that device will be unbound.
If you’re in the EU, UK or a US state with a privacy law, you can also complain to your local data protection authority. We’d rather you talk to us first.
09Children
AegisLoader accounts are not for anyone under 13. If you’re between 13 and the age of majority where you live, you need a parent or guardian’s permission, and they handle any payment.
Roblox has a lot of younger players, so scripts protected with AegisLoader may be run by kids. The loader never asks for a name, email or age. It collects the technical data in section 02, which we use only to run and secure the service. If you believe a child under 13 created an account, or that we hold a child’s data that shouldn’t be here, contact us and we’ll delete it.
10Security
All traffic runs over TLS. Account keys are hashed for login checks. Source code and the recoverable copy of your key are encrypted with keys stored apart from the data. Staff access to production is limited to the people who need it, and every access is logged.
No system is perfect. If we learn of a breach that affects your data, we’ll email affected developers without undue delay and post what happened in our Discord.
11Changes to this policy
We’ll update the date at the top whenever this page changes. For changes that affect what we collect or who we share it with, we email every developer at least 14 days before they take effect and post a note in Discord.
12Contact
Privacy questions, data requests and anything this page doesn’t answer:
- Email [email protected]
- Open a ticket in our Discord server